Zebediah Figura (@zfigura) commented about dlls/user32/msgbox.c:
GetWindowTextW(hItem, buffer, 1024);while(buffer[j] != 0){if(buffer[j] != '&')text[k++] = buffer[j];j++;}text[k] = 0;lstrcatW(text, spaces);}}lstrcatW(text, carriage);lstrcatW(text, line);hMem = GlobalAlloc(GMEM_MOVEABLE|GMEM_DDESHARE|GMEM_ZEROINIT, (len + 1) * sizeof(WCHAR));
GMEM_ZEROINIT isn't doing anything here.
"(len + 1) * sizeof(WCHAR)" is wrong, since "len" is already in bytes and includes the null terminator.