[PATCH 0/1] MR3766: uninstaller: Allocate space for null terminator in FetchFromRootKey.

[PATCH 1/1] uninstaller: Allocate space for null terminator in FetchFromRootKey.

[Alex Henrie]

From: Alex Henrie

---
 programs/uninstaller/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/programs/uninstaller/main.c b/programs/uninstaller/main.c
index 027937ba255..cc14b5eef6c 100644
--- a/programs/uninstaller/main.c
+++ b/programs/uninstaller/main.c
@@ -258,7 +258,7 @@ static int FetchFromRootKey(HKEY root)
                 type == REG_DWORD && value == 1)
             {
                 command = HeapAlloc(GetProcessHeap(), 0,
-                        (lstrlenW(L"msiexec /x%s") + lstrlenW(subKeyName)) * sizeof(WCHAR));
+                        sizeof(L"msiexec /x%s") + wcslen(subKeyName) * sizeof(WCHAR));
                 wsprintfW(command, L"msiexec /x%s", subKeyName);
             }
             else if (!RegQueryValueExW(hkeyApp, L"UninstallString", NULL, NULL, NULL, &uninstlen))

[Alex Henrie (＠alexhenrie)]

I misread the code here: It's actually _overallocating_ by 1 character. Although `lstrlenW` doesn't count the null terminator, the first string it's called on includes `%s` which is two extra characters. I'll push a new patch that makes more sense.