On 2014-08-14 22:10, hbelusca(a)svn.reactos.org wrote:
  +    if (FaceName != GuiData->GuiInfo.FaceName)
 +    {
 +        SIZE_T Length = min(wcslen(FaceName) + 1, LF_FACESIZE); // wcsnlen
 +        wcsncpy(GuiData->GuiInfo.FaceName, FaceName, LF_FACESIZE);
 +        GuiData->GuiInfo.FaceName[Length] = L'\0'; // NULL-terminate
 +    } 
Buffer overflow. You mean [Length - 1]