Joseph Galbraith wrote:
If it is, RtlQueryEnvironmentVariable_U() could succeeded even if a zero length buffer is passed in. And then, would we crash appending the NUL termination?
That's true, i forgot to handle that case, it should be fixed in r16555.
Best Regards, Thomas