On 2014-08-14 22:10, hbelusca(a)svn.reactos.org wrote:
+ if (FaceName != GuiData->GuiInfo.FaceName)
+ {
+ SIZE_T Length = min(wcslen(FaceName) + 1, LF_FACESIZE); // wcsnlen
+ wcsncpy(GuiData->GuiInfo.FaceName, FaceName, LF_FACESIZE);
+ GuiData->GuiInfo.FaceName[Length] = L'\0'; // NULL-terminate
+ }
Buffer overflow. You mean [Length - 1]