fixed two bugs (spotted by w3seek)
Modified: trunk/reactos/subsys/system/msconfig/startuppage.c
Modified: trunk/reactos/subsys/system/notepad/main.c

Modified: trunk/reactos/subsys/system/msconfig/startuppage.c
--- trunk/reactos/subsys/system/msconfig/startuppage.c	2006-01-08 20:12:11 UTC (rev 20727)
+++ trunk/reactos/subsys/system/msconfig/startuppage.c	2006-01-08 20:33:14 UTC (rev 20728)
@@ -75,7 +75,7 @@
             {
                 dwValueLength = MAX_KEY_LENGTH;
                 dwDataLength = MAX_VALUE_NAME;
-                Data = (TCHAR*) HeapAlloc(GetProcessHeap(), 0, MAX_VALUE_NAME);
+                Data = (TCHAR*) HeapAlloc(GetProcessHeap(), 0, MAX_VALUE_NAME * sizeof(TCHAR));
                 if (Data == NULL)
                     break;
                 retVal = RegEnumValue(hKey, Index, lpValueName, &dwValueLength, NULL, &dwType, (LPBYTE)Data, &dwDataLength);

Modified: trunk/reactos/subsys/system/notepad/main.c
--- trunk/reactos/subsys/system/notepad/main.c	2006-01-08 20:12:11 UTC (rev 20727)
+++ trunk/reactos/subsys/system/notepad/main.c	2006-01-08 20:33:14 UTC (rev 20728)
@@ -37,7 +37,7 @@
 {
     lstrcpy(Globals.szFileName, szFileName);
     Globals.szFileTitle[0] = 0;
-    GetFileTitle(szFileName, Globals.szFileTitle, wcslen(Globals.szFileTitle));
+    GetFileTitle(szFileName, Globals.szFileTitle, sizeof(Globals.szFileTitle) / sizeof(Globals.szFileTitle[0]));
 }
 
 /***********************************************************************