[tfaber] 71379: [SETUPAPI] - Fix Buffer overflow in FixupServiceBinaryPath

Author: tfaber
Date: Sun May 22 19:09:49 2016
New Revision: 71379

URL: http://svn.reactos.org/svn/reactos?rev=71379&view=rev
Log:
[SETUPAPI]
- Fix Buffer overflow in FixupServiceBinaryPath

Modified:
    trunk/reactos/dll/win32/setupapi/install.c

Modified: trunk/reactos/dll/win32/setupapi/install.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/win32/setupapi/install…
==============================================================================
--- trunk/reactos/dll/win32/setupapi/install.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/win32/setupapi/install.c	[iso-8859-1] Sun May 22 19:09:49 2016
@@ -1748,10 +1748,8 @@
         /* Handle Win32-services differently */
         if (ServiceType & SERVICE_WIN32)
         {
-            Win32Length = (ServiceLength -
-                RosDirLength - 1 + 13) * sizeof(WCHAR);
-            /* -1 to not count the separator after C:\ReactOS
-               wcslen(L"%SystemRoot%\\") = 13*sizeof(wchar_t) */
+            Win32Length = (ServiceLength - RosDirLength) * sizeof(WCHAR)
+                        - sizeof(L'\\') + sizeof(L"%SystemRoot%\\");
             Buffer = MyMalloc(Win32Length);
 
             wcscpy(Buffer, L"%SystemRoot%\\");