From 2e9aa30294de7bc8c6339177e2af23318641eeb1 Mon Sep 17 00:00:00 2001
From: Aleksey Bragin <aleksey@reactos.org>
Date: Sat, 14 Jul 2012 12:02:19 +0000
Subject: [PATCH] [EXPLORER_NEW] - Fix possible buffer overflow:
 ExpandEnvironmentStrings wants character count size of a buffer, not byte
 sized. Spotted by Thomas Faber. See issue #6053 for more details.

svn path=/trunk/; revision=56888
---
 reactos/base/shell/explorer/services/startup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reactos/base/shell/explorer/services/startup.c b/reactos/base/shell/explorer/services/startup.c
index c8f79623dd9..306c5613733 100644
--- a/reactos/base/shell/explorer/services/startup.c
+++ b/reactos/base/shell/explorer/services/startup.c
@@ -245,7 +245,7 @@ static int runCmd(LPWSTR cmdline, LPCWSTR dir, BOOL wait, BOOL minimized)
     DWORD exit_code=0;
     WCHAR szCmdLineExp[MAX_PATH+1]= L"\0";
 
-    ExpandEnvironmentStrings(cmdline, szCmdLineExp, sizeof(szCmdLineExp));
+    ExpandEnvironmentStringsW(cmdline, szCmdLineExp, sizeof(szCmdLineExp) / sizeof(WCHAR));
 
     memset(&si, 0, sizeof(si));
     si.cb=sizeof(si);