From 5a7f64ba982fefa06178186ef4a7e0f0e832dff9 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sun, 22 May 2016 19:09:49 +0000
Subject: [PATCH] [SETUPAPI] - Fix Buffer overflow in FixupServiceBinaryPath

svn path=/trunk/; revision=71379
---
 reactos/dll/win32/setupapi/install.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/reactos/dll/win32/setupapi/install.c b/reactos/dll/win32/setupapi/install.c
index bfa67670325..8408cb6a84e 100644
--- a/reactos/dll/win32/setupapi/install.c
+++ b/reactos/dll/win32/setupapi/install.c
@@ -1748,10 +1748,8 @@ static VOID FixupServiceBinaryPath(
         /* Handle Win32-services differently */
         if (ServiceType & SERVICE_WIN32)
         {
-            Win32Length = (ServiceLength -
-                RosDirLength - 1 + 13) * sizeof(WCHAR);
-            /* -1 to not count the separator after C:\ReactOS
-               wcslen(L"%SystemRoot%\\") = 13*sizeof(wchar_t) */
+            Win32Length = (ServiceLength - RosDirLength) * sizeof(WCHAR)
+                        - sizeof(L'\\') + sizeof(L"%SystemRoot%\\");
             Buffer = MyMalloc(Win32Length);
 
             wcscpy(Buffer, L"%SystemRoot%\\");