From ebec2dd826ad3292fc772d780fc31f83622ed2ed Mon Sep 17 00:00:00 2001
From: Pierre Schweitzer <pierre@reactos.org>
Date: Sat, 20 Nov 2010 12:07:24 +0000
Subject: [PATCH] [NTOSKRNL] Fix potential buffer overflow

svn path=/trunk/; revision=49659
---
 reactos/ntoskrnl/ke/freeldr.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/reactos/ntoskrnl/ke/freeldr.c b/reactos/ntoskrnl/ke/freeldr.c
index 866d0a7ca2b..9dfc8eb9e07 100644
--- a/reactos/ntoskrnl/ke/freeldr.c
+++ b/reactos/ntoskrnl/ke/freeldr.c
@@ -1206,14 +1206,10 @@ KiRosFrldrLpbToNtLpb(IN PROS_LOADER_PARAMETER_BLOCK RosLoaderBlock,
                               0,
                               &Base);
     
-    //
-    // Check if we have a ramdisk
-    //
+    /* Check if we have a ramdisk */
     if ((RosLoaderBlock->RdAddr) && (RosLoaderBlock->RdLength))
     {
-        //
-        // Build a descriptor for it
-        //
+        /* Build a descriptor for it */
         KiRosAllocateNtDescriptor(LoaderXIPRom,
                                   KERNEL_DESCRIPTOR_PAGE(RosLoaderBlock->RdAddr),
                                   (RosLoaderBlock->RdLength + PAGE_SIZE - 1) >> PAGE_SHIFT,
@@ -1267,7 +1263,7 @@ KiRosFrldrLpbToNtLpb(IN PROS_LOADER_PARAMETER_BLOCK RosLoaderBlock,
     HalPath = strchr(BootPath + 1, ' ');
     *HalPath = ANSI_NULL;
     BldrNtBootPath[0] = '\\';
-    strncat(BldrNtBootPath, BootPath + 1, 63);
+    strncat(BldrNtBootPath, BootPath + 1, 61);
     strcat(BldrNtBootPath,"\\");
     LoaderBlock->NtBootPathName = BldrNtBootPath;