When len is 256, (ARRAY_SIZE(title) - len) is 0. When LoadStringW() is called with the last parameter being zero, a WCHAR string pointer is stored at 'title + 256', writing title out of bounds. |
||
---|---|---|
.. | ||
tests | ||
compstui.rc | ||
compstui.spec | ||
compstui_main.c | ||
Makefile.in |