Piotr Caban : msvcrt: Fix buffer size in _ecvt_s.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f48cfa2be0e0d199072308cd759c2e75734a7cd1
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f48cfa2be0e0d199072308cd759c2e75734a7cd1

Author: Piotr Caban <piotr at codeweavers.com>
Date:   Wed Mar 30 20:33:06 2011 +0200

msvcrt: Fix buffer size in _ecvt_s.

---

 dlls/msvcrt/math.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dlls/msvcrt/math.c b/dlls/msvcrt/math.c
index ab9cec4..3428398 100644
--- a/dlls/msvcrt/math.c
+++ b/dlls/msvcrt/math.c
@@ -1306,17 +1306,17 @@ int CDECL _ecvt_s( char *buffer, MSVCRT_size_t length, double number, int ndigit
             (*sign) = 0;
         return 0;
     }
-    result = (char*)MSVCRT_malloc(max(ndigits + 7, 7));
+    /* handle cases with zero ndigits or less */
+    prec = ndigits;
+    if( prec < 1) prec = 2;
+    result = (char*)MSVCRT_malloc(prec + 7);
 
     if( number < 0) {
         *sign = TRUE;
         number = -number;
     } else
         *sign = FALSE;
-    /* handle cases with zero ndigits or less */
-    prec = ndigits;
-    if( prec < 1) prec = 2;
-    len = snprintf(result, 80, "%.*le", prec - 1, number);
+    len = snprintf(result, prec + 7, "%.*le", prec - 1, number);
     /* take the decimal "point away */
     if( prec != 1)
         memmove( result + 1, result + 2, len - 1 );