diff --git a/dlls/kernel32/profile.c b/dlls/kernel32/profile.c
index 9b6b1a1..ad43677 100644
--- a/dlls/kernel32/profile.c
+++ b/dlls/kernel32/profile.c
@@ -1084,17 +1084,14 @@ static int PROFILE_GetPrivateProfileString( LPCWSTR section, LPCWSTR entry,
     /* strip any trailing ' ' of def_val. */
     if (def_val)
     {
-        LPCWSTR p = &def_val[strlenW(def_val)]; /* even "" works ! */
+        LPCWSTR p = &def_val[strlenW(def_val) - 1];
 
-	while (p > def_val)
-	{
-	    p--;
-	    if ((*p) != ' ')
-		break;
-	}
-	if (*p == ' ') /* ouch, contained trailing ' ' */
-	{
-	    int len = (int)(p - def_val);
+        while (p > def_val && *p == ' ')
+            p--;
+
+        if (p >= def_val)
+        {
+            int len = (int)(p - def_val) + 1;
 
             defval_tmp = HeapAlloc(GetProcessHeap(), 0, (len + 1) * sizeof(WCHAR));
             memcpy(defval_tmp, def_val, len * sizeof(WCHAR));
diff --git a/dlls/kernel32/tests/profile.c b/dlls/kernel32/tests/profile.c
index 81999dc..414b596 100644
--- a/dlls/kernel32/tests/profile.c
+++ b/dlls/kernel32/tests/profile.c
@@ -418,21 +418,15 @@ static void test_GetPrivateProfileString(void)
     lstrcpyA(buf, "kumquat");
     ret = GetPrivateProfileStringA("", "name1", "default  ",
                                    buf, MAX_PATH, filename);
-    todo_wine
-    {
-        ok(ret == 7, "Expected 7, got %d\n", ret);
-        ok(!lstrcmpA(buf, "default"), "Expected \"default\", got \"%s\"\n", buf);
-    }
+    ok(ret == 7, "Expected 7, got %d\n", ret);
+    ok(!lstrcmpA(buf, "default"), "Expected \"default\", got \"%s\"\n", buf);
 
     /* lpAppName is empty, many blank characters in lpDefault */
     lstrcpyA(buf, "kumquat");
     ret = GetPrivateProfileStringA("", "name1", "one two  ",
                                    buf, MAX_PATH, filename);
-    todo_wine
-    {
-        ok(ret == 7, "Expected 7, got %d\n", ret);
-        ok(!lstrcmpA(buf, "one two"), "Expected \"one two\", got \"%s\"\n", buf);
-    }
+    ok(ret == 7, "Expected 7, got %d\n", ret);
+    ok(!lstrcmpA(buf, "one two"), "Expected \"one two\", got \"%s\"\n", buf);
 
     /* lpAppName is empty, blank character but not trailing in lpDefault */
     lstrcpyA(buf, "kumquat");
-- 
1.5.4.3