[bug2796] Richedit bug

[Krzysztof Foltman]

Ann and Jason Edmeades wrote:

> WCHAR *p = ALLOC_N_OBJ(WCHAR, nLen+1);
> #define ALLOC_N_OBJ(type, count) (type *)HeapAlloc(me_heap, 0,
> count*sizeof(type))

That is so embarrasing! They teach this in the nursery school :/

By coincidence, I've spent at least half an hour today on finding the 
memory overwrite elsewhere, which turned out to be caused by the bug above.

The buffer overrun comment refers to something else - I'm not sure if 
WideCharToMultiByte will produce single byte character string for ANSI 
codepages. If it produced a real multibyte string, it could exceed the 
buffer supplied by the application.

Krzysztof