kernel32: GetTempPathW must zero the remaining buffer

[Bruno Jesus]

Fixes bug https://bugs.winehq.org/show_bug.cgi?id=34716
-------------- next part --------------
diff --git a/dlls/kernel32/path.c b/dlls/kernel32/path.c
index 475b1f6..827a9ff 100644
--- a/dlls/kernel32/path.c
+++ b/dlls/kernel32/path.c
@@ -607,7 +607,7 @@ DWORD WINAPI GetTempPathW( DWORD count, LPWSTR path )
     ret = GetFullPathNameW(tmp_path, MAX_PATH, tmp_path, NULL);
     if (!ret) return 0;
 
-    if (ret > MAX_PATH - 2)
+    if (ret > MAX_PATH - sizeof(WCHAR))
     {
         SetLastError(ERROR_FILENAME_EXCED_RANGE);
         return 0;
@@ -623,9 +623,13 @@ DWORD WINAPI GetTempPathW( DWORD count, LPWSTR path )
 
     if (count)
     {
-        lstrcpynW(path, tmp_path, count);
+        lstrcpynW(path, tmp_path, ret);
         if (count >= ret)
+        {
+            /* the remaining buffer must be zeroed */
+            memset(path + ret, 0, (count - ret) * sizeof(WCHAR));
             ret--; /* return length without 0 */
+        }
         else if (count < 4)
             path[0] = 0; /* avoid returning ambiguous "X:" */
     }
diff --git a/dlls/kernel32/tests/path.c b/dlls/kernel32/tests/path.c
index 8b07b8f..a5c0f41 100644
--- a/dlls/kernel32/tests/path.c
+++ b/dlls/kernel32/tests/path.c
@@ -1012,7 +1012,6 @@ static void test_GetTempPathW(char* tmp_dir)
     ok(len == lstrlenW(buf), "returned length should be equal to the length of string\n");
     /* The rest of the buffer must be zeroed */
     for(len++; len < sizeof(buf) / sizeof(buf[0]); len++)
-        todo_wine
         ok(buf[len] == '\0', "expected NULL at [%d], got 0x%x\n", len, buf[len]);
 }