diff --git a/win32ss/user/user32/windows/input.c b/win32ss/user/user32/windows/input.c
index aac99382113..af6500dfee5 100644
--- a/win32ss/user/user32/windows/input.c
+++ b/win32ss/user/user32/windows/input.c
@@ -369,7 +369,7 @@ BOOL FASTCALL CliGetImeHotKeysFromRegistry(VOID)
 
 VOID APIENTRY CliGetPreloadKeyboardLayouts(PBYTE pbFlags)
 {
-    WCHAR szValueName[8], szValue[16];
+    WCHAR szValueName[12], szValue[16];
     UNICODE_STRING ustrValue;
     DWORD dwKL, cbValue, dwType;
     UINT iNumber;
@@ -382,14 +382,17 @@ VOID APIENTRY CliGetPreloadKeyboardLayouts(PBYTE pbFlags)
 
     for (iNumber = 1; iNumber < 1000; ++iNumber)
     {
-        StringCchPrintfW(szValueName, _countof(szValueName), L"%u", iNumber);
+        RtlIntegerToUnicode(iNumber, 10, sizeof(szValueName), szValueName);
 
         cbValue = sizeof(szValue);
         error = RegQueryValueExW(hKey, szValueName, NULL, &dwType, (LPBYTE)szValue, &cbValue);
-        if (error != ERROR_SUCCESS || dwType != REG_SZ)
+        if (error != ERROR_SUCCESS)
             break;
 
-        szValue[_countof(szValue) - 1] = 0;
+        if (dwType != REG_SZ)
+            continue;
+
+        szValue[_countof(szValue) - 1] = 0; /* Avoid stack overrun */
 
         RtlInitUnicodeString(&ustrValue, szValue);
         RtlUnicodeStringToInteger(&ustrValue, 16, &dwKL);