From 97a23a5f3d6994730c3121ff57d76f158e4e10c5 Mon Sep 17 00:00:00 2001
From: Mark Jansen <mark.jansen@reactos.org>
Date: Sat, 3 Apr 2021 01:54:57 +0200
Subject: [PATCH] [SERVICES] Fix booting with DPH enabled

RegSetValueExW tries to read one extra character after the buffer,
to see if a REG_SZ is null terminated
---
 base/system/services/controlset.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/base/system/services/controlset.c b/base/system/services/controlset.c
index e9ac8ddc7e2..1eb0facd545 100644
--- a/base/system/services/controlset.c
+++ b/base/system/services/controlset.c
@@ -174,9 +174,10 @@ ScmCopyTree(
             return ERROR_NOT_ENOUGH_MEMORY;
         }
 
+        /* RegSetValueExW tries to read behind the maximum length, so give it space for that */
         lpDataBuffer = HeapAlloc(GetProcessHeap(),
-                                 0,
-                                 dwMaxValueLength);
+                                 HEAP_ZERO_MEMORY,
+                                 dwMaxValueLength + sizeof(WCHAR));
         if (lpDataBuffer == NULL)
         {
             DPRINT1("Buffer allocation failed\n");