From: Piotr Caban <piotr@codeweavers.com>
Subject: msvcrt: Fix buffer size in _ecvt_s
Message-Id: <4D937762.8000802@codeweavers.com>
Date: Wed, 30 Mar 2011 20:33:06 +0200

---
  dlls/msvcrt/math.c |   10 +++++-----
  1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dlls/msvcrt/math.c b/dlls/msvcrt/math.c
index ab9cec4..3428398 100644
--- a/dlls/msvcrt/math.c
+++ b/dlls/msvcrt/math.c
@@ -1306,17 +1306,17 @@ int CDECL _ecvt_s( char *buffer, MSVCRT_size_t length, double number, int ndigit
             (*sign) = 0;
         return 0;
     }
-    result = (char*)MSVCRT_malloc(max(ndigits + 7, 7));
+    /* handle cases with zero ndigits or less */
+    prec = ndigits;
+    if( prec < 1) prec = 2;
+    result = (char*)MSVCRT_malloc(prec + 7);
 
     if( number < 0) {
         *sign = TRUE;
         number = -number;
     } else
         *sign = FALSE;
-    /* handle cases with zero ndigits or less */
-    prec = ndigits;
-    if( prec < 1) prec = 2;
-    len = snprintf(result, 80, "%.*le", prec - 1, number);
+    len = snprintf(result, prec + 7, "%.*le", prec - 1, number);
     /* take the decimal "point away */
     if( prec != 1)
         memmove( result + 1, result + 2, len - 1 );