Merge with 3.2 (Issue #14471)

Kristján Valur Jónsson · Kristján Valur Jónsson · commit 2247775bfa38 · 2012-04-02T15:41:06.000Z
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -56,6 +56,8 @@ Core and Builtins
 - Issue #14435: Remove dedicated block allocator from floatobject.c and rely
   on the PyObject_Malloc() api like all other objects.
 
+- Issue #14471: Fix a possible buffer overrun in the winreg module.
+
 Library
 -------
 
diff --git a/PC/winreg.c b/PC/winreg.c
@@ -1122,7 +1122,7 @@ PyEnumKey(PyObject *self, PyObject *args)
      * nul.  RegEnumKeyEx requires a 257 character buffer to
      * retrieve such a key name. */
     wchar_t tmpbuf[257];
-    DWORD len = sizeof(tmpbuf); /* includes NULL terminator */
+    DWORD len = sizeof(tmpbuf)/sizeof(wchar_t); /* includes NULL terminator */
 
     if (!PyArg_ParseTuple(args, "Oi:EnumKey", &obKey, &index))
         return NULL;
