From 984dfa7eed5a2c4673a5cc108f6bad1401e83440 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristj=C3=A1n=20Valur=20J=C3=B3nsson?=
 <kristjan@ccpgames.com>
Date: Mon, 2 Apr 2012 15:23:29 +0000
Subject: [PATCH] Issue #14471: Fix a possible buffer overrun in the winreg
 module.

---
 Misc/NEWS   | 2 ++
 PC/winreg.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/Misc/NEWS b/Misc/NEWS
index 3d9b8225bd4..18a8d73e694 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -34,6 +34,8 @@ Core and Builtins
 - Issue #13521: dict.setdefault() now does only one lookup for the given key,
   making it "atomic" for many purposes.  Patch by Filip Gruszczyński.
 
+- Issue #14471: Fix a possible buffer overrun in the winreg module.
+
 Library
 -------
 
diff --git a/PC/winreg.c b/PC/winreg.c
index 1bc47b958b4..240ca69c397 100644
--- a/PC/winreg.c
+++ b/PC/winreg.c
@@ -1110,7 +1110,7 @@ PyEnumKey(PyObject *self, PyObject *args)
      * nul.  RegEnumKeyEx requires a 257 character buffer to
      * retrieve such a key name. */
     wchar_t tmpbuf[257];
-    DWORD len = sizeof(tmpbuf); /* includes NULL terminator */
+    DWORD len = sizeof(tmpbuf)/sizeof(wchar_t); /* includes NULL terminator */
 
     if (!PyArg_ParseTuple(args, "Oi:EnumKey", &obKey, &index))
         return NULL;