Since evutil_snprintf() (actually evutil_vsnprintf() called by it) will
make sure the buffer is null-terminated by placing a null byte at
len_out - 1, we need to pass the full length of the buffer; otherwise
the path will end in "\\host" instead of "\\hosts".
if (! SHGetSpecialFolderPathA(NULL, path, CSIDL_SYSTEM, 0))
return NULL;
- len_out = strlen(path)+strlen(hostfile);
- path_out = mm_malloc(len_out+1);
+ len_out = strlen(path)+strlen(hostfile)+1;
+ path_out = mm_malloc(len_out);
evutil_snprintf(path_out, len_out, "%s%s", path, hostfile);
return path_out;
#else