Bug 506394 - ExpandEnvironmentStringsW in CE shunt isn't quite right, r=vlad

build/wince/shunt/environment.cpp

@@ -214,27 +214,37 @@ unsigned int ExpandEnvironmentStringsW(const unsigned short* lpSrc,
   while ( index < origLen ) {
 
     if (*pIn != L'%') {  // Regular char, copy over
-      if ( size < nSize ) *pOut = *pIn, pOut++;
-      index++, size++, pIn++;
+      if ( size++ < nSize ) *pOut = *pIn, pOut++;
+      index++, pIn++;
       continue;
     }
 
     // Have a starting '%' - look for matching '%'
     int envlen = 0;
-    const unsigned short *pTmp = ++pIn;                    // Move past original '%'
-    while ( L'%' != *pTmp ) {
+    const unsigned short *pTmp = pIn + 1;
+    while ( *pTmp != L'%' && *pTmp != L' ' ) {
       envlen++, pTmp++;
       if ( origLen < index + envlen ) {    // Ran past end of original
-        SetLastError(ERROR_INVALID_PARAMETER); // buffer without matching '%'
-        return -1;
+        while ( envlen-- ) {
+          if ( size++ < nSize ) *pOut = *pIn, pOut++;
+          index++, pIn++;
+        }
+        break;
       }
     }
 
+    if ( *pTmp == L' ' ) { // Need to append through space
+      while ( envlen-- ) {
+        if ( size++ < nSize ) *pOut = *pIn, pOut++;
+        index++, pIn++;
+      }
+      continue;
+    }
+
+    pIn++; // Move past original %
     if ( 0 == envlen ) {  // Encountered a "%%" - mapping to "%"
-      size++;
-      if ( size < nSize ) *pOut = *pIn, pOut++;
-      pIn++;
-      index += 2;
+      if ( size++ < nSize ) *pOut = *pIn, pOut++;
+      index += 2, pIn++;
     } else {
       // Encountered a "%something%" - mapping "something"
       char key[256];