Improper use of SysAllocStringLen Can Cause Heap Corruption

[Rich-Lang]

https://github.com/FWest98/hsts-iis-module/blob/develop/module/HSTSIisModule.cpp#L164 This is not a proper use of SysAllocStringLen. The length passed in should not be longer than the string passed in.

If strIn is not NULL, then the memory allocated to strIn must be at least ui characters long.
Source: https://docs.microsoft.com/en-us/windows/desktop/api/oleauto/nf-oleauto-sysallocstringlen

More Info: https://docs.microsoft.com/en-us/previous-versions/5c28xhds(v=vs.80)

[Rich-Lang]

To see this issue in action, enable PageHeap Verification for w3wp.exe
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enable-page-heap