Research into a heap buffer overflow error in Windows XP version of NetApi32.dll reveals that the code is using a null terminated string copy. The patched version of the same dll shows that the copy code has been replaced by a better function that checks the size of the destination buffer.
