Index: base/shell/cmd/cmd.c
===================================================================
--- base/shell/cmd/cmd.c	(revision 63108)
+++ base/shell/cmd/cmd.c	(working copy)
@@ -397,13 +397,13 @@
         /* build command line for CreateProcess(): FullName + " " + rest */
         BOOL quoted = !!_tcschr(First, ' ');
         _tcscpy(szFullCmdLine, quoted ? _T("\"") : _T(""));
-        _tcsncat(szFullCmdLine, First, CMDLINE_LENGTH - _tcslen(szFullCmdLine));
-        _tcsncat(szFullCmdLine, quoted ? _T("\"") : _T(""), CMDLINE_LENGTH - _tcslen(szFullCmdLine));
+        _tcsncat(szFullCmdLine, First, CMDLINE_LENGTH - _tcslen(szFullCmdLine - 1));
+        _tcsncat(szFullCmdLine, quoted ? _T("\"") : _T(""), CMDLINE_LENGTH - _tcslen(szFullCmdLine - 1));
 
         if (*rest)
         {
-            _tcsncat(szFullCmdLine, _T(" "), CMDLINE_LENGTH - _tcslen(szFullCmdLine));
-            _tcsncat(szFullCmdLine, rest, CMDLINE_LENGTH - _tcslen(szFullCmdLine));
+            _tcsncat(szFullCmdLine, _T(" "), CMDLINE_LENGTH - _tcslen(szFullCmdLine) - 1);
+            _tcsncat(szFullCmdLine, rest, CMDLINE_LENGTH - _tcslen(szFullCmdLine) - 1);
         }
 
         TRACE ("[EXEC: %s]\n", debugstr_aw(szFullCmdLine));