Index: drivers/usb/usbhub/fdo.c
===================================================================
--- drivers/usb/usbhub/fdo.c	(revision 74244)
+++ drivers/usb/usbhub/fdo.c	(working copy)
@@ -701,8 +701,9 @@
         ExFreePool(StringDesc);
         return STATUS_DEVICE_DATA_ERROR;
     }
-    SizeNeeded = StringDesc->bLength + sizeof(WCHAR);
 
+    SizeNeeded = StringDesc->bLength;
+
     //
     // Free String
     //
@@ -739,6 +740,11 @@
     }
 
     //
+    // Calculate buffer size
+    //
+    SizeNeeded = (StringDesc->bLength - FIELD_OFFSET(USB_STRING_DESCRIPTOR, bString)) + sizeof(WCHAR);
+
+    //
     // Allocate Buffer to return
     //
     Buffer = ExAllocatePoolWithTag(NonPagedPool,
@@ -756,7 +762,8 @@
     //
     // Copy the string to destination
     //
-    RtlCopyMemory(Buffer, StringDesc->bString, SizeNeeded - FIELD_OFFSET(USB_STRING_DESCRIPTOR, bString));
+    RtlCopyMemory(Buffer, StringDesc->bString, StringDesc->bLength - FIELD_OFFSET(USB_STRING_DESCRIPTOR, bString));
+    
     *Size = SizeNeeded;
     *TransferBuffer = Buffer;