cmd: Size buffer in create_full_path() correctly.

programs/cmd/builtins.c

diff --git a/programs/cmd/builtins.c b/programs/cmd/builtins.c
index c63360b..d1019cc 100644
--- a/programs/cmd/builtins.c
+++ b/programs/cmd/builtins.c
@@ -319,7 +319,7 @@
     WCHAR *new_path;
     BOOL ret = TRUE;
 
-    new_path = HeapAlloc(GetProcessHeap(),0,(strlenW(path) * sizeof(WCHAR))+1);
+    new_path = HeapAlloc(GetProcessHeap(),0,(strlenW(path)+1) * sizeof(WCHAR));
     strcpyW(new_path,path);
 
     while ((len = strlenW(new_path)) && new_path[len - 1] == '\\')