From 82c154034445d8d6495bbe10601e3023a6c591da Mon Sep 17 00:00:00 2001
From: Hans Leidekker <hans@it.vu.nl>
Date: Sat, 24 Mar 2007 17:32:02 +0100
Subject: [PATCH] mpr: Fix buffer size calculation in WNetGetUniversalNameW.

---
 dlls/mpr/wnet.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/dlls/mpr/wnet.c b/dlls/mpr/wnet.c
index f20e31842c3..7419258b351 100644
--- a/dlls/mpr/wnet.c
+++ b/dlls/mpr/wnet.c
@@ -1713,8 +1713,7 @@ DWORD WINAPI WNetGetUniversalNameA ( LPCSTR lpLocalPath, DWORD dwInfoLevel,
 DWORD WINAPI WNetGetUniversalNameW ( LPCWSTR lpLocalPath, DWORD dwInfoLevel,
                                      LPVOID lpBuffer, LPDWORD lpBufferSize )
 {
-    LPUNIVERSAL_NAME_INFOW uniw;
-    DWORD err, len;
+    DWORD err, size;
 
     FIXME( "(%s, 0x%08X, %p, %p): stub\n",
            debugstr_w(lpLocalPath), dwInfoLevel, lpBuffer, lpBufferSize);
@@ -1722,23 +1721,28 @@ DWORD WINAPI WNetGetUniversalNameW ( LPCWSTR lpLocalPath, DWORD dwInfoLevel,
     switch (dwInfoLevel)
     {
     case UNIVERSAL_NAME_INFO_LEVEL:
-        err = WN_MORE_DATA;
-        len = sizeof (*uniw) + lstrlenW(lpLocalPath);
-        if (*lpBufferSize <= len)
+    {
+        LPUNIVERSAL_NAME_INFOW info = (LPUNIVERSAL_NAME_INFOW)lpBuffer;
+
+        size = sizeof(*info) + (lstrlenW(lpLocalPath) + 1) * sizeof(WCHAR);
+        if (*lpBufferSize < size)
+        {
+            err = WN_MORE_DATA;
             break;
-        uniw = lpBuffer;
-        uniw->lpUniversalName = (LPWSTR) &uniw[1];
-        lstrcpyW(uniw->lpUniversalName, lpLocalPath);
-        *lpBufferSize = len;
+        }
+        info->lpUniversalName = (LPWSTR)((char *)info + sizeof(*info));
+        lstrcpyW(info->lpUniversalName, lpLocalPath);
+        *lpBufferSize = size;
         err = WN_NO_ERROR;
         break;
-
+    }
     case REMOTE_NAME_INFO_LEVEL:
         err = WN_NO_NETWORK;
         break;
 
     default:
         err = WN_BAD_VALUE;
+        break;
     }
 
     SetLastError(err);
-- 
2.11.4.GIT