[PATCH 06/12] LookupAccountNameW() - use CreateWellKnowenSid() properly

[Paul Bryan Roberts]

---
 dlls/advapi32/security.c |   23 ++++++++++++++++++++++-
 1 files changed, 22 insertions(+), 1 deletions(-)

diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
index 62313a6..1b3cee7 100644
--- a/dlls/advapi32/security.c
+++ b/dlls/advapi32/security.c
@@ -2532,7 +2532,26 @@ BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSI
     {
         if (!strcmpW(lpAccountName, ACCOUNT_SIDS[i].account))
         {
-            ret = CreateWellKnownSid(ACCOUNT_SIDS[i].type, NULL, Sid, cbSid);
+            DWORD sidLen = SECURITY_MAX_SID_SIZE;
+
+            pSid = HeapAlloc(GetProcessHeap(), 0, sidLen);
+
+            ret = CreateWellKnownSid(ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen);
+
+            if (ret)
+            {
+                if (*cbSid < sidLen)
+                {
+                    SetLastError(ERROR_INSUFFICIENT_BUFFER);
+                    ret = FALSE;
+                }
+                else if (Sid)
+                {
+                    CopySid(*cbSid, Sid, pSid);
+                }
+
+                *cbSid = sidLen;
+            }
 
             domainName = ACCOUNT_SIDS[i].domain;
             nameLen = strlenW(domainName);
@@ -2555,6 +2574,8 @@ BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSI
                 *peUse = ACCOUNT_SIDS[i].name_use;
             }
 
+            HeapFree(GetProcessHeap(), 0, pSid);
+
             return ret;
         }
     }
-- 
1.5.4.3


--------------070505070106060609000106--