From: Andrew Nguyen <anguyen@codeweavers.com>
Subject: mmsystem.dll16: Correctly map the MCI_SYSINFO_PARMS structure when MCI_SYSINFO_QUANTITY is set.
Message-Id: <4D22D70A.6070300@codeweavers.com>
Date: Tue, 04 Jan 2011 02:15:06 -0600

---
 dlls/mmsystem.dll16/mci16.c |   59 +++++++++++++++++++++++++++----------------
 1 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/dlls/mmsystem.dll16/mci16.c b/dlls/mmsystem.dll16/mci16.c
index d9bf7bb..80be9ef 100644
--- a/dlls/mmsystem.dll16/mci16.c
+++ b/dlls/mmsystem.dll16/mci16.c
@@ -269,23 +269,30 @@ static MMSYSTEM_MapType	MCI_MapMsg16To32W(WORD wMsg, DWORD dwFlags, DWORD_PTR* l
 	}
 	return MMSYSTEM_MAP_OKMEM;
     case MCI_SYSINFO:
-	{
-            LPMCI_SYSINFO_PARMSW	msip32w = HeapAlloc(GetProcessHeap(), 0, sizeof(LPMCI_OPEN_PARMS16) + sizeof(MCI_SYSINFO_PARMSW));
-	    LPMCI_SYSINFO_PARMS16	msip16  = MapSL(*lParam);
-
-	    if (msip32w) {
-		*(LPMCI_SYSINFO_PARMS16*)(msip32w) = msip16;
-		msip32w = (LPMCI_SYSINFO_PARMSW)((char*)msip32w + sizeof(LPMCI_OPEN_PARMS16));
-		msip32w->dwCallback       = msip16->dwCallback;
-		msip32w->lpstrReturn      = HeapAlloc(GetProcessHeap(), 0, msip16->dwRetSize * sizeof(WCHAR));
-		msip32w->dwRetSize        = msip16->dwRetSize;
-		msip32w->dwNumber         = msip16->dwNumber;
-		msip32w->wDeviceType      = msip16->wDeviceType;
-	    } else {
-		return MMSYSTEM_MAP_NOMEM;
-	    }
-	    *lParam = (DWORD)msip32w;
-	}
+    {
+        MCI_SYSINFO_PARMSW *msip32w = HeapAlloc(GetProcessHeap(), 0, sizeof(MCI_OPEN_PARMS16 *) + sizeof(MCI_SYSINFO_PARMSW));
+        MCI_SYSINFO_PARMS16 *msip16 = MapSL(*lParam);
+
+        if (!msip32w)
+            return MMSYSTEM_MAP_NOMEM;
+
+        *(MCI_SYSINFO_PARMS16 **)msip32w = msip16;
+        msip32w = (MCI_SYSINFO_PARMSW *)((char *)msip32w + sizeof(MCI_OPEN_PARMS16 *));
+        msip32w->dwCallback       = msip16->dwCallback;
+        msip32w->lpstrReturn      = HeapAlloc(GetProcessHeap(), 0, (dwFlags & MCI_SYSINFO_QUANTITY) ?
+                                                                    sizeof(DWORD) :
+                                                                    msip16->dwRetSize * sizeof(WCHAR));
+        if (!msip32w->lpstrReturn)
+        {
+            HeapFree(GetProcessHeap(), 0, msip32w);
+            return MMSYSTEM_MAP_NOMEM;
+        }
+        msip32w->dwRetSize        = (dwFlags & MCI_SYSINFO_QUANTITY) ? sizeof(DWORD) : msip16->dwRetSize;
+        msip32w->dwNumber         = msip16->dwNumber;
+        msip32w->wDeviceType      = msip16->wDeviceType;
+
+        *lParam = (DWORD)msip32w;
+    }
 	return MMSYSTEM_MAP_OKMEM;
     case MCI_SOUND:
 	{
@@ -391,13 +398,21 @@ static  MMSYSTEM_MapType	MCI_UnMapMsg16To32W(WORD wMsg, DWORD dwFlags, DWORD_PTR
 	return MMSYSTEM_MAP_OK;
     case MCI_SYSINFO:
         if (lParam) {
-            LPMCI_SYSINFO_PARMSW	   msip32w = (LPMCI_SYSINFO_PARMSW)lParam;
-	    LPMCI_SYSINFO_PARMS16          msip16  = *(LPMCI_SYSINFO_PARMS16*)((char*)msip32w - sizeof(LPMCI_SYSINFO_PARMS16));
+            MCI_SYSINFO_PARMSW *msip32w = (MCI_SYSINFO_PARMSW *)lParam;
+            MCI_SYSINFO_PARMS16 *msip16  = *(MCI_SYSINFO_PARMS16 **)((char *)msip32w - sizeof(MCI_SYSINFO_PARMS16 *));
+
+            if (dwFlags & MCI_SYSINFO_QUANTITY) {
+                DWORD *quantity = MapSL(msip16->lpstrReturn);
+
+                *quantity = *(DWORD *)msip32w->lpstrReturn;
+            }
+            else {
+                WideCharToMultiByte(CP_ACP, 0,
+                                    msip32w->lpstrReturn, msip32w->dwRetSize,
+                                    MapSL(msip16->lpstrReturn), msip16->dwRetSize,
+                                    NULL, NULL);
+            }
 
-            WideCharToMultiByte(CP_ACP, 0,
-                                msip32w->lpstrReturn, msip32w->dwRetSize,
-                                MapSL(msip16->lpstrReturn), msip16->dwRetSize,
-                                NULL, NULL);
             HeapFree(GetProcessHeap(), 0, msip32w->lpstrReturn);
             HeapFree(GetProcessHeap(), 0, (LPVOID)lParam);
         }

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJNItcMAAoJEK/FbHgLAxL2IWMP/0g8w1xOa5nC++aAXFTVKa9Q
OhdR9GyXP2ykMQTcaq1z4cD3at5i5p83U58XqFIPngQzYB8Q97jvRHe4UKDTNKaZ
d8Yk+38oaFC6ehdZtrnp+tQDYW6T/JsB0r8a7cOQ4n+Zv8GCHder/e6IT+8Xgkg1
63XBtq1oQHTMviHV1QLc5Ek0aF1YVf0IvFGy3M6ti4Ddi3UnE/gtfNYJAoWpfVCM
oejsVOGCmH3CoQXTwn052E5+2KQrea6bUFQB2zO4DS1xawUxDOUaQqEXtiNdNZR7
9A4ddIhNY+XvJ4nJaz5O4FYjYmVDT9fakaISO0LMfstg5deXymHYCbzValh0RbC3
L6eEF+n1w+3clW7cYbigX/XwDJWYUZXoGpyJNBIGlo7GR5Us0tucWKB696Q8Lkp0
Ru1L76j6CMLq/qZEinq4HSTmCZTvkOcxpp9f6cc+DveGs8NJsTd3E6ol7Tx+v4OS
+ewPWGukA9GLksyZq3OmxcnK9T3oUd5HxZXFAnaA7Mz69iclms4Ayp89fNx0SOPC
79xeXfqA1fkZisB4UaOepN62ejVkvW3IVLNsYEly0hu1Xu2WlYWLWG5hEeRhMl7M
uFkmmDPpMX5jibQo08YkJ/0uCuKCekjQcjsUB6hp3h2AIdb1SjkaFBy5ifJL6My5
VYB+mP6q2ZzQ/aOP+z3K
=izLo
-----END PGP SIGNATURE-----