From 60d847b074d27bc7a5bd1d1908d5126d497b80de Mon Sep 17 00:00:00 2001
From: Rob Shearman <rob@codeweavers.com>
Date: Wed, 18 Jul 2007 18:07:29 +0100
Subject: [PATCH] advapi32: Fix a typo in ParseStringAclToAcl which caused the
 ACE to be written inside of the ACL memory.

---
 dlls/advapi32/security.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
index 0f067de40a5..41a3aef638b 100644
--- a/dlls/advapi32/security.c
+++ b/dlls/advapi32/security.c
@@ -3178,7 +3178,7 @@ static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
 	return FALSE;
 
     if (pAcl) /* pAce is only useful if we're setting values */
-        pAce = (PACCESS_ALLOWED_ACE) ((LPBYTE)pAcl + sizeof(PACL));
+        pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
 
     /* Parse ACL flags */
     *lpdwFlags = ParseAclStringFlags(&StringAcl);