From a37512ee63f33b69f3838c32a7a42abffb70d772 Mon Sep 17 00:00:00 2001
From: Paul Bryan Roberts <pbronline-wine@yahoo.co.uk>
Date: Sat, 18 Oct 2008 21:28:39 +0100
Subject: [PATCH] advapi32: LookupAccountNameW() - use CreateWellKnownSid()
 properly.

---
 dlls/advapi32/security.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
index 03933d2497a..fcb048bdb7a 100644
--- a/dlls/advapi32/security.c
+++ b/dlls/advapi32/security.c
@@ -2536,7 +2536,26 @@ BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSI
     {
         if (!strcmpW(lpAccountName, ACCOUNT_SIDS[i].account))
         {
-            ret = CreateWellKnownSid(ACCOUNT_SIDS[i].type, NULL, Sid, cbSid);
+            DWORD sidLen = SECURITY_MAX_SID_SIZE;
+
+            pSid = HeapAlloc(GetProcessHeap(), 0, sidLen);
+
+            ret = CreateWellKnownSid(ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen);
+
+            if (ret)
+            {
+                if (*cbSid < sidLen)
+                {
+                    SetLastError(ERROR_INSUFFICIENT_BUFFER);
+                    ret = FALSE;
+                }
+                else if (Sid)
+                {
+                    CopySid(*cbSid, Sid, pSid);
+                }
+
+                *cbSid = sidLen;
+            }
 
             domainName = ACCOUNT_SIDS[i].domain;
             nameLen = strlenW(domainName);
@@ -2559,6 +2578,8 @@ BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSI
                 *peUse = ACCOUNT_SIDS[i].name_use;
             }
 
+            HeapFree(GetProcessHeap(), 0, pSid);
+
             return ret;
         }
     }