From bbf97892df1125d4778909d794850dbd2ee6fcc4 Mon Sep 17 00:00:00 2001
From: Eric Kohl <eric.kohl@reactos.org>
Date: Sat, 18 May 2013 19:19:27 +0000
Subject: [PATCH] [RPCRT4] Fix a bug that corrupted in-parameters when a remote
 function is called. If the in-parameter is an array of UNICODE_STRINGS, the
 bug terminates all strings at the length of the first string. For example,
 when LsaLookupNames is called in order to retrieve the SIDs of the "Guest"
 and "Administrator" users, the remote function received the strings "Guest"
 and "Admin".

The patch will be sent to the WINE project after a similar bug for out-parameters has been fixed too.

svn path=/trunk/; revision=59038
---
 reactos/dll/win32/rpcrt4/ndr_marshall.c  |  4 ++--
 reactos/dll/win32/rpcrt4/rpcrt4_ros.diff | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/reactos/dll/win32/rpcrt4/ndr_marshall.c b/reactos/dll/win32/rpcrt4/ndr_marshall.c
index 83b636330a4..3805217b9f3 100644
--- a/reactos/dll/win32/rpcrt4/ndr_marshall.c
+++ b/reactos/dll/win32/rpcrt4/ndr_marshall.c
@@ -1210,7 +1210,7 @@ static unsigned char * EmbeddedPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
         unsigned char *saved_memory = pStubMsg->Memory;
 
-        pStubMsg->Memory = pMemory;
+        pStubMsg->Memory = membase;
         PointerMarshall(pStubMsg, bufptr, *(unsigned char**)memptr, info+4);
         pStubMsg->Memory = saved_memory;
       }
@@ -1362,7 +1362,7 @@ static void EmbeddedPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
         unsigned char *memptr = membase + *(const SHORT*)&info[0];
         unsigned char *saved_memory = pStubMsg->Memory;
 
-        pStubMsg->Memory = pMemory;
+        pStubMsg->Memory = membase;
         PointerBufferSize(pStubMsg, *(unsigned char**)memptr, info+4);
         pStubMsg->Memory = saved_memory;
       }
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff b/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
index 48b0e731684..099cfd73cf6 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
+++ b/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
@@ -15,6 +15,24 @@ Index: ndr_marshall.c
 ===================================================================
 --- ndr_marshall.c	(working copy)
 +++ ndr_marshall.c	(working copy)
+@@ -1210,7 +1210,7 @@
+         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
+         unsigned char *saved_memory = pStubMsg->Memory;
+ 
+-        pStubMsg->Memory = pMemory;
++        pStubMsg->Memory = membase;
+         PointerMarshall(pStubMsg, bufptr, *(unsigned char**)memptr, info+4);
+         pStubMsg->Memory = saved_memory;
+       }
+@@ -1362,7 +1362,7 @@
+         unsigned char *memptr = membase + *(const SHORT*)&info[0];
+         unsigned char *saved_memory = pStubMsg->Memory;
+ 
+-        pStubMsg->Memory = pMemory;
++        pStubMsg->Memory = membase;
+         PointerBufferSize(pStubMsg, *(unsigned char**)memptr, info+4);
+         pStubMsg->Memory = saved_memory;
+       }
 @@ -6159,6 +6159,7 @@ static LONG unmarshall_discriminant(PMID
      case RPC_FC_WCHAR:
      case RPC_FC_SHORT: