Index: dll/win32/advapi32/reg/reg.c
===================================================================
--- dll/win32/advapi32/reg/reg.c	(revision 67563)
+++ dll/win32/advapi32/reg/reg.c	(working copy)
@@ -3660,18 +3660,17 @@
 LONG WINAPI
 RegQueryInfoKeyW(HKEY hKey,
                  LPWSTR lpClass,
-                 LPDWORD lpcClass,
+                 LPDWORD lpcbClass,
                  LPDWORD lpReserved,
                  LPDWORD lpcSubKeys,
-                 LPDWORD lpcMaxSubKeyLen,
-                 LPDWORD lpcMaxClassLen,
+                 LPDWORD lpcbMaxSubKeyLen,
+                 LPDWORD lpcbMaxClassLen,
                  LPDWORD lpcValues,
-                 LPDWORD lpcMaxValueNameLen,
-                 LPDWORD lpcMaxValueLen,
+                 LPDWORD lpcbMaxValueNameLen,
+                 LPDWORD lpcbMaxValueLen,
                  LPDWORD lpcbSecurityDescriptor,
                  PFILETIME lpftLastWriteTime)
 {
-    KEY_FULL_INFORMATION FullInfoBuffer;
     PKEY_FULL_INFORMATION FullInfo;
     ULONG FullInfoSize;
     ULONG ClassLength = 0;
@@ -3680,7 +3679,7 @@
     ULONG Length;
     LONG ErrorCode = ERROR_SUCCESS;
 
-    if ((lpClass) && (!lpcClass))
+    if ((lpClass) && (!lpcbClass))
     {
         return ERROR_INVALID_PARAMETER;
     }
@@ -3692,79 +3691,46 @@
         return RtlNtStatusToDosError(Status);
     }
 
-    if (lpClass != NULL)
-    {
-        if (*lpcClass > 0)
-        {
-            ClassLength = min(*lpcClass - 1, REG_MAX_NAME_SIZE) * sizeof(WCHAR);
-        }
-        else
-        {
-            ClassLength = 0;
-        }
+    // Query information ignoring the user class size field from KEY_FULL_INFORMATION structure
+    FullInfoSize = sizeof(KEY_FULL_INFORMATION);
+    FullInfo = RtlAllocateHeap(ProcessHeap, 0, FullInfoSize);
 
-        FullInfoSize = sizeof(KEY_FULL_INFORMATION) + ((ClassLength + 3) & ~3);
-        FullInfo = RtlAllocateHeap(ProcessHeap,
-                                   0,
-                                   FullInfoSize);
-        if (FullInfo == NULL)
-        {
-            ErrorCode = ERROR_OUTOFMEMORY;
-            goto Cleanup;
-        }
-    }
-    else
+    // If the key has an user-class defined this call will return an STATUS_BUFFER_OVERFLOW:
+    Status = NtQueryKey( hKey, KeyFullInformation, FullInfo, FullInfoSize, &Length );
+      
+    if (Status && Status != STATUS_BUFFER_OVERFLOW) 
     {
-        FullInfoSize = sizeof(KEY_FULL_INFORMATION);
-        FullInfo = &FullInfoBuffer;
-    }
-
-    Status = NtQueryKey(KeyHandle,
-                        KeyFullInformation,
-                        FullInfo,
-                        FullInfoSize,
-                        &Length);
-    TRACE("NtQueryKey() returned status 0x%X\n", Status);
-    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
-    {
-        ErrorCode = RtlNtStatusToDosError(Status);
+        RtlFreeHeap(ProcessHeap, 0, FullInfo);
         goto Cleanup;
     }
+        
 
+    // If ERROR_SUCCESS or STATUS_BUFFER_OVERFLOW:  All the fields of KEY_FULL_INFORMATION are properly set...but the Class:
+
+
+
     TRACE("SubKeys %d\n", FullInfo->SubKeys);
-    if (lpcSubKeys != NULL)
-    {
-        *lpcSubKeys = FullInfo->SubKeys;
-    }
+    if (lpcSubKeys != NULL)         *lpcSubKeys = FullInfo->SubKeys;
 
     TRACE("MaxNameLen %lu\n", FullInfo->MaxNameLen);
-    if (lpcMaxSubKeyLen != NULL)
-    {
-        *lpcMaxSubKeyLen = FullInfo->MaxNameLen / sizeof(WCHAR);
-    }
+    if (lpcbMaxSubKeyLen != NULL)   *lpcbMaxSubKeyLen = FullInfo->MaxNameLen / sizeof(WCHAR);
 
     TRACE("MaxClassLen %lu\n", FullInfo->MaxClassLen);
-    if (lpcMaxClassLen != NULL)
-    {
-        *lpcMaxClassLen = FullInfo->MaxClassLen / sizeof(WCHAR);
-    }
+    if (lpcbMaxClassLen != NULL)    *lpcbMaxClassLen = FullInfo->MaxClassLen / sizeof(WCHAR);
 
     TRACE("Values %lu\n", FullInfo->Values);
-    if (lpcValues != NULL)
-    {
-        *lpcValues = FullInfo->Values;
-    }
+    if (lpcValues != NULL)          *lpcValues = FullInfo->Values;
 
     TRACE("MaxValueNameLen %lu\n", FullInfo->MaxValueNameLen);
-    if (lpcMaxValueNameLen != NULL)
-    {
-        *lpcMaxValueNameLen = FullInfo->MaxValueNameLen / sizeof(WCHAR);
-    }
+    if (lpcbMaxValueNameLen != NULL)     *lpcbMaxValueNameLen = FullInfo->MaxValueNameLen / sizeof(WCHAR);
+    
+    TRACE("MaxValueDataLen %lu\n", FullInfo->MaxValueDataLen);
+    if (lpcbMaxValueLen != NULL)         *lpcbMaxValueLen = FullInfo->MaxValueDataLen;
 
-    TRACE("MaxValueDataLen %lu\n", FullInfo->MaxValueDataLen);
-    if (lpcMaxValueLen != NULL)
+    if (lpftLastWriteTime != NULL)
     {
-        *lpcMaxValueLen = FullInfo->MaxValueDataLen;
+        lpftLastWriteTime->dwLowDateTime = FullInfo->LastWriteTime.u.LowPart;
+        lpftLastWriteTime->dwHighDateTime = FullInfo->LastWriteTime.u.HighPart;
     }
 
     if (lpcbSecurityDescriptor != NULL)
@@ -3778,50 +3744,55 @@
                                        lpcbSecurityDescriptor);
         if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_TOO_SMALL)
         {
+
             ErrorCode = RtlNtStatusToDosError(Status);
+
+            RtlFreeHeap(ProcessHeap, 0, FullInfo);
             goto Cleanup;
         }
     }
+    
+    // Free FullInfo since all the valuable information has been already extracted. The FullInfo->Class is incomplete.
+    RtlFreeHeap(ProcessHeap, 0, FullInfo);
 
-    if (lpftLastWriteTime != NULL)
+    // Just care to retrieve the "Class" from the key if the API was fed with a lpClass buffer.
+    if (lpClass != NULL)
     {
-        lpftLastWriteTime->dwLowDateTime = FullInfo->LastWriteTime.u.LowPart;
-        lpftLastWriteTime->dwHighDateTime = FullInfo->LastWriteTime.u.HighPart;
-    }
+        // NtQuery already told us which is the proper Length of the buffer needed.     
+        FullInfo = RtlAllocateHeap(ProcessHeap, 0, Length);
 
-    if (lpClass != NULL)
-    {
-        if (*lpcClass == 0)
+        if (FullInfo == NULL)
         {
+            ErrorCode = ERROR_OUTOFMEMORY;
             goto Cleanup;
         }
 
-        if (FullInfo->ClassLength > ClassLength)
+        // Now this query should return ERROR_SUCCESS
+        Status = NtQueryKey( hKey, KeyFullInformation, FullInfo, Length, &Length );
+        ASSERT(Status == ERROR_SUCCESS);
+        ErrorCode = ERROR_SUCCESS;
+
+        // Check against the buffer size marked by lpcbClass. 
+        ClassLength = (*lpcbClass) * sizeof(WCHAR);
+        
+        if (FullInfo->ClassLength >= ClassLength)
         {
             ErrorCode = ERROR_INSUFFICIENT_BUFFER;
         }
         else
         {
-            RtlCopyMemory(lpClass,
-                          FullInfo->Class,
-                          FullInfo->ClassLength);
-            lpClass[FullInfo->ClassLength / sizeof(WCHAR)] = UNICODE_NULL;
+            RtlCopyMemory(lpClass, FullInfo->Class, FullInfo->ClassLength);
+            lpClass[*lpcbClass] = 0;
         }
-    }
 
-    if (lpcClass != NULL)
-    {
-        *lpcClass = FullInfo->ClassLength / sizeof(WCHAR);
+        RtlFreeHeap(ProcessHeap, 0, FullInfo);
     }
 
+    //Set lpcbClass:
+    TRACE("lpcbClass %d\n", FullInfo->ClassLength);
+    if (lpcbClass != NULL)         *lpcbClass = FullInfo->ClassLength / sizeof(WCHAR);
+    
 Cleanup:
-    if (lpClass != NULL)
-    {
-        RtlFreeHeap(ProcessHeap,
-                    0,
-                    FullInfo);
-    }
-
     ClosePredefKey(KeyHandle);
 
     return ErrorCode;
