Index: dll/win32/advapi32/reg/reg.c
===================================================================
--- dll/win32/advapi32/reg/reg.c	(revision 67605)
+++ dll/win32/advapi32/reg/reg.c	(working copy)
@@ -3671,7 +3671,6 @@
                  LPDWORD lpcbSecurityDescriptor,
                  PFILETIME lpftLastWriteTime)
 {
-    KEY_FULL_INFORMATION FullInfoBuffer;
     PKEY_FULL_INFORMATION FullInfo;
     ULONG FullInfoSize;
     ULONG ClassLength = 0;
@@ -3692,80 +3691,65 @@
         return RtlNtStatusToDosError(Status);
     }
 
-    if (lpClass != NULL)
-    {
-        if (*lpcClass > 0)
-        {
-            ClassLength = min(*lpcClass - 1, REG_MAX_NAME_SIZE) * sizeof(WCHAR);
-        }
-        else
-        {
-            ClassLength = 0;
-        }
+    // Query information ignoring the user class size field from KEY_FULL_INFORMATION structure
+    FullInfoSize = sizeof(KEY_FULL_INFORMATION);
+    FullInfo = RtlAllocateHeap(ProcessHeap, 0, FullInfoSize);
 
-        FullInfoSize = sizeof(KEY_FULL_INFORMATION) + ((ClassLength + 3) & ~3);
-        FullInfo = RtlAllocateHeap(ProcessHeap,
-                                   0,
-                                   FullInfoSize);
-        if (FullInfo == NULL)
-        {
-            ErrorCode = ERROR_OUTOFMEMORY;
-            goto Cleanup;
-        }
-    }
-    else
+    // If the key has an user-class defined this call will return an STATUS_BUFFER_OVERFLOW:
+    Status = NtQueryKey( hKey, KeyFullInformation, FullInfo, FullInfoSize, &Length );
+      
+    if (Status && Status != STATUS_BUFFER_OVERFLOW) 
     {
-        FullInfoSize = sizeof(KEY_FULL_INFORMATION);
-        FullInfo = &FullInfoBuffer;
-    }
-
-    Status = NtQueryKey(KeyHandle,
-                        KeyFullInformation,
-                        FullInfo,
-                        FullInfoSize,
-                        &Length);
-    TRACE("NtQueryKey() returned status 0x%X\n", Status);
-    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
-    {
-        ErrorCode = RtlNtStatusToDosError(Status);
+        RtlFreeHeap(ProcessHeap, 0, FullInfo);
         goto Cleanup;
     }
+        
 
+    // If ERROR_SUCCESS or STATUS_BUFFER_OVERFLOW:  All the fields of KEY_FULL_INFORMATION are properly set...but the Class:
+
+
+
     TRACE("SubKeys %d\n", FullInfo->SubKeys);
-    if (lpcSubKeys != NULL)
+    if (lpcSubKeys != NULL)        
     {
         *lpcSubKeys = FullInfo->SubKeys;
     }
-
+    
     TRACE("MaxNameLen %lu\n", FullInfo->MaxNameLen);
     if (lpcMaxSubKeyLen != NULL)
     {
         *lpcMaxSubKeyLen = FullInfo->MaxNameLen / sizeof(WCHAR);
     }
-
+    
     TRACE("MaxClassLen %lu\n", FullInfo->MaxClassLen);
     if (lpcMaxClassLen != NULL)
     {
         *lpcMaxClassLen = FullInfo->MaxClassLen / sizeof(WCHAR);
     }
-
+    
     TRACE("Values %lu\n", FullInfo->Values);
     if (lpcValues != NULL)
     {
         *lpcValues = FullInfo->Values;
     }
-
+    
     TRACE("MaxValueNameLen %lu\n", FullInfo->MaxValueNameLen);
     if (lpcMaxValueNameLen != NULL)
     {
         *lpcMaxValueNameLen = FullInfo->MaxValueNameLen / sizeof(WCHAR);
     }
-
+    
     TRACE("MaxValueDataLen %lu\n", FullInfo->MaxValueDataLen);
     if (lpcMaxValueLen != NULL)
     {
         *lpcMaxValueLen = FullInfo->MaxValueDataLen;
     }
+    
+    if (lpftLastWriteTime != NULL)
+    {
+        lpftLastWriteTime->dwLowDateTime = FullInfo->LastWriteTime.u.LowPart;
+        lpftLastWriteTime->dwHighDateTime = FullInfo->LastWriteTime.u.HighPart;
+    }
 
     if (lpcbSecurityDescriptor != NULL)
     {
@@ -3778,50 +3762,58 @@
                                        lpcbSecurityDescriptor);
         if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_TOO_SMALL)
         {
+
             ErrorCode = RtlNtStatusToDosError(Status);
+
+            RtlFreeHeap(ProcessHeap, 0, FullInfo);
             goto Cleanup;
         }
     }
+    
+    // Free FullInfo since all the valuable information has been already extracted. The FullInfo->Class is incomplete.
+    RtlFreeHeap(ProcessHeap, 0, FullInfo);
 
-    if (lpftLastWriteTime != NULL)
+    // Just care to retrieve the "Class" from the key if the API was fed with a lpClass buffer.
+    if (lpClass != NULL)
     {
-        lpftLastWriteTime->dwLowDateTime = FullInfo->LastWriteTime.u.LowPart;
-        lpftLastWriteTime->dwHighDateTime = FullInfo->LastWriteTime.u.HighPart;
-    }
+        // NtQuery already told us which is the proper Length of the buffer needed.     
+        FullInfo = RtlAllocateHeap(ProcessHeap, 0, Length);
 
-    if (lpClass != NULL)
-    {
-        if (*lpcClass == 0)
+        if (FullInfo == NULL)
         {
+            ErrorCode = ERROR_OUTOFMEMORY;
             goto Cleanup;
         }
 
-        if (FullInfo->ClassLength > ClassLength)
+        // Now this query should return ERROR_SUCCESS
+        Status = NtQueryKey( hKey, KeyFullInformation, FullInfo, Length, &Length );
+        
+        ErrorCode = ERROR_SUCCESS;
+
+        // Check against the buffer size marked by lpcClass. 
+        ClassLength = (*lpcClass) * sizeof(WCHAR);
+        
+        if (FullInfo->ClassLength >= ClassLength)
         {
             ErrorCode = ERROR_INSUFFICIENT_BUFFER;
         }
         else
         {
-            RtlCopyMemory(lpClass,
-                          FullInfo->Class,
-                          FullInfo->ClassLength);
-            lpClass[FullInfo->ClassLength / sizeof(WCHAR)] = UNICODE_NULL;
+            RtlCopyMemory(lpClass, FullInfo->Class, FullInfo->ClassLength);
+            lpClass[*lpcClass] = 0;
         }
+
+        RtlFreeHeap(ProcessHeap, 0, FullInfo);
     }
 
-    if (lpcClass != NULL)
+    //Set lpcClass:
+    TRACE("lpcClass %d\n", FullInfo->ClassLength);
+    if (lpcClass != NULL)         
     {
         *lpcClass = FullInfo->ClassLength / sizeof(WCHAR);
     }
 
 Cleanup:
-    if (lpClass != NULL)
-    {
-        RtlFreeHeap(ProcessHeap,
-                    0,
-                    FullInfo);
-    }
-
     ClosePredefKey(KeyHandle);
 
     return ErrorCode;
