Index: sctrl.c
===================================================================
--- dll/win32/advapi32/service/sctrl.c	(revision 68198)
+++ dll/win32/advapi32/service/sctrl.c	(working copy)
@@ -285,9 +285,9 @@
                          LPWSTR **lpArgVector)
 {
     LPWSTR *lpVector;
-    LPWSTR *lpArg;
     LPWSTR pszServiceName;
     DWORD cbServiceName;
+    DWORD cbArguments;
     DWORD cbTotal;
     DWORD i;
 
@@ -302,7 +302,10 @@
 
     cbTotal = cbServiceName + sizeof(LPWSTR);
     if (ControlPacket->dwArgumentsCount > 0)
-        cbTotal += ControlPacket->dwSize - ControlPacket->dwArgumentsOffset;
+    {
+        cbArguments = ControlPacket->dwSize - ControlPacket->dwArgumentsOffset;
+        cbTotal += cbArguments;
+    }
 
     lpVector = HeapAlloc(GetProcessHeap(),
                          HEAP_ZERO_MEMORY,
@@ -310,26 +313,24 @@
     if (lpVector == NULL)
         return ERROR_OUTOFMEMORY;
 
-    lpArg = lpVector;
-    *lpArg = (LPWSTR)(lpArg + 1);
-    lpArg++;
-
-    memcpy(lpArg, pszServiceName, cbServiceName);
-    lpArg = (LPWSTR*)((ULONG_PTR)lpArg + cbServiceName);
-
     if (ControlPacket->dwArgumentsCount > 0)
     {
-        memcpy(lpArg,
+        memcpy(&lpVector[1],
                ((PBYTE)ControlPacket + ControlPacket->dwArgumentsOffset),
-               ControlPacket->dwSize - ControlPacket->dwArgumentsOffset);
+               cbArguments);
 
         for (i = 0; i < ControlPacket->dwArgumentsCount; i++)
         {
-            *lpArg = (LPWSTR)((ULONG_PTR)lpArg + (ULONG_PTR)*lpArg);
-            lpArg++;
+            lpVector[i + 1] = (LPWSTR)((PBYTE)&lpVector[i + 1] + (ULONG_PTR)lpVector[i + 1]);
+            FIXME("Unicode lpVector[%lu] = %ls\n", i + 1, lpVector[i + 1]);
         }
     }
 
+    lpVector[0] = (PWSTR)((PBYTE)&lpVector[1] + cbArguments);
+    ASSERT((PBYTE)lpVector[0] + cbServiceName == (PBYTE)lpVector + cbTotal);
+    memcpy(lpVector[0], pszServiceName, cbServiceName);
+    FIXME("Unicode lpVector[0] = %ls\n", lpVector[0]);
+
     *lpArgCount = ControlPacket->dwArgumentsCount + 1;
     *lpArgVector = lpVector;
 
@@ -342,17 +343,12 @@
                       LPDWORD lpArgCount,
                       LPSTR **lpArgVector)
 {
+    DWORD Error;
+    DWORD ArgCount;
     LPSTR *lpVector;
-    LPSTR *lpPtr;
-    LPWSTR lpUnicodeString;
-    LPWSTR pszServiceName;
-    LPSTR lpAnsiString;
-    DWORD cbServiceName;
-    DWORD dwVectorSize;
-    DWORD dwUnicodeSize;
-    DWORD dwAnsiSize = 0;
-    DWORD dwAnsiNameSize = 0;
+    LPWSTR *lpVectorW;
     DWORD i;
+    DWORD cchArg;
 
     if (ControlPacket == NULL || lpArgCount == NULL || lpArgVector == NULL)
         return ERROR_INVALID_PARAMETER;
@@ -360,81 +356,31 @@
     *lpArgCount = 0;
     *lpArgVector = NULL;
 
-    pszServiceName = (PWSTR)((PBYTE)ControlPacket + ControlPacket->dwServiceNameOffset);
-    cbServiceName = lstrlenW(pszServiceName) * sizeof(WCHAR) + sizeof(UNICODE_NULL);
+    Error = ScBuildUnicodeArgsVector(ControlPacket,
+                                     &ArgCount,
+                                     &lpVectorW);
+    if (Error)
+        return Error;
 
-    dwAnsiNameSize = WideCharToMultiByte(CP_ACP,
-                                         0,
-                                         pszServiceName,
-                                         cbServiceName,
-                                         NULL,
-                                         0,
-                                         NULL,
-                                         NULL);
+    lpVector = (LPSTR *)lpVectorW;
 
-    dwVectorSize = ControlPacket->dwArgumentsCount * sizeof(LPWSTR);
-    if (ControlPacket->dwArgumentsCount > 0)
+    ASSERT(ArgCount == ControlPacket->dwArgumentsCount + 1);
+    for (i = 0; i < ArgCount; i++)
     {
-        lpUnicodeString = (LPWSTR)((PBYTE)ControlPacket +
-                                   ControlPacket->dwArgumentsOffset +
-                                   dwVectorSize);
-        dwUnicodeSize = (ControlPacket->dwSize -
-                         ControlPacket->dwArgumentsOffset -
-                         dwVectorSize) / sizeof(WCHAR);
-
-        dwAnsiSize = WideCharToMultiByte(CP_ACP,
-                                         0,
-                                         lpUnicodeString,
-                                         dwUnicodeSize,
-                                         NULL,
-                                         0,
-                                         NULL,
-                                         NULL);
-    }
-
-    dwVectorSize += sizeof(LPWSTR);
-
-    lpVector = HeapAlloc(GetProcessHeap(),
-                         HEAP_ZERO_MEMORY,
-                         dwVectorSize + dwAnsiNameSize + dwAnsiSize);
-    if (lpVector == NULL)
-        return ERROR_OUTOFMEMORY;
-
-    lpPtr = (LPSTR*)lpVector;
-    lpAnsiString = (LPSTR)((ULONG_PTR)lpVector + dwVectorSize);
-
-    WideCharToMultiByte(CP_ACP,
-                        0,
-                        pszServiceName,
-                        cbServiceName,
-                        lpAnsiString,
-                        dwAnsiNameSize,
-                        NULL,
-                        NULL);
-
-    if (ControlPacket->dwArgumentsCount > 0)
-    {
-        lpAnsiString = (LPSTR)((ULONG_PTR)lpAnsiString + dwAnsiNameSize);
-
+        char buffer[100];
+        cchArg = wcslen(lpVectorW[i]) + 1;
         WideCharToMultiByte(CP_ACP,
                             0,
-                            lpUnicodeString,
-                            dwUnicodeSize,
-                            lpAnsiString,
-                            dwAnsiSize,
+                            lpVectorW[i],
+                            cchArg,
+                            buffer,
+                            _countof(buffer),
                             NULL,
                             NULL);
+        memcpy(lpVector[i], buffer, cchArg);
+        FIXME("Ansi lpVector[%lu] = %s\n", i, lpVector[i]);
     }
 
-    lpAnsiString = (LPSTR)((ULONG_PTR)lpVector + dwVectorSize);
-    for (i = 0; i < ControlPacket->dwArgumentsCount + 1; i++)
-    {
-        *lpPtr = lpAnsiString;
-
-        lpPtr++;
-        lpAnsiString += (strlen(lpAnsiString) + 1);
-    }
-
     *lpArgCount = ControlPacket->dwArgumentsCount + 1;
     *lpArgVector = lpVector;