The last argument to MultiByteToWideChar is wide character count and

dlls/comctl32/comctl32undoc.c

@@ -579,7 +579,7 @@ INT WINAPI AddMRUStringA(HANDLE hList, LPCSTR lpszString)
     if (!stringW)
         return -1;
 
-    MultiByteToWideChar(CP_ACP, 0, lpszString, -1, stringW, len);
+    MultiByteToWideChar(CP_ACP, 0, lpszString, -1, stringW, len/sizeof(WCHAR));
     ret = AddMRUData(hList, stringW, len);
     Free(stringW);
     return ret;

dlls/comctl32/propsheet.c

@@ -2161,7 +2161,7 @@ static void PROPSHEET_SetTitleA(HWND hwndDlg, DWORD dwStyle, LPCSTR lpszText)
   {
      WCHAR szTitle[256];
      MultiByteToWideChar(CP_ACP, 0, lpszText, -1,
-			     szTitle, sizeof(szTitle));
+                         szTitle, sizeof(szTitle)/sizeof(WCHAR));
      PROPSHEET_SetTitleW(hwndDlg, dwStyle, szTitle);
   }
   else

dlls/comctl32/toolbar.c

@@ -6483,23 +6483,24 @@ static LRESULT TOOLBAR_TTGetDispInfo (TOOLBAR_INFO *infoPtr, NMTTDISPINFOW *lpnm
 
         TRACE("TBN_GETINFOTIPA - got string %s\n", debugstr_a(tbgit.pszText));
 
-        len = -1 + MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, -1, NULL, 0);
-        if (len > sizeof(lpnmtdi->szText)/sizeof(lpnmtdi->szText[0])-1)
+        len = MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, -1, NULL, 0);
+        if (len > sizeof(lpnmtdi->szText)/sizeof(lpnmtdi->szText[0]))
         {
             /* need to allocate temporary buffer in infoPtr as there
              * isn't enough space in buffer passed to us by the
              * tooltip control */
-            infoPtr->pszTooltipText = Alloc((len+1)*sizeof(WCHAR));
+            infoPtr->pszTooltipText = Alloc(len*sizeof(WCHAR));
             if (infoPtr->pszTooltipText)
             {
-                MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, len+1, infoPtr->pszTooltipText, (len+1)*sizeof(WCHAR));
+                MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, -1, infoPtr->pszTooltipText, len);
                 lpnmtdi->lpszText = infoPtr->pszTooltipText;
                 return 0;
             }
         }
         else if (len > 0)
         {
-            MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, len+1, lpnmtdi->lpszText, (len+1)*sizeof(WCHAR));
+            MultiByteToWideChar(CP_ACP, 0, tbgit.pszText, -1,
+                                lpnmtdi->lpszText, sizeof(lpnmtdi->szText)/sizeof(lpnmtdi->szText[0]));
             return 0;
         }
     }

dlls/comctl32/treeview.c

@@ -775,8 +775,8 @@ TREEVIEW_UpdateDispInfo(TREEVIEW_INFO *infoPtr, TREEVIEW_ITEM *wineItem,
 		wineItem->pszText = newText;
 		MultiByteToWideChar( CP_ACP, 0,
 				     (LPSTR)callback.item.pszText, -1,
-				     wineItem->pszText, buflen);
-		wineItem->cchTextMax = buflen;
+				     wineItem->pszText, buflen/sizeof(WCHAR));
+		wineItem->cchTextMax = buflen/sizeof(WCHAR);
 	    }
 	    /* If ReAlloc fails we have nothing to do, but keep original text */
 	}
@@ -818,8 +818,8 @@ TREEVIEW_UpdateDispInfo(TREEVIEW_INFO *infoPtr, TREEVIEW_ITEM *wineItem,
 		wineItem->pszText = newText;
 		MultiByteToWideChar( CP_ACP, 0,
 				     (LPSTR)callback.item.pszText, -1,
-				     wineItem->pszText, buflen);
-		wineItem->cchTextMax = buflen;
+				     wineItem->pszText, buflen/sizeof(WCHAR));
+		wineItem->cchTextMax = buflen/sizeof(WCHAR);
 		if (oldText)
 		    Free(oldText);
 	    }

dlls/dbghelp/minidump.c

@@ -407,7 +407,7 @@ static  void    dump_modules(struct dump_context* dc, BOOL dump_elf)
         if (sizeof(ULONG) + ms->Length > sizeof(tmp))
             FIXME("Buffer overflow!!!\n");
         MultiByteToWideChar(CP_ACP, 0, dc->module[i].name, -1,
-                            ms->Buffer, ms->Length);
+                            ms->Buffer, ms->Length/sizeof(WCHAR));
 
         if (dc->cb)
         {

dlls/dinput/effect_linuxinput.c

@@ -903,7 +903,7 @@ HRESULT linuxinput_get_info_W(
 
     /* yes, this is windows behavior (print the GUID_Name for name) */
     MultiByteToWideChar(CP_ACP, 0, _dump_dinput_GUID(rguid), -1, 
-		        (WCHAR*)&(info->tszName), sizeof(WCHAR) * MAX_PATH);
+		        (WCHAR*)&(info->tszName), MAX_PATH);
 
     return DI_OK;
 }

dlls/dsound/propset.c

@@ -1088,8 +1088,8 @@ static HRESULT WINAPI DSPROPERTY_Enumerate1(
                         lstrcpynA(data.DescriptionA, desc.szDesc, sizeof(data.DescriptionA));
                         lstrcpynA(data.ModuleA, desc.szDrvname, sizeof(data.ModuleA));
 
-                        MultiByteToWideChar( CP_ACP, 0, data.DescriptionA, -1, data.DescriptionW, sizeof(data.DescriptionW) );
-                        MultiByteToWideChar( CP_ACP, 0, data.ModuleA, -1, data.ModuleW, sizeof(data.ModuleW) );
+                        MultiByteToWideChar( CP_ACP, 0, data.DescriptionA, -1, data.DescriptionW, sizeof(data.DescriptionW)/sizeof(WCHAR) );
+                        MultiByteToWideChar( CP_ACP, 0, data.ModuleA, -1, data.ModuleW, sizeof(data.ModuleW)/sizeof(WCHAR) );
 
                         data.Type = DIRECTSOUNDDEVICE_TYPE_EMULATED;
                         err = mmErr(waveOutMessage((HWAVEOUT)wod, DRV_QUERYDSOUNDIFACE, (DWORD_PTR)&drv, 0));
@@ -1115,8 +1115,8 @@ static HRESULT WINAPI DSPROPERTY_Enumerate1(
                         lstrcpynA(data.DescriptionA, desc.szDesc, sizeof(data.DescriptionA));
                         lstrcpynA(data.ModuleA, desc.szDrvname, sizeof(data.ModuleA));
 
-                        MultiByteToWideChar( CP_ACP, 0, data.DescriptionA, -1, data.DescriptionW, sizeof(data.DescriptionW) );
-                        MultiByteToWideChar( CP_ACP, 0, data.ModuleA, -1, data.ModuleW, sizeof(data.ModuleW) );
+                        MultiByteToWideChar( CP_ACP, 0, data.DescriptionA, -1, data.DescriptionW, sizeof(data.DescriptionW)/sizeof(WCHAR) );
+                        MultiByteToWideChar( CP_ACP, 0, data.ModuleA, -1, data.ModuleW, sizeof(data.ModuleW)/sizeof(WCHAR) );
 
                         data.Type = DIRECTSOUNDDEVICE_TYPE_EMULATED;
                         err = mmErr(waveInMessage((HWAVEIN)wid, DRV_QUERYDSOUNDIFACE, (DWORD_PTR)&drv, 0));

dlls/gdi/freetype.c

@@ -848,7 +848,7 @@ static void LoadReplaceList(void)
 			    &dlen) == ERROR_SUCCESS) {
 	    TRACE("Got %s=%s\n", debugstr_a(value), debugstr_a(data));
             /* "NewName"="Oldname" */
-            if(!MultiByteToWideChar(CP_ACP, 0, data, -1, old_nameW, sizeof(old_nameW)))
+            if(!MultiByteToWideChar(CP_ACP, 0, data, -1, old_nameW, sizeof(old_nameW)/sizeof(WCHAR)))
                 break;
 
             /* Find the old family and hence all of the font files
@@ -3075,7 +3075,7 @@ UINT WineEngGetOutlineTextMetrics(GdiFont font, UINT cbSize,
       * sizeof(WCHAR);
     style_nameW = HeapAlloc(GetProcessHeap(), 0, lensty);
     MultiByteToWideChar(CP_ACP, 0, ft_face->style_name, -1,
-			style_nameW, lensty);
+			style_nameW, lensty/sizeof(WCHAR));
 
     /* These names should be read from the TT name table */
 

dlls/oleaut32/tests/vartest.c

@@ -625,7 +625,7 @@ static HRESULT (WINAPI *pVarParseNumFromStr)(OLECHAR*,LCID,ULONG,NUMPARSE*,BYTE*
 
 /* Macros for converting and testing the result of VarParseNumFromStr */
 #define FAILDIG 255
-#define CONVERTN(str,dig,flags) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)); \
+#define CONVERTN(str,dig,flags) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)/sizeof(WCHAR)); \
   memset(rgb, FAILDIG, sizeof(rgb)); memset(&np,-1,sizeof(np)); np.cDig = dig; np.dwInFlags = flags; \
   hres = pVarParseNumFromStr(buff,lcid,LOCALE_NOUSEROVERRIDE,&np,rgb)
 #define CONVERT(str,flags) CONVERTN(str,sizeof(rgb),flags)

dlls/oleaut32/tests/vartype.c

@@ -121,7 +121,7 @@ static HMODULE hOleaut32;
 
 #define CONVERT_STR(func,str,flags) \
   SetLastError(0); \
-  if (str) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)); \
+  if (str) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)/sizeof(WCHAR)); \
   hres = p##func(str ? buff : NULL,in,flags,&out)
 
 #define COPYTEST(val, vt, srcval, dstval, srcref, dstref, fs) do { \
@@ -3249,7 +3249,7 @@ static void test_VarDateFromDec(void)
 
 #define DFS(str) \
   buff[0] = '\0'; out = 0.0; \
-  if (str) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)); \
+  if (str) MultiByteToWideChar(CP_ACP,0,str,-1,buff,sizeof(buff)/sizeof(WCHAR)); \
   hres = pVarDateFromStr(str ? buff : NULL,lcid,LOCALE_NOUSEROVERRIDE,&out)
 
 #define MKRELDATE(day,mth) st.wMonth = mth; st.wDay = day; \

dlls/riched20/reader.c

@@ -2755,7 +2755,7 @@ RTFFlushCPOutputBuffer(RTF_Info *info)
         int length;
 
         length = MultiByteToWideChar(info->codePage, 0, info->cpOutputBuffer,
-                                     info->dwCPOutputCount, buffer, bufferMax);
+                                     info->dwCPOutputCount, buffer, bufferMax/sizeof(WCHAR));
         info->dwCPOutputCount = 0;
 
         RTFPutUnicodeString(info, buffer, length);

dlls/riched20/style.c

@@ -52,7 +52,7 @@ CHARFORMAT2W *ME_ToCF2W(CHARFORMAT2W *to, CHARFORMAT2W *from)
     CopyMemory(to, f, sizeof(CHARFORMATA)-sizeof(f->szFaceName));
     /* convert face name */
     if (f->dwMask & CFM_FACE)
-      MultiByteToWideChar(0, 0, f->szFaceName, -1, to->szFaceName, sizeof(to->szFaceName));
+      MultiByteToWideChar(0, 0, f->szFaceName, -1, to->szFaceName, sizeof(to->szFaceName)/sizeof(WCHAR));
     /* copy the rest of the 2A structure to 2W */
     CopyMemory(1+((CHARFORMATW *)to), f+1, sizeof(CHARFORMAT2A)-sizeof(CHARFORMATA));
     to->cbSize = sizeof(CHARFORMAT2W);

dlls/secur32/thunks.c

@@ -620,7 +620,7 @@ static PSecPkgInfoW _copyPackageInfoFlatAToW(PSecPkgInfoA infoA)
             {
                 ret->Comment = nextString;
                 MultiByteToWideChar(CP_ACP, 0, infoA->Comment, -1, nextString,
-                 nameLen);
+                 commentLen);
             }
             else
                 ret->Comment = NULL;

dlls/setupapi/parser.c

@@ -951,8 +951,7 @@ static struct inf_file *parse_file( HANDLE handle, const WCHAR *class, UINT *err
         WCHAR *new_buff = HeapAlloc( GetProcessHeap(), 0, size * sizeof(WCHAR) );
         if (new_buff)
         {
-            DWORD len = MultiByteToWideChar( CP_ACP, 0, buffer, size, new_buff,
-                                             size * sizeof(WCHAR) );
+            DWORD len = MultiByteToWideChar( CP_ACP, 0, buffer, size, new_buff, size );
             err = parse_buffer( file, new_buff, new_buff + len, error_line );
             HeapFree( GetProcessHeap(), 0, new_buff );
         }

dlls/shlwapi/reg.c

@@ -134,7 +134,7 @@ LONG WINAPI SHRegOpenUSKeyW(LPCWSTR Path, REGSAM AccessType, HUSKEY hRelativeUSK
 
     /* Create internal HUSKEY */
     hKey = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*hKey));
-    lstrcpynW(hKey->lpszPath, Path, sizeof(hKey->lpszPath));
+    lstrcpynW(hKey->lpszPath, Path, sizeof(hKey->lpszPath)/sizeof(WCHAR));
 
     if (hRelativeUSKey)
     {

dlls/shlwapi/string.c

@@ -1810,7 +1810,7 @@ HRESULT WINAPI SHStrDupA(LPCSTR lpszStr, LPWSTR * lppszDest)
 
   if (*lppszDest)
   {
-    MultiByteToWideChar(0, 0, lpszStr, -1, *lppszDest, len);
+    MultiByteToWideChar(0, 0, lpszStr, -1, *lppszDest, len/sizeof(WCHAR));
     hRet = S_OK;
   }
   else

dlls/winmm/message16.c

@@ -3452,7 +3452,7 @@ static  WINMM_MapType	MCI_UnMapMsg32WTo16(WORD uDevType, WORD wMsg, DWORD dwFlag
             UnMapLS( lParam );
 	    if (msip16) {
                 MultiByteToWideChar(CP_ACP, 0, MapSL(msip16->lpstrReturn), msip16->dwRetSize, 
-                                    msip32w->lpstrReturn, msip32w->dwRetSize);
+                                    msip32w->lpstrReturn, msip32w->dwRetSize/sizeof(WCHAR));
                 UnMapLS( msip16->lpstrReturn );
                 HeapFree( GetProcessHeap(), 0, MapSL(msip16->lpstrReturn) );
                 HeapFree( GetProcessHeap(), 0, (char*)msip16 - sizeof(LPMCI_SYSINFO_PARMSW) );

dlls/winmm/winmm.c

@@ -603,7 +603,7 @@ UINT WINAPI mixerGetLineInfoA(HMIXEROBJ hmix, LPMIXERLINEA lpmliA,
 	mliW.Target.wMid = lpmliA->Target.wMid;
 	mliW.Target.wPid = lpmliA->Target.wPid;
 	mliW.Target.vDriverVersion = lpmliA->Target.vDriverVersion;
-        MultiByteToWideChar( CP_ACP, 0, lpmliA->Target.szPname, -1, mliW.Target.szPname, sizeof(mliW.Target.szPname));
+        MultiByteToWideChar( CP_ACP, 0, lpmliA->Target.szPname, -1, mliW.Target.szPname, sizeof(mliW.Target.szPname)/sizeof(WCHAR));
 	break;
     default:
 	WARN("Unsupported fdwControls=0x%08lx\n", fdwInfo);

dlls/winsock/socket.c

@@ -3082,7 +3082,7 @@ SOCKET WINAPI WSASocketA(int af, int type, int protocol,
 
     memcpy(&info, lpProtocolInfo, FIELD_OFFSET(WSAPROTOCOL_INFOW, szProtocol));
     len = MultiByteToWideChar(CP_ACP, 0, lpProtocolInfo->szProtocol, -1,
-                              info.szProtocol, WSAPROTOCOL_LEN * sizeof(WCHAR) + 1);
+                              info.szProtocol, WSAPROTOCOL_LEN + 1);
 
     if (!len)
     {

dlls/x11drv/xim.c

@@ -224,7 +224,7 @@ void X11DRV_XIMLookupChars( const char *str, DWORD count )
     WCHAR wcOutput[64];
     HWND focus;
 
-    dwOutput = MultiByteToWideChar(CP_UNIXCP, 0, str, count, wcOutput, sizeof(wcOutput));
+    dwOutput = MultiByteToWideChar(CP_UNIXCP, 0, str, count, wcOutput, sizeof(wcOutput)/sizeof(WCHAR));
 
     if (pImmAssociateContext && (focus = GetFocus()))
         pImmAssociateContext(focus,root_context);

programs/winemenubuilder/winemenubuilder.c

@@ -994,7 +994,7 @@ int PASCAL WinMain (HINSTANCE hInstance, HINSTANCE prev, LPSTR cmdline, int show
         {
             WCHAR link[MAX_PATH];
 
-            MultiByteToWideChar( CP_ACP, 0, token, -1, link, sizeof(link) );
+            MultiByteToWideChar( CP_ACP, 0, token, -1, link, sizeof(link)/sizeof(WCHAR) );
             if( !Process_Link( link, bAgain ) )
             {
 	        WINE_ERR( "failed to build menu item for %s\n",token);