python
diff --git a/‎Lib/test/test_os.py‎
Lines changed: 15 additions & 0 deletions b/‎Lib/test/test_os.py‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎Misc/NEWS.d/next/Windows/2018-02-07-17-50-48.bpo-29248.Xzwj-6.rst‎
Lines changed: 3 additions & 0 deletions b/‎Misc/NEWS.d/next/Windows/2018-02-07-17-50-48.bpo-29248.Xzwj-6.rst‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎Modules/posixmodule.c‎
Lines changed: 3 additions & 3 deletions b/‎Modules/posixmodule.c‎
Lines changed: 3 additions & 3 deletions
@@ -2165,6 +2165,21 @@ def test_12084(self):
         finally:
             os.chdir(orig_dir)
 
+    @unittest.skipUnless(os.path.lexists(r'C:\Users\All Users')
+                            and os.path.exists(r'C:\ProgramData'),
+                            'Test directories not found')
+    def test_29248(self):
+        # os.symlink() calls CreateSymbolicLink, which creates
+        # the reparse data buffer with the print name stored
+        # first, so the offset is always 0. CreateSymbolicLink
+        # stores the "PrintName" DOS path (e.g. "C:\") first,
+        # with an offset of 0, followed by the "SubstituteName"
+        # NT path (e.g. "\??\C:\"). The "All Users" link, on
+        # the other hand, seems to have been created manually
+        # with an inverted order.
+        target = os.readlink(r'C:\Users\All Users')
+        self.assertTrue(os.path.samefile(target, r'C:\ProgramData'))
+
 
 @unittest.skipUnless(sys.platform == "win32", "Win32 specific tests")
 class Win32JunctionTests(unittest.TestCase):
 
@@ -0,0 +1,3 @@
+Fix :func:`os.readlink` on Windows, which was mistakenly treating the
+``PrintNameOffset`` field of the reparse data buffer as a number of
+characters instead of bytes. Patch by Craig Holmquist and SSE4.
@@ -7439,11 +7439,11 @@ win_readlink(PyObject *self, PyObject *args, PyObject *kwargs)
                 "not a symbolic link");
         return NULL;
     }
-    print_name = rdb->SymbolicLinkReparseBuffer.PathBuffer +
-                 rdb->SymbolicLinkReparseBuffer.PrintNameOffset;
+    print_name = (wchar_t *)((char*)rdb->SymbolicLinkReparseBuffer.PathBuffer +
+                 rdb->SymbolicLinkReparseBuffer.PrintNameOffset);
 
     result = PyUnicode_FromWideChar(print_name,
-                    rdb->SymbolicLinkReparseBuffer.PrintNameLength/2);
+                    rdb->SymbolicLinkReparseBuffer.PrintNameLength / sizeof(wchar_t));
     return result;
 }
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Fix :func:`os.readlink` on Windows, which was mistakenly treating the
	`2`	+``PrintNameOffset`` field of the reparse data buffer as a number of
	`3`	`+characters instead of bytes. Patch by Craig Holmquist and SSE4.`
Original file line number	Diff line number	Diff line change
`@@ -7439,11 +7439,11 @@ win_readlink(PyObject self, PyObject args, PyObject *kwargs)`
`7439`	`7439`	`"not a symbolic link");`
`7440`	`7440`	`return NULL;`
`7441`	`7441`	`}`
`7442`		`- print_name = rdb->SymbolicLinkReparseBuffer.PathBuffer +`
`7443`		`- rdb->SymbolicLinkReparseBuffer.PrintNameOffset;`
	`7442`	`+ print_name = (wchar_t )((char)rdb->SymbolicLinkReparseBuffer.PathBuffer +`
	`7443`	`+ rdb->SymbolicLinkReparseBuffer.PrintNameOffset);`
`7444`	`7444`
`7445`	`7445`	`result = PyUnicode_FromWideChar(print_name,`
`7446`		`- rdb->SymbolicLinkReparseBuffer.PrintNameLength/2);`
	`7446`	`+ rdb->SymbolicLinkReparseBuffer.PrintNameLength / sizeof(wchar_t));`
`7447`	`7447`	`return result;`
`7448`	`7448`	`}`
`7449`	`7449`