python
diff --git a/‎Lib/test/test_os.py‎
Lines changed: 15 additions & 0 deletions b/‎Lib/test/test_os.py‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎Misc/NEWS.d/next/Windows/2018-02-07-17-50-48.bpo-29248.Xzwj-6.rst‎
Lines changed: 3 additions & 0 deletions b/‎Misc/NEWS.d/next/Windows/2018-02-07-17-50-48.bpo-29248.Xzwj-6.rst‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎Modules/posixmodule.c‎
Lines changed: 3 additions & 3 deletions b/‎Modules/posixmodule.c‎
Lines changed: 3 additions & 3 deletions
@@ -2171,6 +2171,21 @@ def test_12084(self):
         finally:
             os.chdir(orig_dir)
 
+    @unittest.skipUnless(os.path.lexists(r'C:\Users\All Users')
+                            and os.path.exists(r'C:\ProgramData'),
+                            'Test directories not found')
+    def test_29248(self):
+        # os.symlink() calls CreateSymbolicLink, which creates
+        # the reparse data buffer with the print name stored
+        # first, so the offset is always 0. CreateSymbolicLink
+        # stores the "PrintName" DOS path (e.g. "C:\") first,
+        # with an offset of 0, followed by the "SubstituteName"
+        # NT path (e.g. "\??\C:\"). The "All Users" link, on
+        # the other hand, seems to have been created manually
+        # with an inverted order.
+        target = os.readlink(r'C:\Users\All Users')
+        self.assertTrue(os.path.samefile(target, r'C:\ProgramData'))
+
 
 @unittest.skipUnless(sys.platform == "win32", "Win32 specific tests")
 class Win32JunctionTests(unittest.TestCase):
 
@@ -0,0 +1,3 @@
+Fix :func:`os.readlink` on Windows, which was mistakenly treating the
+``PrintNameOffset`` field of the reparse data buffer as a number of
+characters instead of bytes. Patch by Craig Holmquist and SSE4.
@@ -7127,11 +7127,11 @@ win_readlink(PyObject *self, PyObject *args, PyObject *kwargs)
                 "not a symbolic link");
         return NULL;
     }
-    print_name = rdb->SymbolicLinkReparseBuffer.PathBuffer +
-                 rdb->SymbolicLinkReparseBuffer.PrintNameOffset;
+    print_name = (wchar_t *)((char*)rdb->SymbolicLinkReparseBuffer.PathBuffer +
+                 rdb->SymbolicLinkReparseBuffer.PrintNameOffset);
 
     result = PyUnicode_FromWideChar(print_name,
-                    rdb->SymbolicLinkReparseBuffer.PrintNameLength/2);
+                    rdb->SymbolicLinkReparseBuffer.PrintNameLength / sizeof(wchar_t));
     return result;
 }
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Fix :func:`os.readlink` on Windows, which was mistakenly treating the
	`2`	+``PrintNameOffset`` field of the reparse data buffer as a number of
	`3`	`+characters instead of bytes. Patch by Craig Holmquist and SSE4.`
Original file line number	Diff line number	Diff line change
`@@ -7127,11 +7127,11 @@ win_readlink(PyObject self, PyObject args, PyObject *kwargs)`
`7127`	`7127`	`"not a symbolic link");`
`7128`	`7128`	`return NULL;`
`7129`	`7129`	`}`
`7130`		`- print_name = rdb->SymbolicLinkReparseBuffer.PathBuffer +`
`7131`		`- rdb->SymbolicLinkReparseBuffer.PrintNameOffset;`
	`7130`	`+ print_name = (wchar_t )((char)rdb->SymbolicLinkReparseBuffer.PathBuffer +`
	`7131`	`+ rdb->SymbolicLinkReparseBuffer.PrintNameOffset);`
`7132`	`7132`
`7133`	`7133`	`result = PyUnicode_FromWideChar(print_name,`
`7134`		`- rdb->SymbolicLinkReparseBuffer.PrintNameLength/2);`
	`7134`	`+ rdb->SymbolicLinkReparseBuffer.PrintNameLength / sizeof(wchar_t));`
`7135`	`7135`	`return result;`
`7136`	`7136`	`}`
`7137`	`7137`