[PATCH] mshtml: fixed second buffer argument to MultiByteToWideChar

[Marcus Meissner]

Hi,

Targetbuffer length must not be -1.

Ciao, Marcus
---
 dlls/mshtml/editor.c   |    2 +-
 dlls/mshtml/navigate.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/editor.c b/dlls/mshtml/editor.c
index 7cbdf2e..e92cf96 100644
--- a/dlls/mshtml/editor.c
+++ b/dlls/mshtml/editor.c
@@ -588,7 +588,7 @@ static HRESULT exec_fontname(HTMLDocument *This, DWORD cmdexecopt, VARIANT *in,
 
         len = MultiByteToWideChar(CP_ACP, 0, stra, -1, NULL, 0);
         strw = heap_alloc(len*sizeof(WCHAR));
-        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, -1);
+        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, len);
         nsfree(stra);
 
         V_BSTR(out) = SysAllocString(strw);
diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
index 188cdd7..6e41699 100644
--- a/dlls/mshtml/navigate.c
+++ b/dlls/mshtml/navigate.c
@@ -657,7 +657,7 @@ static void parse_post_data(nsIInputStream *post_data_stream, LPWSTR *headers_re
         else
             headers = heap_alloc((len+1)*sizeof(WCHAR));
 
-        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, -1);
+        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, len);
         headers_len += len;
 
         ptr2 = ptr;
-- 
1.5.6