Memory corruption fix

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@35657 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/common/strconv.cpp b/src/common/strconv.cpp
index 1136bde236c55051afc78b73065f5b5ae31dde42..986bf4f82d39c514752cfcf2edc9ab7ce30c4687 100644 (file)
--- a/src/common/strconv.cpp
+++ b/src/common/strconv.cpp
@@ -1530,7 +1530,8 @@ size_t wxMBConv_iconv::WC2MB(char *buf, const wchar_t *psz, size_t n) const
     wxMutexLocker lock(wxConstCast(this, wxMBConv_iconv)->m_iconvMutex);
 #endif
 
-    size_t inbuf = wxWcslen(psz) * SIZEOF_WCHAR_T;
+    size_t inlen = wxWcslen(psz);
+    size_t inbuf = inlen * SIZEOF_WCHAR_T;
     size_t outbuf = n;
     size_t res, cres;
 
@@ -1542,9 +1543,9 @@ size_t wxMBConv_iconv::WC2MB(char *buf, const wchar_t *psz, size_t n) const
         // (doing WC_BSWAP twice on the original buffer won't help, as it
         //  could be in read-only memory, or be accessed in some other thread)
         tmpbuf = (wchar_t *)malloc(inbuf + SIZEOF_WCHAR_T);
-        for ( size_t n = 0; n < inbuf; n++ )
+        for ( size_t n = 0; n < inlen; n++ )
             tmpbuf[n] = WC_BSWAP(psz[n]);
-        tmpbuf[inbuf] = L'\0';
+        tmpbuf[inlen] = L'\0';
         psz = tmpbuf;
     }