From: Michael Wetherell <mike.wetherell@ntlworld.com>
Date: Sat, 24 Sep 2005 00:16:56 +0000 (+0000)
Subject: Memory corruption fix
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/156162ece8abffbe69fcb66daf28ac8d1779ce7b

Memory corruption fix


git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@35657 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/common/strconv.cpp b/src/common/strconv.cpp
index 1136bde236..986bf4f82d 100644
--- a/src/common/strconv.cpp
+++ b/src/common/strconv.cpp
@@ -1530,7 +1530,8 @@ size_t wxMBConv_iconv::WC2MB(char *buf, const wchar_t *psz, size_t n) const
     wxMutexLocker lock(wxConstCast(this, wxMBConv_iconv)->m_iconvMutex);
 #endif
 
-    size_t inbuf = wxWcslen(psz) * SIZEOF_WCHAR_T;
+    size_t inlen = wxWcslen(psz);
+    size_t inbuf = inlen * SIZEOF_WCHAR_T;
     size_t outbuf = n;
     size_t res, cres;
 
@@ -1542,9 +1543,9 @@ size_t wxMBConv_iconv::WC2MB(char *buf, const wchar_t *psz, size_t n) const
         // (doing WC_BSWAP twice on the original buffer won't help, as it
         //  could be in read-only memory, or be accessed in some other thread)
         tmpbuf = (wchar_t *)malloc(inbuf + SIZEOF_WCHAR_T);
-        for ( size_t n = 0; n < inbuf; n++ )
+        for ( size_t n = 0; n < inlen; n++ )
             tmpbuf[n] = WC_BSWAP(psz[n]);
-        tmpbuf[inbuf] = L'\0';
+        tmpbuf[inlen] = L'\0';
         psz = tmpbuf;
     }