mshtml: Fixed second buffer argument to MultiByteToWideChar.

dlls/mshtml/editor.c

@@ -588,7 +588,7 @@ static HRESULT exec_fontname(HTMLDocument *This, DWORD cmdexecopt, VARIANT *in,
 
         len = MultiByteToWideChar(CP_ACP, 0, stra, -1, NULL, 0);
         strw = heap_alloc(len*sizeof(WCHAR));
-        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, -1);
+        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, len);
         nsfree(stra);
 
         V_BSTR(out) = SysAllocString(strw);

dlls/mshtml/navigate.c

@@ -657,7 +657,7 @@ static void parse_post_data(nsIInputStream *post_data_stream, LPWSTR *headers_re
         else
             headers = heap_alloc((len+1)*sizeof(WCHAR));
 
-        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, -1);
+        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, len);
         headers_len += len;
 
         ptr2 = ptr;