mshtml: Make sure to null terminate buffer in parse_extern_script.

dlls/mshtml/mshtml_private.h

@@ -411,7 +411,7 @@ void set_document_bscallback(HTMLDocument*,nsChannelBSC*);
 void set_current_mon(HTMLDocument*,IMoniker*);
 HRESULT start_binding(HTMLDocument*,BSCallback*,IBindCtx*);
 
-HRESULT bind_mon_to_buffer(HTMLDocument*,IMoniker*,void**);
+HRESULT bind_mon_to_buffer(HTMLDocument*,IMoniker*,void**,DWORD*);
 
 nsChannelBSC *create_channelbsc(IMoniker*);
 HRESULT channelbsc_load_stream(nsChannelBSC*,IStream*);

dlls/mshtml/navigate.c

@@ -807,7 +807,7 @@ static BufferBSC *create_bufferbsc(IMoniker *mon)
     return ret;
 }
 
-HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf)
+HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf, DWORD *size)
 {
     BufferBSC *bsc = create_bufferbsc(mon);
     HRESULT hres;
@@ -820,6 +820,7 @@ HRESULT bind_mon_to_buffer(HTMLDocument *doc, IMoniker *mon, void **buf)
         if(SUCCEEDED(hres)) {
             *buf = bsc->buf;
             bsc->buf = NULL;
+            *size = bsc->bsc.readed;
             bsc->size = 0;
         }
     }

dlls/mshtml/script.c

@@ -477,6 +477,7 @@ static void parse_extern_script(ScriptHost *script_host, LPCWSTR src)
     IMoniker *mon;
     char *buf;
     WCHAR *text;
+    DWORD len, size=0;
     HRESULT hres;
 
     static const WCHAR wine_schemaW[] = {'w','i','n','e',':'};
@@ -488,13 +489,16 @@ static void parse_extern_script(ScriptHost *script_host, LPCWSTR src)
     if(FAILED(hres))
         return;
 
-    hres = bind_mon_to_buffer(script_host->doc, mon, (void**)&buf);
+    hres = bind_mon_to_buffer(script_host->doc, mon, (void**)&buf, &size);
     IMoniker_Release(mon);
     if(FAILED(hres))
         return;
 
-    text = heap_strdupAtoW(buf);
+    len = MultiByteToWideChar(CP_ACP, 0, buf, size, NULL, 0);
+    text = heap_alloc((len+1)*sizeof(WCHAR));
+    MultiByteToWideChar(CP_ACP, 0, buf, size, text, len);
     heap_free(buf);
+    text[len] = 0;
 
     parse_text(script_host, text);