Bug 333297: UMW nsScriptableUnicodeConverter::FinishWithLength overwrites end of buffer, patch by Phil Ringnalda <philringnalda@gmail.com>, r=smontagu, sr=jag

intl/uconv/src/nsScriptableUConv.cpp

@@ -123,12 +123,10 @@ nsScriptableUnicodeConverter::FinishWithLength(char **_retval, PRInt32* aLength)
 
   nsresult rv = mEncoder->Finish(*_retval, &finLength);
   if (NS_SUCCEEDED(rv))
-    (*_retval)[finLength] = '\0';
+    *aLength = finLength;
   else
     nsMemory::Free(*_retval);
 
-  *aLength = finLength;
-
   return rv;
 
 }
@@ -217,6 +215,7 @@ nsScriptableUnicodeConverter::ConvertToByteArray(const nsAString& aString,
     return rv;
 
   str.Append(data, len);
+  nsMemory::Free(data);
   // NOTE: this being a byte array, it needs no null termination
   *_aData = NS_REINTERPRET_CAST(PRUint8*,
                                 nsMemory::Clone(str.get(), str.Length()));