Potential buffer overflow in Unicode string conversion (thanks Orville Pike for the report)

[bennylp]

In unicode_win32.c the pj_ansi_to_unicode function uses MultiByteToWideChar to do character conversion which could result in a buffer overflow.

PJ_DEF(wchar_t*) pj_ansi_to_unicode(const char *s, pj_size_t len,
                                    wchar_t *buf, pj_size_t buf_count)
{
    PJ_ASSERT_RETURN(s && buf, NULL);

    len = MultiByteToWideChar(CP_ACP, 0, s, len, buf, buf_count);
    buf[len]=0;
    return buf;
}

Under most circumstances the above won't have a problem however if the value in len and buf_count are the same then doing
"buf[len]=0" is going to overflow the buf buffer.

The same issue also exists in pj_unicode_to_ansi(), and in Symbian port.

[bennylp]

Fixed in r3047