diff --git a/dlls/mshtml/editor.c b/dlls/mshtml/editor.c
index 7cbdf2e46d9..e92cf96e834 100644
--- a/dlls/mshtml/editor.c
+++ b/dlls/mshtml/editor.c
@@ -588,7 +588,7 @@ static HRESULT exec_fontname(HTMLDocument *This, DWORD cmdexecopt, VARIANT *in,
 
         len = MultiByteToWideChar(CP_ACP, 0, stra, -1, NULL, 0);
         strw = heap_alloc(len*sizeof(WCHAR));
-        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, -1);
+        MultiByteToWideChar(CP_ACP, 0, stra, -1, strw, len);
         nsfree(stra);
 
         V_BSTR(out) = SysAllocString(strw);
diff --git a/dlls/mshtml/navigate.c b/dlls/mshtml/navigate.c
index 188cdd7ba00..6e41699b280 100644
--- a/dlls/mshtml/navigate.c
+++ b/dlls/mshtml/navigate.c
@@ -657,7 +657,7 @@ static void parse_post_data(nsIInputStream *post_data_stream, LPWSTR *headers_re
         else
             headers = heap_alloc((len+1)*sizeof(WCHAR));
 
-        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, -1);
+        len = MultiByteToWideChar(CP_ACP, 0, ptr2, ptr-ptr2, headers+headers_len, len);
         headers_len += len;
 
         ptr2 = ptr;