use the correct pointer to free the string. Thx to Hartmut for spotting this bug

Modified: trunk/reactos/subsys/csrss/win32csr/conio.c

--- trunk/reactos/subsys/csrss/win32csr/conio.c	2005-08-07 23:22:18 UTC (rev 17189)
+++ trunk/reactos/subsys/csrss/win32csr/conio.c	2005-08-07 23:37:59 UTC (rev 17190)
@@ -1545,7 +1545,7 @@

 CSR_API(CsrWriteConsoleOutputChar)
 {
   NTSTATUS Status;

-  PCHAR String;

+  PCHAR String, tmpString = NULL;

   PBYTE Buffer;
   PCSRSS_CONSOLE Console;
   PCSRSS_SCREEN_BUFFER Buff;
@@ -1577,7 +1577,7 @@

                                       (PWCHAR)Request->Data.WriteConsoleOutputCharRequest.String, 
                                        Request->Data.WriteConsoleOutputCharRequest.Length, 
                                        NULL, 0, NULL, NULL);

-          String = RtlAllocateHeap(GetProcessHeap(), 0, Length);

+          tmpString = String = RtlAllocateHeap(GetProcessHeap(), 0, Length);

           if (String)
             {
               WideCharToMultiByte(Console->CodePage, 0, 
@@ -1635,7 +1635,7 @@

             }
           if (Request->Data.WriteConsoleRequest.Unicode)
             {

-              RtlFreeHeap(GetProcessHeap(), 0, String);

+              RtlFreeHeap(GetProcessHeap(), 0, tmpString);

             }
         }
       if (NULL != Console)