Convert Multi Byte 2 Wide Char crash sometimes

I have a function that sometime cause my program to crash, I did not writethe function myself, could someone tell me what could be causing the crash?

Here's the function:

std::wstring multi_byte_2_wide_char(
            const char* pStr,
            int nLen,
            UINT nCodePage )
      {
            assert( pStr != NULL );
            assert( nLen >= 0 || nLen == -1 );

            // figure out how many wide characters we are going to get
            int nChars = MultiByteToWideChar( nCodePage , 0 , pStr , nLen , NULL , 0 ) ;
            if ( nLen == -1 ) --nChars ;
            if ( nChars == 0 ) return L"";

            // convert the narrow string to a wide string
            // nb: slightly naughty to write directly into the string like this
            std::wstring buf;
            buf.resize( nChars );
            MultiByteToWideChar( nCodePage , 0 , pStr , nLen ,
                  const_cast<wchar_t*>(buf.c_str()) , nChars ) ;

            return buf;
      }

Whe debugging, it seems to crash on the "return buf", here's the last function in the call stack is a malloc and it's where it crash.

Any idea someone?