From e62cd89e204d25b20c1e51031b104cdb8d449ade Mon Sep 17 00:00:00 2001 From: Igor Novikov <intorr@gmail.com> Date: Sun, 28 Jan 2018 16:05:58 +0500 Subject: [PATCH] Fix one more memory corruption in line_edit_control. --- src/xrEngine/line_edit_control.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/xrEngine/line_edit_control.cpp b/src/xrEngine/line_edit_control.cpp index a94a5e21dcf..7e8adc728d5 100644 --- a/src/xrEngine/line_edit_control.cpp +++ b/src/xrEngine/line_edit_control.cpp @@ -646,14 +646,14 @@ void line_edit_control::delete_selected(bool back) { u8 dp = ((m_p1 == m_p2) && m_p1 > 0) ? 1 : 0; strncpy_s(m_undo_buf, m_buffer_size, m_edit_str + m_p1 - dp, m_p2 - m_p1 + dp); - strncpy_s(m_edit_str + m_p1 - dp, m_buffer_size, m_edit_str + m_p2, edit_len - m_p2); + strncpy_s(m_edit_str + m_p1 - dp, m_buffer_size - (m_p1 - dp), m_edit_str + m_p2, edit_len - m_p2); m_cur_pos = m_p1 - dp; } else { u8 dn = ((m_p1 == m_p2) && m_p2 < edit_len) ? 1 : 0; strncpy_s(m_undo_buf, m_buffer_size, m_edit_str + m_p1, m_p2 - m_p1 + dn); - strncpy_s(m_edit_str + m_p1, m_buffer_size, m_edit_str + m_p2 + dn, edit_len - m_p2 - dn); + strncpy_s(m_edit_str + m_p1, m_buffer_size - m_p1, m_edit_str + m_p2 + dn, edit_len - m_p2 - dn); m_cur_pos = m_p1; } clamp_cur_pos();