From e62cd89e204d25b20c1e51031b104cdb8d449ade Mon Sep 17 00:00:00 2001
From: Igor Novikov <intorr@gmail.com>
Date: Sun, 28 Jan 2018 16:05:58 +0500
Subject: [PATCH] Fix one more memory corruption in line_edit_control.

---
 src/xrEngine/line_edit_control.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/xrEngine/line_edit_control.cpp b/src/xrEngine/line_edit_control.cpp
index a94a5e21dcf..7e8adc728d5 100644
--- a/src/xrEngine/line_edit_control.cpp
+++ b/src/xrEngine/line_edit_control.cpp
@@ -646,14 +646,14 @@ void line_edit_control::delete_selected(bool back)
         {
             u8 dp = ((m_p1 == m_p2) && m_p1 > 0) ? 1 : 0;
             strncpy_s(m_undo_buf, m_buffer_size, m_edit_str + m_p1 - dp, m_p2 - m_p1 + dp);
-            strncpy_s(m_edit_str + m_p1 - dp, m_buffer_size, m_edit_str + m_p2, edit_len - m_p2);
+            strncpy_s(m_edit_str + m_p1 - dp, m_buffer_size - (m_p1 - dp), m_edit_str + m_p2, edit_len - m_p2);
             m_cur_pos = m_p1 - dp;
         }
         else
         {
             u8 dn = ((m_p1 == m_p2) && m_p2 < edit_len) ? 1 : 0;
             strncpy_s(m_undo_buf, m_buffer_size, m_edit_str + m_p1, m_p2 - m_p1 + dn);
-            strncpy_s(m_edit_str + m_p1, m_buffer_size, m_edit_str + m_p2 + dn, edit_len - m_p2 - dn);
+            strncpy_s(m_edit_str + m_p1, m_buffer_size - m_p1, m_edit_str + m_p2 + dn, edit_len - m_p2 - dn);
             m_cur_pos = m_p1;
         }
         clamp_cur_pos();