diff options
| author | Campbell Barton <ideasman42@gmail.com> | 2011-03-08 05:24:29 +0300 |
|---|---|---|
| committer | Campbell Barton <ideasman42@gmail.com> | 2011-03-08 05:24:29 +0300 |
| commit | b9db9e147efe08bee72451f386c3d8917998afdf (patch) | |
| tree | 567ce0aedb8197a8e3c70d582049d68c413ec46f /source/blender/editors | |
| parent | 471c0c1afb70e298e8746dcd229d67e242c21fc8 (diff) | |
ui_textedit_delete_selection() could access past the array bounds.
Diffstat (limited to 'source/blender/editors')
| -rw-r--r-- | source/blender/editors/interface/interface_handlers.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/blender/editors/interface/interface_handlers.c b/source/blender/editors/interface/interface_handlers.c index c01eb351fba..67154a41e32 100644 --- a/source/blender/editors/interface/interface_handlers.c +++ b/source/blender/editors/interface/interface_handlers.c @@ -1254,7 +1254,7 @@ static int ui_textedit_delete_selection(uiBut *but, uiHandleButtonData *data) int len= strlen(str); int change= 0; if(but->selsta != but->selend && len) { - memmove( str+but->selsta, str+but->selend, len-but->selsta+1 ); + memmove( str+but->selsta, str+but->selend, (len - but->selend) + 1 ); change= 1; } |