# HG changeset patch
# User Darkvater
# Date 1172848108 0
# Node ID e2f112f5d50f620fe75a549836bd0ab7d356f65d
# Parent  48825779b73f551e0d7dd7c2643e4958dc7d30bb
(svn r8975) -Regression: [win32] Possible buffer overflow if unicode text is pasted into an input box and needs trimming. The last character was wrongly assumed to be of length 1 (tb->maxlength - 1), while a unicode character can be up to 4 long.

diff -r 48825779b73f -r e2f112f5d50f src/win32.cpp
--- a/src/win32.cpp	Fri Mar 02 15:02:12 2007 +0000
+++ b/src/win32.cpp	Fri Mar 02 15:08:28 2007 +0000
@@ -1017,16 +1017,16 @@
 	width = length = 0;
 
 	for (ptr = utf8_buf; (c = Utf8Consume(&ptr)) != '\0';) {
-		byte charwidth;
-
 		if (!IsPrintable(c)) break;
-		if (tb->length + length >= tb->maxlength - 1) break;
-		charwidth = GetCharacterWidth(FS_NORMAL, c);
 
+		size_t len = Utf8CharLen(c);
+		if (tb->length + length >= tb->maxlength - (uint16)len) break;
+
+		byte charwidth = GetCharacterWidth(FS_NORMAL, c);
 		if (tb->maxwidth != 0 && width + tb->width + charwidth > tb->maxwidth) break;
 
 		width += charwidth;
-		length += Utf8CharLen(c);
+		length += len;
 	}
 
 	if (length == 0) return false;
@@ -1038,6 +1038,7 @@
 
 	tb->length += length;
 	tb->caretpos += length;
+	assert(tb->length < tb->maxlength);
 	tb->buf[tb->length] = '\0'; // terminating zero
 
 	return true;