summaryrefslogtreecommitdiff
path: root/indra/llui
diff options
context:
space:
mode:
authorGilbert Gonzales <gilbert@lindenlab.com>2013-03-28 17:31:45 -0700
committerGilbert Gonzales <gilbert@lindenlab.com>2013-03-28 17:31:45 -0700
commite76a4eb7c51ab662d5f463737361cfdb1e82bf67 (patch)
treea1154d2680ea6c6bd7e8e32ed61e2666ec560fe1 /indra/llui
parentda8f2ffb16d6df1ccb9f34ddf6f26d799d2ea127 (diff)
CHUI-905 (Viewer crashes while using Insert keyboard key in chat): Problem was because when insert was used at the end of a string of text, this would attempt to delete something past the bounds of the string...as a side effect the size of the segment was increasing even though the string length never changed. The segment size would be greater than the string size and would eventually cause an invalid read outside the bounds of the string.
Diffstat (limited to 'indra/llui')
-rw-r--r--indra/llui/lltexteditor.cpp8
1 files changed, 7 insertions, 1 deletions
diff --git a/indra/llui/lltexteditor.cpp b/indra/llui/lltexteditor.cpp
index d5e08fa29b..b8bdea48b5 100644
--- a/indra/llui/lltexteditor.cpp
+++ b/indra/llui/lltexteditor.cpp
@@ -956,12 +956,18 @@ S32 LLTextEditor::insert(S32 pos, const LLWString &wstr, bool group_with_next_op
S32 LLTextEditor::remove(S32 pos, S32 length, bool group_with_next_op)
{
S32 end_pos = getEditableIndex(pos + length, true);
+ BOOL removedChar = FALSE;
segment_vec_t segments_to_remove;
// store text segments
getSegmentsInRange(segments_to_remove, pos, pos + length, false);
+
+ if(pos <= end_pos)
+ {
+ removedChar = execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) );
+ }
- return execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) );
+ return removedChar;
}
S32 LLTextEditor::overwriteChar(S32 pos, llwchar wc)