CHUI-905 (Viewer crashes while using Insert keyboard key in chat): Problem was because when insert was used at the end of a string of text, this would attempt to delete something past the bounds of the string...as a side effect the size of the segment was increasing even though the string length never changed. The segment size would be greater than the string size and would eventually cause an invalid read outside the bounds of the string.

1 files changed, 7 insertions, 1 deletions

diff --git a/indra/llui/lltexteditor.cpp b/indra/llui/lltexteditor.cpp
index d5e08fa29b..b8bdea48b5 100644
--- a/indra/llui/lltexteditor.cpp
+++ b/indra/llui/lltexteditor.cpp
@@ -956,12 +956,18 @@ S32 LLTextEditor::insert(S32 pos, const LLWString &wstr, bool group_with_next_op
 S32 LLTextEditor::remove(S32 pos, S32 length, bool group_with_next_op)
 {
 	S32 end_pos = getEditableIndex(pos + length, true);
+	BOOL removedChar = FALSE;
 
 	segment_vec_t segments_to_remove;
 	// store text segments
 	getSegmentsInRange(segments_to_remove, pos, pos + length, false);
+	
+	if(pos <= end_pos)
+	{
+		removedChar = execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) );
+	}
 
-	return execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) );
+	return removedChar;
 }
 
 S32 LLTextEditor::overwriteChar(S32 pos, llwchar wc)