From 67921fae6d9f32464b42b6b3086de109c0761532 Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <andreykproductengine@lindenlab.com>
Date: Wed, 16 Apr 2025 22:39:02 +0300
Subject: #3922 out_of_range crash in preeditor

---
 indra/llui/lllineeditor.cpp | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

(limited to 'indra/llui/lllineeditor.cpp')

diff --git a/indra/llui/lllineeditor.cpp b/indra/llui/lllineeditor.cpp
index 66b274c33f..45dab88e87 100644
--- a/indra/llui/lllineeditor.cpp
+++ b/indra/llui/lllineeditor.cpp
@@ -2505,9 +2505,24 @@ void LLLineEditor::resetPreedit()
     if (hasPreeditString())
     {
         const S32 preedit_pos = mPreeditPositions.front();
-        mText.erase(preedit_pos, mPreeditPositions.back() - preedit_pos);
-        mText.insert(preedit_pos, mPreeditOverwrittenWString);
-        setCursor(preedit_pos);
+        const S32 end = mPreeditPositions.back();
+        const S32 len = end - preedit_pos;
+        const S32 size = mText.length();
+        if (preedit_pos < size
+            && end <= size
+            && preedit_pos >= 0
+            && len > 0)
+        {
+            mText.erase(preedit_pos, len);
+            mText.insert(preedit_pos, mPreeditOverwrittenWString);
+            setCursor(preedit_pos);
+        }
+        else
+        {
+            LL_WARNS() << "Index out of bounds. Start: " << preedit_pos
+                << ", end:" << end
+                << ", full string length: " << size << LL_ENDL;
+        }
 
         mPreeditWString.clear();
         mPreeditOverwrittenWString.clear();
-- 
cgit v1.2.3