From e76a4eb7c51ab662d5f463737361cfdb1e82bf67 Mon Sep 17 00:00:00 2001 From: Gilbert Gonzales Date: Thu, 28 Mar 2013 17:31:45 -0700 Subject: CHUI-905 (Viewer crashes while using Insert keyboard key in chat): Problem was because when insert was used at the end of a string of text, this would attempt to delete something past the bounds of the string...as a side effect the size of the segment was increasing even though the string length never changed. The segment size would be greater than the string size and would eventually cause an invalid read outside the bounds of the string. --- indra/llui/lltexteditor.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'indra/llui/lltexteditor.cpp') diff --git a/indra/llui/lltexteditor.cpp b/indra/llui/lltexteditor.cpp index d5e08fa29b..b8bdea48b5 100644 --- a/indra/llui/lltexteditor.cpp +++ b/indra/llui/lltexteditor.cpp @@ -956,12 +956,18 @@ S32 LLTextEditor::insert(S32 pos, const LLWString &wstr, bool group_with_next_op S32 LLTextEditor::remove(S32 pos, S32 length, bool group_with_next_op) { S32 end_pos = getEditableIndex(pos + length, true); + BOOL removedChar = FALSE; segment_vec_t segments_to_remove; // store text segments getSegmentsInRange(segments_to_remove, pos, pos + length, false); + + if(pos <= end_pos) + { + removedChar = execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) ); + } - return execute( new TextCmdRemove( pos, group_with_next_op, end_pos - pos, segments_to_remove ) ); + return removedChar; } S32 LLTextEditor::overwriteChar(S32 pos, llwchar wc) -- cgit v1.2.3