In case KEY_BACKSPACE / KEY_DC to delete a char, it memmove only (len-cursor_position+1) bytes; the default case is to insert a char, it should also memmove exactly (len-cursor_position+1) bytes; the original use of (len+1) is wrong and may access following memory that doesn't belong to result, may cause SegFault in theory; case KEY_BACKSPACE: if (cursor_position > 0) { memmove(&result[cursor_position-1], &result[cursor_position], len-cursor_position+1); cursor_position--; } break; case KEY_DC: if (cursor_position >= 0 && cursor_position < len) { memmove(&result[cursor_position], &result[cursor_position+1], len-cursor_position+1); } break; default: if ((isgraph(res) || isspace(res)) && len-2 < result_len) { /* insert the char at the proper position */ memmove(&result[cursor_position+1], &result[cursor_position], len-cursor_position+1); result[cursor_position] = res; cursor_position++; }
Unified · Split
| @@ -457,7 +457,7 @@ int dialog_inputbox(WINDOW *main_window, · 456 unmodified lines | |||
| 457 | /* insert the char at the proper position */ | 457 | /* insert the char at the proper position */ |
| 458 | memmove(&result[cursor_position+1], | 458 | memmove(&result[cursor_position+1], |
| 459 | &result[cursor_position], | 459 | &result[cursor_position], |
| 460 | len+1); | 460 | len-cursor_position+1); |
| 461 | result[cursor_position] = res; | 461 | result[cursor_position] = res; |
| 462 | cursor_position++; | 462 | cursor_position++; |
| 463 | } else { | 463 | } else { |