From 6746eb87f6893045e5dd6951094d219df9f0ddac Mon Sep 17 00:00:00 2001 From: /dev/humancontroller Date: Tue, 4 Apr 2017 11:35:40 +0200 Subject: fix a pointer going out of bounds, in the text width calculation code the cgame QVM was calling strncpy() with a size argument of -1 --- src/ui/ui_shared.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ui/ui_shared.c b/src/ui/ui_shared.c index 5daf33b7..02a45bf5 100644 --- a/src/ui/ui_shared.c +++ b/src/ui/ui_shared.c @@ -4351,7 +4351,8 @@ const char *Item_Text_Wrap( const char *text, float scale, float width ) if( !previousCharIsSpace && isspace( *q ) ) eol = q; - textWidth += UI_Char_Width( &q, scale ); + if( q != eos ) + textWidth += UI_Char_Width( &q, scale ); } // No split has taken place, so just split mid-word -- cgit