[User32]

- Patch by Roman Pi?l : Fix buffer overflow in EDIT_EM_ReplaceSel().

svn path=/trunk/; revision=73470

diff --git a/reactos/win32ss/user/user32/controls/edit.c b/reactos/win32ss/user/user32/controls/edit.c
index 47a070b..9920586 100644 (file)
--- a/reactos/win32ss/user/user32/controls/edit.c
+++ b/reactos/win32ss/user/user32/controls/edit.c
@@ -2644,7 +2644,7 @@ static void EDIT_EM_ReplaceSel(EDITSTATE *es, BOOL can_undo, LPCWSTR lpsz_replac
                if (es->buffer_limit < (tl - (e-s)))
                        strl = 0;
                else
-                       strl = es->buffer_limit - (tl - (e-s));
+                       strl = min(strl, es->buffer_limit - (tl - (e-s)));
        }
 
        if (!EDIT_MakeFit(es, tl - (e - s) + strl))