From c3c56594790c60a0571128b1d333efb68c9ad3ef Mon Sep 17 00:00:00 2001
From: Albrecht Schlosser <albrechts.fltk@online.de>
Date: Thu, 30 Oct 2014 11:47:46 +0000
Subject: Fix out-of-bounds memory access in Fl_Text_Display (STR #2730).

This bug would only show up in wrap mode.


git-svn-id: file:///fltk/svn/fltk/branches/branch-1.3@10415 ea41ed52-d2ee-0310-a9c1-e6b18d33e121
---
 src/Fl_Text_Display.cxx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/Fl_Text_Display.cxx b/src/Fl_Text_Display.cxx
index 7bd221095..e9f0367bc 100644
--- a/src/Fl_Text_Display.cxx
+++ b/src/Fl_Text_Display.cxx
@@ -3369,9 +3369,13 @@ void Fl_Text_Display::wrapped_line_counter(Fl_Text_Buffer *buf, int startPos,
       if (b<lineStart) b = lineStart;
       if (!foundBreak) { /* no whitespace, just break at margin */
         newLineStart = max(p, buf->next_char(lineStart));
-        const char *s = buf->address(b);
         colNum++;
-        width = measure_proportional_character(s, 0, p+styleBufOffset);
+	if (b >= buf->length()) { // STR #2730
+	  width = 0;
+	} else {
+	  const char *s = buf->address(b);
+	  width = measure_proportional_character(s, 0, p+styleBufOffset);
+	}
       }
       if (p >= maxPos) {
         *retPos = maxPos;
-- 
cgit v1.2.3