Alex Busenius : user32: Fix segfault when combobox contains a longer text than buffer_limit.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: ca625836defc851dac00c19c3a561e0c0a979c6a
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=ca625836defc851dac00c19c3a561e0c0a979c6a

Author: Alex Busenius <the_unknown at gmx.net>
Date:   Sun Oct 21 13:28:17 2007 +0200

user32: Fix segfault when combobox contains a longer text than buffer_limit.

---

 dlls/user32/edit.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/dlls/user32/edit.c b/dlls/user32/edit.c
index 6ea843e..ee7e7a4 100644
--- a/dlls/user32/edit.c
+++ b/dlls/user32/edit.c
@@ -3203,7 +3203,11 @@ static void EDIT_EM_ReplaceSel(EDITSTATE *es, BOOL can_undo, LPCWSTR lpsz_replac
 	 * such that buffer limit is honored. */
 	if ((honor_limit) && (size > es->buffer_limit)) {
 		EDIT_NOTIFY_PARENT(es, EN_MAXTEXT);
-		strl = es->buffer_limit - (tl - (e-s));
+		/* Buffer limit can be smaller than the actual length of text in combobox */
+		if (es->buffer_limit < (tl - (e-s)))
+			strl = 0;
+		else
+			strl = es->buffer_limit - (tl - (e-s));
 	}
 
 	if (!EDIT_MakeFit(es, tl - (e - s) + strl))