(svn r4314) -Fix: a buffer overflow of the chat box introduced in r1263. Don't tell the Textbuf an arbitrary number as size of the string buffer, but the real lengthof() it

3 files changed, 4 insertions, 4 deletions

diff --git a/gui.h b/gui.h
index f5c024a1d..b291effc7 100644
--- a/gui.h
+++ b/gui.h
@@ -124,7 +124,7 @@ extern const byte _fios_colors[];
 
 /* network gui */
 void ShowNetworkGameWindow(void);
-void ShowChatWindow(int maxlen);
+void ShowChatWindow(void);
 
 /* bridge_gui.c */
 void ShowBuildBridgeWindow(uint start, uint end, byte type);
diff --git a/main_gui.c b/main_gui.c
index 87750ad25..d22931528 100644
--- a/main_gui.c
+++ b/main_gui.c
@@ -332,7 +332,7 @@ void ShowNetworkChatQueryWindow(byte desttype, byte dest)
 {
 	_rename_id = desttype + (dest << 8);
 	_rename_what = 2;
-	ShowChatWindow(150);
+	ShowChatWindow();
 }
 
 void ShowNetworkGiveMoneyWindow(byte player)
diff --git a/network_gui.c b/network_gui.c
index f537a7ebb..adec0c004 100644
--- a/network_gui.c
+++ b/network_gui.c
@@ -1545,7 +1545,7 @@ static const WindowDesc _chat_window_desc = {
 	ChatWindowWndProc
 };
 
-void ShowChatWindow(int maxlen)
+void ShowChatWindow(void)
 {
 	Window *w;
 
@@ -1560,7 +1560,7 @@ void ShowChatWindow(int maxlen)
 	WP(w,querystr_d).wnd_class = WC_MAIN_TOOLBAR;
 	WP(w,querystr_d).wnd_num = 0;
 	WP(w,querystr_d).text.caret = false;
-	WP(w,querystr_d).text.maxlength = maxlen;
+	WP(w,querystr_d).text.maxlength = lengthof(_edit_str_buf);
 	WP(w,querystr_d).text.maxwidth = w->widget[1].right - w->widget[1].left - 2; // widget[1] is the "text box"
 	WP(w,querystr_d).text.buf = _edit_str_buf;
 	UpdateTextBufferSize(&WP(w, querystr_d).text);