From 4d9445749ce91868f0b7457e8604bcce6e84783e Mon Sep 17 00:00:00 2001
From: Jonas Maebe <jonas@freepascal.org>
Date: Sat, 9 Feb 2008 11:47:14 +0000
Subject: [PATCH]   * fixed buffer overflow in delete() for widestrings (patch
 by     Martin Schreiber, #10800)

git-svn-id: trunk@10255 -
---
 .gitattributes          |  1 +
 rtl/inc/wustrings.inc   |  2 +-
 tests/webtbs/tw10800.pp | 13 +++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 tests/webtbs/tw10800.pp

diff --git a/.gitattributes b/.gitattributes
index 5827f3774f..4fa03b3962 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -7966,6 +7966,7 @@ tests/webtbs/tw10753.pp svneol=native#text/plain
 tests/webtbs/tw10753a.pp svneol=native#text/plain
 tests/webtbs/tw10757.pp svneol=native#text/plain
 tests/webtbs/tw10790.pp svneol=native#text/plain
+tests/webtbs/tw10800.pp svneol=native#text/plain
 tests/webtbs/tw1081.pp svneol=native#text/plain
 tests/webtbs/tw1090.pp svneol=native#text/plain
 tests/webtbs/tw1092.pp svneol=native#text/plain
diff --git a/rtl/inc/wustrings.inc b/rtl/inc/wustrings.inc
index c87036c0ce..d31f36f72e 100644
--- a/rtl/inc/wustrings.inc
+++ b/rtl/inc/wustrings.inc
@@ -1362,7 +1362,7 @@ begin
      if Index+Size<=LS then
       begin
         Dec(Index);
-        Move(PWideChar(S)[Index+Size],PWideChar(S)[Index],(LS-Index+1)*sizeof(WideChar));
+        Move(PWideChar(S)[Index+Size],PWideChar(S)[Index],(LS-Index-Size+1)*sizeof(WideChar));
       end;
      Setlength(s,LS-Size);
    end;
diff --git a/tests/webtbs/tw10800.pp b/tests/webtbs/tw10800.pp
new file mode 100644
index 0000000000..25402c0f40
--- /dev/null
+++ b/tests/webtbs/tw10800.pp
@@ -0,0 +1,13 @@
+program widestringdelete;
+{$ifdef FPC}{$mode objfpc}{$h+}{$INTERFACES CORBA}{$endif}
+{$ifdef mswindows}{$apptype console}{$endif}
+uses
+ {$ifdef FPC}{$ifdef unix}cthreads,{$endif}{$endif}
+ sysutils;
+var
+ wstr1: widestring;
+begin
+ setlength(wstr1,10240);
+ delete(wstr1,1,10230);
+end.
+