* (bug 3454) Fix crash in autocompletion due to incorrect strncpy buffer size

git-svn-id: svn://svn.icculus.org/quake3/trunk@1226 edf5b092-35ff-0310-97b2-ce42778d08ea

1 files changed, 6 insertions, 3 deletions

diff --git a/code/qcommon/common.c b/code/qcommon/common.c
index fd99449..ba155bd 100644
--- a/code/qcommon/common.c
+++ b/code/qcommon/common.c
@@ -3292,6 +3292,8 @@ static void Field_CompleteCommand( char *cmd,
 	}
 	else
 	{
+		int completionOffset;
+
 		if( completionString[0] == '\\' || completionString[0] == '/' )
 			completionString++;
 
@@ -3310,9 +3312,10 @@ static void Field_CompleteCommand( char *cmd,
 		if( matchCount == 0 )
 			return; // no matches
 
-		Q_strncpyz( &completionField->buffer[ strlen( completionField->buffer ) -
-			strlen( completionString ) ], shortestMatch,
-			sizeof( completionField->buffer ) );
+		completionOffset = strlen( completionField->buffer ) - strlen( completionString );
+
+		Q_strncpyz( &completionField->buffer[ completionOffset ], shortestMatch,
+			sizeof( completionField->buffer ) - completionOffset );
 
 		completionField->cursor = strlen( completionField->buffer );