Fix bug triggered by cone.

Parameters to memmove were reversed.

len is the size of the buffer. len-pos-cnt characters were copied in error
to position pos+cnt. As such this did not overflow. I.e. if len was 8
(eight chars), pos was 1 and cnt was 2, then 8-2-1=5 characters were copied
to offset 3, right at the end of the buffer. This was just plain wrong.

1 files changed, 2 insertions, 1 deletions

diff --git a/unicode/unicodebuf.c b/unicode/unicodebuf.c
index eb64543..59b7522 100644
--- a/unicode/unicodebuf.c
+++ b/unicode/unicodebuf.c
@@ -89,7 +89,8 @@ void unicode_buf_remove(struct unicode_buf *p,
 		cnt=p->len-pos;
 
 	if (cnt)
-		memmove(p->ptr+pos+cnt, p->ptr+pos, p->len-pos-cnt);
+		memmove(p->ptr+pos, p->ptr+pos+cnt,
+			(p->len-pos-cnt) * sizeof(char32_t));
 	p->len -= cnt;
 }