Fix bug triggered by cone.

Parameters to memmove were reversed.

len is the size of the buffer. len-pos-cnt characters were copied in error
to position pos+cnt. As such this did not overflow. I.e. if len was 8
(eight chars), pos was 1 and cnt was 2, then 8-2-1=5 characters were copied
to offset 3, right at the end of the buffer. This was just plain wrong.

1 files changed, 19 insertions, 0 deletions

diff --git a/unicode/unicodetest.c b/unicode/unicodetest.c
index e9e4228..12a874f 100644
--- a/unicode/unicodetest.c
+++ b/unicode/unicodetest.c
@@ -123,11 +123,30 @@ static void test2()
 	exit(1);
 }
 
+void testunicodebuf()
+{
+	struct unicode_buf buf;
+
+	unicode_buf_init(&buf, -1);
+	unicode_buf_append_char(&buf, "01234567", 8);
+	unicode_buf_remove(&buf, 1, 6);
+
+	if (unicode_buf_len(&buf) != 2 ||
+	    unicode_buf_ptr(&buf)[0] != '0' ||
+	    unicode_buf_ptr(&buf)[1] != '7')
+	{
+		fprintf(stderr, "unicode_buf_remove failed\n");
+		exit(1);
+	}
+	unicode_buf_deinit(&buf);
+}
+
 int main(int argc, char **argv)
 {
 	const char *chset=unicode_x_imap_modutf7;
 	int argn=1;
 
+	testunicodebuf();
 	if (argn < argc && strcmp(argv[argn], "--smap") == 0)
 	{
 		chset=unicode_x_imap_modutf7 " ./~:";