From 898ffdb8e0835ba86b2f47d2ff5e088c4c0cf845 Mon Sep 17 00:00:00 2001
From: Richard Jenkins <rwj@serenity.uk.net>
Date: Wed, 17 May 2017 14:42:44 +0100
Subject: [PATCH] Fix #5487: Crash on deleting text

---
 src/openrct2-ui/TextComposition.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/openrct2-ui/TextComposition.cpp b/src/openrct2-ui/TextComposition.cpp
index f211cd7aef..ed4cc1a8f0 100644
--- a/src/openrct2-ui/TextComposition.cpp
+++ b/src/openrct2-ui/TextComposition.cpp
@@ -287,7 +287,7 @@ void TextComposition::Delete()
     utf8 * buffer = _session.Buffer;
     utf8 * targetShiftPtr = buffer + _session.SelectionStart;
     utf8 * sourceShiftPtr = targetShiftPtr + _session.SelectionSize;
-    size_t shiftSize = _session.SelectionSize - _session.SelectionStart - _session.SelectionSize + 1;
+    size_t shiftSize = _session.Size - (_session.SelectionStart - _session.SelectionSize + 1);
     memmove(targetShiftPtr, sourceShiftPtr, shiftSize);
     _session.SelectionSize = 0;
     RecalculateLength();