From 94a69ad9e27e74aa99315c7f16d6b769859e0d96 Mon Sep 17 00:00:00 2001
From: Max Freedom Pollard
 <272618364+MaxFreedomPollard@users.noreply.github.com>
Date: Thu, 10 Sep 2026 09:13:05 -0400
Subject: [PATCH] [rtext] Fix TextSplit() reading past its buffer on text of
 1024 bytes or more (#6136)

The copy loop filled all MAX_TEXT_BUFFER_LENGTH bytes, so the last substring
could come back with no terminator, and a delimiter on the last byte made
buffers[] point one past the end of the array. Stop one byte earlier so the
zero left by the memset() at the top of the function always terminates the
last substring.
---
 src/rtext.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/rtext.c b/src/rtext.c
index aa446e400..ae802c158 100644
--- a/src/rtext.c
+++ b/src/rtext.c
@@ -2082,7 +2082,8 @@ char **TextSplit(const char *text, char delimiter, int *count)
         counter = 1;
 
         // Count how many substrings ar found on text and set pointers to every one
-        for (int i = 0; i < MAX_TEXT_BUFFER_LENGTH; i++)
+        // NOTE: Last buffer byte is reserved to terminate the last substring
+        for (int i = 0; i < MAX_TEXT_BUFFER_LENGTH - 1; i++)
         {
             buffer[i] = text[i];
             if (buffer[i] == '\0') break;