Authors: Sander van Leeuwen <sandervl@xs4all.nl>, Dietrich Teickner <Dietrich_Teickner@t-online.de>
- Fixed incorrect undo buffer size (previous code caused heap
  corruption when using backspace many times).
- Always kill timer when left mouse button is released and in captured
  state.

controls/edit.c

diff --git a/controls/edit.c b/controls/edit.c
index 66b9874..37f9106 100644
--- a/controls/edit.c
+++ b/controls/edit.c
@@ -1747,7 +1747,7 @@
 
 	alloc_size = ROUND_TO_GROW((size + 1) * sizeof(WCHAR));
 	if ((es->undo_text = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, es->undo_text, alloc_size))) {
-		es->undo_buffer_size = alloc_size/sizeof(WCHAR);
+		es->undo_buffer_size = alloc_size/sizeof(WCHAR) - 1;
 		return TRUE;
 	}
 	else
@@ -4216,9 +4216,9 @@
  */
 static LRESULT EDIT_WM_LButtonUp(EDITSTATE *es)
 {
-	if (es->bCaptureState && GetCapture() == es->hwndSelf) {
+	if (es->bCaptureState) {
 		KillTimer(es->hwndSelf, 0);
-		ReleaseCapture();
+		if (GetCapture() == es->hwndSelf) ReleaseCapture();
 	}
 	es->bCaptureState = FALSE;
 	return 0;