I was looking through scripting/lua_utils.cpp and saw this in gen_inputbox
Unless I'm misinterpreting the "&" comment, that length check seems like it should come before the FindAndReplace.
// if we leave in & it will make the next letter underlined
string sInputMsg = FindAndReplace (inputmsg, "&", "&&");
if (sInputMsg.length () > 1000)
luaL_error (L, "inputbox message too long (max 1000 characters)");
Unless I'm misinterpreting the "&" comment, that length check seems like it should come before the FindAndReplace.