Found with coverity.
Where is this in Coverity? I can't find it.
Unfortunately, as an observer for the Scintilla coverity project I can't see the defects themselves. I saw this when I scanned Notepad2-mod which includes the latest scintilla version.
Committed as [c77981].
Changed account to Contributor/Viewer which should allow you to view everything in Coverity for Scintilla.