fix(terminal): avoid reading over the end of cell.chars (#19580)

2 files changed, 11 insertions, 1 deletions

diff --git a/src/nvim/terminal.c b/src/nvim/terminal.c
index 73af00b5d1..fc02d9d53a 100644
--- a/src/nvim/terminal.c
+++ b/src/nvim/terminal.c
@@ -1384,7 +1384,7 @@ static void fetch_row(Terminal *term, int row, int end_col)
     fetch_cell(term, row, col, &cell);
     if (cell.chars[0]) {
       int cell_len = 0;
-      for (int i = 0; cell.chars[i]; i++) {
+      for (int i = 0; i < VTERM_MAX_CHARS_PER_CELL && cell.chars[i]; i++) {
         cell_len += utf_char2bytes((int)cell.chars[i], ptr + cell_len);
       }
       ptr += cell_len;
diff --git a/test/functional/terminal/buffer_spec.lua b/test/functional/terminal/buffer_spec.lua
index 1cef771f0d..ec3066c20d 100644
--- a/test/functional/terminal/buffer_spec.lua
+++ b/test/functional/terminal/buffer_spec.lua
@@ -5,6 +5,8 @@ local feed, clear, nvim = helpers.feed, helpers.clear, helpers.nvim
 local poke_eventloop = helpers.poke_eventloop
 local eval, feed_command, source = helpers.eval, helpers.feed_command, helpers.source
 local eq, neq = helpers.eq, helpers.neq
+local meths = helpers.meths
+local retry = helpers.retry
 local write_file = helpers.write_file
 local command = helpers.command
 local exc_exec = helpers.exc_exec
@@ -364,3 +366,11 @@ describe('on_lines does not emit out-of-bounds line indexes when', function()
     eq('', exec_lua([[return _G.cb_error]]))
   end)
 end)
+
+it('terminal truncates number of composing characters to 5', function()
+  clear()
+  local chan = meths.open_term(0, {})
+  local composing = ('a̳'):sub(2)
+  meths.chan_send(chan, 'a' .. composing:rep(8))
+  retry(nil, nil, function() eq('a' .. composing:rep(5), meths.get_current_line()) end)
+end)