Merge #2846 'out-of-bounds slicing'

1 files changed, 13 insertions, 1 deletions

diff --git a/src/nvim/api/buffer.c b/src/nvim/api/buffer.c
index c9ada8dfc0..915c5f74d7 100644
--- a/src/nvim/api/buffer.c
+++ b/src/nvim/api/buffer.c
@@ -108,7 +108,7 @@ ArrayOf(String) buffer_get_line_slice(Buffer buffer,
   Array rv = ARRAY_DICT_INIT;
   buf_T *buf = find_buffer_by_handle(buffer, err);
 
-  if (!buf) {
+  if (!buf || !inbounds(buf, start)) {
     return rv;
   }
 
@@ -179,6 +179,11 @@ void buffer_set_line_slice(Buffer buffer,
     return;
   }
 
+  if (!inbounds(buf, start)) {
+    api_set_error(err, Validation, _("Index out of bounds"));
+    return;
+  }
+
   start = normalize_index(buf, start) + (include_start ? 0 : 1);
   include_end = include_end || (end >= buf->b_ml.ml_line_count);
   end = normalize_index(buf, end) + (include_end ? 1 : 0);
@@ -550,3 +555,10 @@ static int64_t normalize_index(buf_T *buf, int64_t index)
   index = index > buf->b_ml.ml_line_count ? buf->b_ml.ml_line_count : index;
   return index;
 }
+
+// Returns true if the 0-indexed `index` is within the 1-indexed buffer bounds.
+static bool inbounds(buf_T *buf, int64_t index)
+{
+  linenr_T nlines = buf->b_ml.ml_line_count;
+  return index >= -nlines && index < nlines;
+}