vim-patch:8.0.0337: invalid memory access in :recover command

Problem:    Invalid memory access in :recover command.
Solution:   Avoid access before directory name. (Dominique Pelle,
            closes vim/vim#1488)

https://github.com/vim/vim/commit/c525e3a1c20f6b5d9809c8b84f80090a8e416c92

4 files changed, 27 insertions, 5 deletions

diff --git a/src/nvim/memline.c b/src/nvim/memline.c
index 80775c607d..f783dd84c5 100644
--- a/src/nvim/memline.c
+++ b/src/nvim/memline.c
@@ -1330,9 +1330,12 @@ recover_names (
         names[2] = (char_u *)concat_fnames((char *)dir_name, ".sw?", TRUE);
         num_names = 3;
       } else {
-        p = dir_name + STRLEN(dir_name);
-        if (after_pathsep((char *)dir_name, (char *)p) && p[-1] == p[-2]) {
-          /* Ends with '//', Use Full path for swap name */
+        int len = STRLEN(dir_name);
+        p = dir_name + len;
+        if (after_pathsep((char *)dir_name, (char *)p)
+            && len > 1
+            && p[-1] == p[-2]) {
+          // Ends with '//', Use Full path for swap name
           tail = (char_u *)make_percent_swname((char *)dir_name, (char *)fname_res);
         } else {
           tail = path_tail(fname_res);
@@ -3054,9 +3057,12 @@ char_u *makeswapname(char_u *fname, char_u *ffname, buf_T *buf, char_u *dir_name
 #ifdef HAVE_READLINK
   char_u fname_buf[MAXPATHL];
 #endif
+  int len = STRLEN(dir_name);
 
-  s = dir_name + STRLEN(dir_name);
-  if (after_pathsep((char *)dir_name, (char *)s) && s[-1] == s[-2]) { /* Ends with '//', Use Full path */
+  s = dir_name + len;
+  if (after_pathsep((char *)dir_name, (char *)s)
+      && len > 1
+      && s[-1] == s[-2]) {  // Ends with '//', Use Full path
     r = NULL;
     if ((s = (char_u *)make_percent_swname((char *)dir_name, (char *)fname)) != NULL) {
       r = (char_u *)modname((char *)s, ".swp", FALSE);
diff --git a/src/nvim/testdir/Makefile b/src/nvim/testdir/Makefile
index 1b927076d8..5e5671787e 100644
--- a/src/nvim/testdir/Makefile
+++ b/src/nvim/testdir/Makefile
@@ -85,6 +85,7 @@ NEW_TESTS ?= \
 	    test_options.res \
 	    test_profile.res \
 	    test_quickfix.res \
+	    test_recover.res \
 	    test_retab.res \
 	    test_scrollbind.res \
 	    test_search.res \
diff --git a/src/nvim/testdir/test_alot.vim b/src/nvim/testdir/test_alot.vim
index 6df5aae677..91da0d9566 100644
--- a/src/nvim/testdir/test_alot.vim
+++ b/src/nvim/testdir/test_alot.vim
@@ -25,6 +25,7 @@ source test_mapping.vim
 source test_messages.vim
 source test_partial.vim
 source test_popup.vim
+source test_recover.vim
 source test_regexp_utf8.vim
 source test_source_utf8.vim
 source test_statusline.vim
diff --git a/src/nvim/testdir/test_recover.vim b/src/nvim/testdir/test_recover.vim
new file mode 100644
index 0000000000..aa291b1294
--- /dev/null
+++ b/src/nvim/testdir/test_recover.vim
@@ -0,0 +1,14 @@
+" Test :recover
+
+func Test_recover_root_dir()
+  " This used to access invalid memory.
+  split Xtest
+  set dir=/
+  call assert_fails('recover', 'E305:')
+  close!
+
+  call assert_fails('split Xtest', 'E303:')
+  set dir&
+endfunc
+
+" TODO: move recover tests from test78.in to here.