diff options
| -rw-r--r-- | src/nvim/api/vim.c | 2 | ||||
| -rw-r--r-- | test/functional/api/vim_spec.lua | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/src/nvim/api/vim.c b/src/nvim/api/vim.c index 6280038d1a..d027eca59a 100644 --- a/src/nvim/api/vim.c +++ b/src/nvim/api/vim.c @@ -364,7 +364,7 @@ String nvim_command_output(String command, Error *err) }; // redir usually (except :echon) prepends a newline. if (s.data[0] == '\n') { - memmove(s.data, s.data + 1, s.size); + memmove(s.data, s.data + 1, s.size - 1); s.data[s.size - 1] = '\0'; s.size = s.size - 1; } diff --git a/test/functional/api/vim_spec.lua b/test/functional/api/vim_spec.lua index 519b65081e..cd45914552 100644 --- a/test/functional/api/vim_spec.lua +++ b/test/functional/api/vim_spec.lua @@ -178,6 +178,11 @@ describe('API', function() -- Verify NO hit-enter prompt. eq({mode='n', blocking=false}, nvim("get_mode")) end) + + it('Does not cause heap buffer overflow with large output', function() + eq(eval('string(range(1000000))'), + nvim('command_output', 'echo range(1000000)')) + end) end) describe('nvim_eval', function() |