2 files changed, 20 insertions, 8 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 92fd8a8de3..b81384266c 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -5879,22 +5879,27 @@ int read_blob(FILE *const fd, typval_T *rettv, off_T offset, off_T size_arg)
 
   int whence;
   off_T size = size_arg;
+  const off_T file_size = (off_T)os_fileinfo_size(&file_info);
   if (offset >= 0) {
-    if (size == -1) {
+    // The size defaults to the whole file.  If a size is given it is
+    // limited to not go past the end of the file.
+    if (size == -1 || (size > file_size - offset && !S_ISCHR(file_info.stat.st_mode))) {
       // size may become negative, checked below
       size = (off_T)os_fileinfo_size(&file_info) - offset;
     }
     whence = SEEK_SET;
   } else {
-    if (size == -1) {
+    // limit the offset to not go before the start of the file
+    if (-offset > file_size && !S_ISCHR(file_info.stat.st_mode)) {
+      offset = -file_size;
+    }
+    // Size defaults to reading until the end of the file.
+    if (size == -1 || size > -offset) {
       size = -offset;
     }
     whence = SEEK_END;
   }
-  // Trying to read bytes that aren't there results in an empty blob, not an
-  // error.
-  if (size < 0 || (!S_ISCHR(file_info.stat.st_mode)
-                   && size > (off_T)os_fileinfo_size(&file_info))) {
+  if (size <= 0) {
     return OK;
   }
   if (offset != 0 && vim_fseek(fd, offset, whence) != 0) {
diff --git a/src/nvim/testdir/test_blob.vim b/src/nvim/testdir/test_blob.vim
index 5fc232119c..b01d9309fa 100644
--- a/src/nvim/testdir/test_blob.vim
+++ b/src/nvim/testdir/test_blob.vim
@@ -450,10 +450,17 @@ func Test_blob_read_write()
       VAR br6 = readblob('Xblob', -3, 2)
       call assert_equal(b[-3 : -2], br6)
 
+      #" reading past end of file, empty result
       VAR br1e = readblob('Xblob', 10000)
       call assert_equal(0z, br1e)
-      VAR br2e = readblob('Xblob', -10000)
-      call assert_equal(0z, br2e)
+
+      #" reading too much, result is truncated
+      VAR blong = readblob('Xblob', -1000)
+      call assert_equal(b, blong)
+      LET blong = readblob('Xblob', -10, 8)
+      call assert_equal(b, blong)
+      LET blong = readblob('Xblob', 0, 10)
+      call assert_equal(b, blong)
 
       call delete('Xblob')
   END