From d4fd139c2ab950ca3b6916f68911726bef57fbe9 Mon Sep 17 00:00:00 2001
From: James McCoy <jamessan@jamessan.com>
Date: Thu, 6 May 2021 00:01:43 -0400
Subject: coverity/331366: fname_trans_sid: Avoid buffer overrun

Since we're printf()ing into an offset of fname_buf, we need to reduce
the max length by the same amount.
---
 src/nvim/eval/userfunc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/nvim/eval/userfunc.c b/src/nvim/eval/userfunc.c
index 00260bc3f7..dc7027980e 100644
--- a/src/nvim/eval/userfunc.c
+++ b/src/nvim/eval/userfunc.c
@@ -537,7 +537,7 @@ static char_u *fname_trans_sid(const char_u *const name,
       if (current_sctx.sc_sid <= 0) {
         *error = ERROR_SCRIPT;
       } else {
-        snprintf((char *)fname_buf + 3, FLEN_FIXED + 1, "%" PRId64 "_",
+        snprintf((char *)fname_buf + i, FLEN_FIXED + 1 - i, "%" PRId64 "_",
                  (int64_t)current_sctx.sc_sid);
         i = (int)STRLEN(fname_buf);
       }
-- 
cgit