From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 1 Jul 2022 18:58:30 +0000 (+0100)
Subject: patch 9.0.0020: with some completion reading past end of string
X-Git-Tag: v9.0.0020
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f12129f1714f7d2301935bb21d896609bdac221c;p=vim

patch 9.0.0020: with some completion reading past end of string

Problem:    With some completion reading past end of string.
Solution:   Check the length of the string.
---

diff --git a/src/insexpand.c b/src/insexpand.c
index 4a5feac9d..734550ffd 100644
--- a/src/insexpand.c
+++ b/src/insexpand.c
@@ -2209,11 +2209,21 @@ ins_compl_stop(int c, int prev_mode, int retval)
     // but only do this, if the Popup is still visible
     if (c == Ctrl_E)
     {
+	char_u *p = NULL;
+
 	ins_compl_delete();
 	if (compl_leader != NULL)
-	    ins_bytes(compl_leader + get_compl_len());
+	    p = compl_leader;
 	else if (compl_first_match != NULL)
-	    ins_bytes(compl_orig_text + get_compl_len());
+	    p = compl_orig_text;
+	if (p != NULL)
+	{
+	    int	    compl_len = get_compl_len();
+	    int	    len = (int)STRLEN(p);
+
+	    if (len > compl_len)
+		ins_bytes_len(p + compl_len, len - compl_len);
+	}
 	retval = TRUE;
     }
 
diff --git a/src/testdir/test_ins_complete.vim b/src/testdir/test_ins_complete.vim
index 365c646a1..20c2b4f48 100644
--- a/src/testdir/test_ins_complete.vim
+++ b/src/testdir/test_ins_complete.vim
@@ -2184,4 +2184,12 @@ func Test_complete_smartindent()
   delfunction! FooBarComplete
 endfunc
 
+func Test_complete_overrun()
+  " this was going past the end of the copied text
+  new
+  sil norm si”0s0
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 42e9135e1..26cb768a8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    20,
 /**/
     19,
 /**/