commit 204b93f95831454e6924acf30b16fd4bdfda0d14
author Bram Moolenaar <Bram@vim.org> Tue Aug 04 22:02:51 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Tue Aug 04 22:02:51 2015 +0200
tree 69d8e9007ae7a33fc9163d8888d5a1ead65f0a79
parent 9dd33af4baf5fd7d3a7a779d8363834b38804946

patch 7.4.811
Problem:    Invalid memory access when using "exe 'sc'".
Solution:   Avoid going over the end of the string. (Dominique Pelle)

src/ex_docmd.c

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 2512757..13ed6b0 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -3129,8 +3129,8 @@
 	++p;
     }
     else if (p[0] == 's'
-	    && ((p[1] == 'c' && p[2] != 's' && p[2] != 'r'
-						&& p[3] != 'i' && p[4] != 'p')
+	    && ((p[1] == 'c' && (p[2] == NUL || (p[2] != 's' && p[2] != 'r'
+			&& (p[3] == NUL || (p[3] != 'i' && p[4] != 'p')))))
 		|| p[1] == 'g'
 		|| (p[1] == 'i' && p[2] != 'm' && p[2] != 'l' && p[2] != 'g')
 		|| p[1] == 'I'