commit af043e12d9e5869c597de40b9a2517ae97ac72e7
author Bram Moolenaar <Bram@vim.org> Sat Jul 02 12:08:16 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Sat Jul 02 12:08:16 2022 +0100
tree 3d141f1d6710bdcbb634114f54e870dace34fef2
parent f2ce76a8c0290af35e434e38cfe889ed0fec4c6a

patch 9.0.0024: may access part of typeahead buf that isn't filled

Problem:    May access part of typeahead buf that isn't filled.
Solution:   Check length of typeahead.

src/getchar.c

diff --git a/src/getchar.c b/src/getchar.c
index 210a67a..12fd1c9 100644
--- a/src/getchar.c
+++ b/src/getchar.c
@@ -2437,7 +2437,8 @@
     int		is_plug_map = FALSE;
 
     // If typehead starts with <Plug> then remap, even for a "noremap" mapping.
-    if (typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
+    if (typebuf.tb_len >= 3
+	    && typebuf.tb_buf[typebuf.tb_off] == K_SPECIAL
 	    && typebuf.tb_buf[typebuf.tb_off + 1] == KS_EXTRA
 	    && typebuf.tb_buf[typebuf.tb_off + 2] == KE_PLUG)
 	is_plug_map = TRUE;