neovim
diff --git a/‎src/nvim/api/vim.c
Copy file name to clipboardExpand all lines: src/nvim/api/vim.c
+1-1Lines changed: 1 addition & 1 deletion b/‎src/nvim/api/vim.c
Copy file name to clipboardExpand all lines: src/nvim/api/vim.c
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎test/functional/api/vim_spec.lua
Copy file name to clipboardExpand all lines: test/functional/api/vim_spec.lua
+5Lines changed: 5 additions & 0 deletions b/‎test/functional/api/vim_spec.lua
Copy file name to clipboardExpand all lines: test/functional/api/vim_spec.lua
+5Lines changed: 5 additions & 0 deletions
@@ -364,7 +364,7 @@ String nvim_command_output(String command, Error *err)
     };
     // redir usually (except :echon) prepends a newline.
     if (s.data[0] == '\n') {
-      memmove(s.data, s.data + 1, s.size);
+      memmove(s.data, s.data + 1, s.size - 1);
       s.data[s.size - 1] = '\0';
       s.size = s.size - 1;
     }
 
@@ -178,6 +178,11 @@ describe('API', function()
       -- Verify NO hit-enter prompt.
       eq({mode='n', blocking=false}, nvim("get_mode"))
     end)
+
+    it('Does not cause heap buffer overflow with large output', function()
+      eq(eval('string(range(1000000))'),
+         nvim('command_output', 'echo range(1000000)'))
+    end)
   end)
 
   describe('nvim_eval', function()