patch 8.0.1346: crash when passing 50 char string to balloon_split() commit https://github.com/vim/vim/commit/a3571ebef5a2969d16e3e202ec4bca8858aca6ba Author: Bram Moolenaar <Bram@vim.org> Date: Sun Nov 26 16:53:16 2017 +0100 patch 8.0.1346: crash when passing 50 char string to balloon_split() Problem: Crash when passing 50 char string to balloon_split(). Solution: Fix off-by-one error.

--- a/src/popupmnu.c
+++ b/src/popupmnu.c
@@ -836,7 +836,7 @@ split_message(char_u *mesg, pumitem_T **
 	item->bytelen = p - item->start;
 	if (item->cells > max_cells)
 	    max_cells = item->cells;
-	long_item_count += item->cells / BALLOON_MIN_WIDTH;
+	long_item_count += (item->cells - 1) / BALLOON_MIN_WIDTH;
     }
 
     height = 2 + ga.ga_len;