# HG changeset patch
# User vimboss
# Date 1214748966 0
# Node ID 630eca9496e07d9a778fe87d087832816a01a850
# Parent  c3e225bc213a1a91a278fdcb3c5fc003ae886f02
updated for version 7.2a-010

diff --git a/src/mbyte.c b/src/mbyte.c
--- a/src/mbyte.c
+++ b/src/mbyte.c
@@ -1387,7 +1387,7 @@ utf_ptr2char(p)
 	return p[0];
 
     len = utf8len_tab[p[0]];
-    if ((p[1] & 0xc0) == 0x80)
+    if (len > 1 && (p[1] & 0xc0) == 0x80)
     {
 	if (len == 2)
 	    return ((p[0] & 0x1f) << 6) + (p[1] & 0x3f);
@@ -1753,14 +1753,27 @@ utfc_ptr2len_len(p, size)
 #endif
     while (len < size)
     {
-	if (p[len] < 0x80 || !UTF_COMPOSINGLIKE(p + prevlen, p + len))
+	int	len_next_char;
+
+	if (p[len] < 0x80)
+	    break;
+
+	/*
+	 * Next character length should not go beyond size to ensure that
+	 * UTF_COMPOSINGLIKE(...) does not read beyond size.
+	 */
+	len_next_char = utf_ptr2len_len(p + len, size - len);
+	if (len_next_char > size - len)
+	    break;
+
+	if (!UTF_COMPOSINGLIKE(p + prevlen, p + len))
 	    break;
 
 	/* Skip over composing char */
 #ifdef FEAT_ARABIC
 	prevlen = len;
 #endif
-	len += utf_ptr2len_len(p + len, size - len);
+	len += len_next_char;
     }
     return len;
 }
diff --git a/src/message.c b/src/message.c
--- a/src/message.c
+++ b/src/message.c
@@ -1391,7 +1391,7 @@ msg_outtrans_len_attr(msgstr, len, attr)
 		plain_start = str + 1;
 		msg_puts_attr(s, attr == 0 ? hl_attr(HLF_8) : attr);
 	    }
-	    retval += ptr2cells(str);
+	    retval += char2cells(*str);
 	    ++str;
 	}
     }
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -677,6 +677,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    10,
+/**/
     9,
 /**/
     8,