From 72870d83311a5259bdb5ab11277a415691ca91a9 Mon Sep 17 00:00:00 2001
From: Johannes Altmanninger <aclopte@gmail.com>
Date: Wed, 14 Jan 2026 17:30:12 +0100
Subject: [PATCH] forward-char: fix buffer overflow

Fixes 701c5da8234 (forward-char: respect fish_cursor_end_mode again,
2026-01-12).

Fixes #12325
---
 src/reader/reader.rs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/reader/reader.rs b/src/reader/reader.rs
index 32d82f368..157a62cd0 100644
--- a/src/reader/reader.rs
+++ b/src/reader/reader.rs
@@ -3607,8 +3607,11 @@ fn handle_readline_command(&mut self, c: ReadlineCmd) {
                         true,
                     );
                     if !is_kill {
-                        let pos = self.edit_line(elt).position();
-                        self.update_buff_pos(elt, Some(pos + 1));
+                        let el = self.edit_line(elt);
+                        let pos = el.position();
+                        if pos < el.len() {
+                            self.update_buff_pos(elt, Some(pos + 1));
+                        }
                     }
                 }
             }