diff --git a/src/nvim/msgpack_rpc/unpacker.c b/src/nvim/msgpack_rpc/unpacker.c
index fcad91d236..8d1e9c4c28 100644
--- a/src/nvim/msgpack_rpc/unpacker.c
+++ b/src/nvim/msgpack_rpc/unpacker.c
@@ -542,7 +542,7 @@ String unpack_string(const char **data, size_t *size)
   if (result || (tok.type != MPACK_TOKEN_STR && tok.type != MPACK_TOKEN_BIN)) {
     return (String)STRING_INIT;
   }
-  if (*size < tok.length) {
+  if (size2 < tok.length) {
     // result = MPACK_EOF;
     return (String)STRING_INIT;
   }
diff --git a/test/functional/shada/errors_spec.lua b/test/functional/shada/errors_spec.lua
index 1ab68b2bf2..edfc6f088c 100644
--- a/test/functional/shada/errors_spec.lua
+++ b/test/functional/shada/errors_spec.lua
@@ -404,6 +404,15 @@ describe('ShaDa error handling', function()
     )
   end)
 
+  it('fails on history item with truncated string', function()
+    -- The string header declares five bytes, but only four follow it.
+    wshada('\004\000\007\146\000\165AAAA')
+    eq(
+      'Vim(rshada):E575: Error while reading ShaDa file: history entry at position 0 has wrong history string type',
+      t.pcall_err(nvim_command, sdrcmd())
+    )
+  end)
+
   it('fails on history item with second item with zero byte', function()
     wshada('\004\000\007\146\000\196\003ab\000')
     eq(