diff --git a/7.3.648 b/7.3.648
new file mode 100644
index 0000000..f51d99d
--- /dev/null
+++ b/7.3.648
@@ -0,0 +1,131 @@
+To: vim_dev@googlegroups.com
+Subject: Patch 7.3.648
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.3.648
+Problem:    Crash when using a very long file name. (ZyX)
+Solution:   Properly check length of buffer space.
+Files:	    src/buffer.c
+
+
+*** ../vim-7.3.647/src/buffer.c	2012-07-16 17:31:48.000000000 +0200
+--- src/buffer.c	2012-09-05 13:17:38.000000000 +0200
+***************
+*** 3234,3245 ****
+  	{
+  	    /* format: "fname + (path) (1 of 2) - VIM" */
+  
+  	    if (curbuf->b_fname == NULL)
+! 		vim_strncpy(buf, (char_u *)_("[No Name]"), IOSIZE - 100);
+  	    else
+  	    {
+  		p = transstr(gettail(curbuf->b_fname));
+! 		vim_strncpy(buf, p, IOSIZE - 100);
+  		vim_free(p);
+  	    }
+  
+--- 3234,3248 ----
+  	{
+  	    /* format: "fname + (path) (1 of 2) - VIM" */
+  
++ #define SPACE_FOR_FNAME (IOSIZE - 100)
++ #define SPACE_FOR_DIR   (IOSIZE - 20)
++ #define SPACE_FOR_ARGNR (IOSIZE - 10)  /* at least room for " - VIM" */
+  	    if (curbuf->b_fname == NULL)
+! 		vim_strncpy(buf, (char_u *)_("[No Name]"), SPACE_FOR_FNAME);
+  	    else
+  	    {
+  		p = transstr(gettail(curbuf->b_fname));
+! 		vim_strncpy(buf, p, SPACE_FOR_FNAME);
+  		vim_free(p);
+  	    }
+  
+***************
+*** 3263,3269 ****
+  		buf[off++] = ' ';
+  		buf[off++] = '(';
+  		home_replace(curbuf, curbuf->b_ffname,
+! 					       buf + off, IOSIZE - off, TRUE);
+  #ifdef BACKSLASH_IN_FILENAME
+  		/* avoid "c:/name" to be reduced to "c" */
+  		if (isalpha(buf[off]) && buf[off + 1] == ':')
+--- 3266,3272 ----
+  		buf[off++] = ' ';
+  		buf[off++] = '(';
+  		home_replace(curbuf, curbuf->b_ffname,
+! 					buf + off, SPACE_FOR_DIR - off, TRUE);
+  #ifdef BACKSLASH_IN_FILENAME
+  		/* avoid "c:/name" to be reduced to "c" */
+  		if (isalpha(buf[off]) && buf[off + 1] == ':')
+***************
+*** 3274,3291 ****
+  		if (p == buf + off)
+  		    /* must be a help buffer */
+  		    vim_strncpy(buf + off, (char_u *)_("help"),
+! 						  (size_t)(IOSIZE - off - 1));
+  		else
+  		    *p = NUL;
+  
+! 		/* translate unprintable chars */
+! 		p = transstr(buf + off);
+! 		vim_strncpy(buf + off, p, (size_t)(IOSIZE - off - 1));
+! 		vim_free(p);
+  		STRCAT(buf, ")");
+  	    }
+  
+! 	    append_arg_number(curwin, buf, IOSIZE, FALSE);
+  
+  #if defined(FEAT_CLIENTSERVER)
+  	    if (serverName != NULL)
+--- 3277,3304 ----
+  		if (p == buf + off)
+  		    /* must be a help buffer */
+  		    vim_strncpy(buf + off, (char_u *)_("help"),
+! 					   (size_t)(SPACE_FOR_DIR - off - 1));
+  		else
+  		    *p = NUL;
+  
+! 		/* Translate unprintable chars and concatenate.  Keep some
+! 		 * room for the server name.  When there is no room (very long
+! 		 * file name) use (...). */
+! 		if (off < SPACE_FOR_DIR)
+! 		{
+! 		    p = transstr(buf + off);
+! 		    vim_strncpy(buf + off, p, (size_t)(SPACE_FOR_DIR - off));
+! 		    vim_free(p);
+! 		}
+! 		else
+! 		{
+! 		    vim_strncpy(buf + off, (char_u *)"...",
+! 					     (size_t)(SPACE_FOR_ARGNR - off));
+! 		}
+  		STRCAT(buf, ")");
+  	    }
+  
+! 	    append_arg_number(curwin, buf, SPACE_FOR_ARGNR, FALSE);
+  
+  #if defined(FEAT_CLIENTSERVER)
+  	    if (serverName != NULL)
+*** ../vim-7.3.647/src/version.c	2012-09-05 12:16:40.000000000 +0200
+--- src/version.c	2012-09-05 13:29:53.000000000 +0200
+***************
+*** 721,722 ****
+--- 721,724 ----
+  {   /* Add new patch number below this line */
++ /**/
++     648,
+  /**/
+
+-- 
+Q: How does a UNIX Guru do Sex ?
+A: unzip;strip;touch;finger;mount;fsck;more;yes;umount;sleep
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\  an exciting new programming language -- http://www.Zimbu.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///