fix(api): fix nvim_cmd crash with filename expansion (#20397)

2 files changed, 6 insertions, 7 deletions

diff --git a/src/nvim/api/command.c b/src/nvim/api/command.c
index 699c62c15c..ab166c6b38 100644
--- a/src/nvim/api/command.c
+++ b/src/nvim/api/command.c
@@ -830,13 +830,12 @@ static void build_cmdline_str(char **cmdlinep, exarg_T *eap, CmdParseInfo *cmdin
   // Replace, :make and :grep with 'makeprg' and 'grepprg'.
   char *p = replace_makeprg(eap, eap->arg, cmdlinep);
   if (p != eap->arg) {
-    // If replace_makeprg modified the cmdline string, correct the argument pointers.
+    // If replace_makeprg() modified the cmdline string, correct the eap->arg pointer.
     eap->arg = p;
-    // We can only know the position of the first argument because the argument list can be used
-    // multiple times in makeprg / grepprg.
-    if (argc >= 1) {
-      eap->args[0] = p;
-    }
+    // This cannot be a user command, so eap->args will not be used.
+    XFREE_CLEAR(eap->args);
+    XFREE_CLEAR(eap->arglens);
+    eap->argc = 0;
   }
 }
 
diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index 96f98b92ca..386f708f79 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -3887,7 +3887,7 @@ static char *repl_cmdline(exarg_T *eap, char *src, size_t srclen, char *repl, ch
     } else {
       // Otherwise, argument gets shifted alongside the replaced text.
       // The amount of the shift is equal to the difference of the old and new string length.
-      eap->args[j] = new_cmdline + (eap->args[j] - *cmdlinep) + (len - srclen);
+      eap->args[j] = new_cmdline + ((eap->args[j] - *cmdlinep) + (ptrdiff_t)(len - srclen));
     }
   }