1 files changed, 15 insertions, 8 deletions
diff --git a/src/nvim/ops.c b/src/nvim/ops.c
index 1e4d392754..c13b6f736a 100644
--- a/src/nvim/ops.c
+++ b/src/nvim/ops.c
@@ -3847,6 +3847,7 @@ fex_format (
   int use_sandbox = was_set_insecurely((char_u *)"formatexpr",
       OPT_LOCAL);
   int r;
+  char_u *fex;
 
   /*
    * Set v:lnum to the first line number and v:count to the number of lines.
@@ -3856,16 +3857,22 @@ fex_format (
   set_vim_var_nr(VV_COUNT, (varnumber_T)count);
   set_vim_var_char(c);
 
-  /*
-   * Evaluate the function.
-   */
-  if (use_sandbox)
-    ++sandbox;
-  r = eval_to_number(curbuf->b_p_fex);
-  if (use_sandbox)
-    --sandbox;
+  // Make a copy, the option could be changed while calling it.
+  fex = vim_strsave(curbuf->b_p_fex);
+  if (fex == NULL) {
+    return 0;
+  }
+  // Evaluate the function.
+  if (use_sandbox) {
+    sandbox++;
+  }
+  r = (int)eval_to_number(fex);
+  if (use_sandbox) {
+    sandbox--;
+  }
 
   set_vim_var_string(VV_CHAR, NULL, -1);
+  xfree(fex);
 
   return r;
 }