1 files changed, 29 insertions, 20 deletions

diff --git a/src/nvim/path.c b/src/nvim/path.c
index 8b9a49dfc0..5cd93ab811 100644
--- a/src/nvim/path.c
+++ b/src/nvim/path.c
@@ -556,8 +556,9 @@ static size_t do_path_expand(garray_T *gap, const char_u *path,
       return 0;
   }
 
-  /* make room for file name */
-  buf = xmalloc(STRLEN(path) + BASENAMELEN + 5);
+  // Make room for file name.  When doing encoding conversion the actual
+  // length may be quite a bit longer, thus use the maximum possible length.
+  buf = xmalloc(MAXPATHL);
 
   /*
    * Find the first part in the path name that contains a wildcard.
@@ -1158,12 +1159,17 @@ int gen_expand_wildcards(int num_pat, char_u **pat, int *num_file,
     add_pat = -1;
     p = pat[i];
 
-    if (vim_backtick(p))
+    if (vim_backtick(p)) {
       add_pat = expand_backtick(&ga, p, flags);
-    else {
-      /*
-       * First expand environment variables, "~/" and "~user/".
-       */
+      if (add_pat == -1) {
+        recursive = false;
+        FreeWild(ga.ga_len, (char_u **)ga.ga_data);
+        *num_file = 0;
+        *file = NULL;
+        return FAIL;
+      }
+    } else {
+      // First expand environment variables, "~/" and "~user/".
       if (has_env_var(p) || *p == '~') {
         p = expand_env_save_opt(p, true);
         if (p == NULL)
@@ -1246,13 +1252,10 @@ static int vim_backtick(char_u *p)
   return *p == '`' && *(p + 1) != NUL && *(p + STRLEN(p) - 1) == '`';
 }
 
-/*
- * Expand an item in `backticks` by executing it as a command.
- * Currently only works when pat[] starts and ends with a `.
- * Returns number of file names found.
- */
-static int 
-expand_backtick (
+// Expand an item in `backticks` by executing it as a command.
+// Currently only works when pat[] starts and ends with a `.
+// Returns number of file names found, -1 if an error is encountered.
+static int expand_backtick(
     garray_T *gap,
     char_u *pat,
     int flags              /* EW_* flags */
@@ -1273,8 +1276,9 @@ expand_backtick (
     buffer = get_cmd_output(cmd, NULL,
         (flags & EW_SILENT) ? kShellOptSilent : 0, NULL);
   xfree(cmd);
-  if (buffer == NULL)
-    return 0;
+  if (buffer == NULL) {
+    return -1;
+  }
 
   cmd = buffer;
   while (*cmd != NUL) {
@@ -1775,19 +1779,20 @@ bool same_directory(char_u *f1, char_u *f2)
  */
 int pathcmp(const char *p, const char *q, int maxlen)
 {
-  int i;
+  int i, j;
   int c1, c2;
   const char  *s = NULL;
 
-  for (i = 0; maxlen < 0 || i < maxlen; i += MB_PTR2LEN((char_u *)p + i)) {
+  for (i = 0, j = 0; maxlen < 0 || (i < maxlen && j < maxlen);) {
     c1 = PTR2CHAR((char_u *)p + i);
-    c2 = PTR2CHAR((char_u *)q + i);
+    c2 = PTR2CHAR((char_u *)q + j);
 
     /* End of "p": check if "q" also ends or just has a slash. */
     if (c1 == NUL) {
       if (c2 == NUL)        /* full match */
         return 0;
       s = q;
+      i = j;
       break;
     }
 
@@ -1811,9 +1816,13 @@ int pathcmp(const char *p, const char *q, int maxlen)
       return p_fic ? vim_toupper(c1) - vim_toupper(c2)
              : c1 - c2;         /* no match */
     }
+
+    i += MB_PTR2LEN((char_u *)p + i);
+    j += MB_PTR2LEN((char_u *)q + j);
   }
-  if (s == NULL)        /* "i" ran into "maxlen" */
+  if (s == NULL) {  // "i" or "j" ran into "maxlen"
     return 0;
+  }
 
   c1 = PTR2CHAR((char_u *)s + i);
   c2 = PTR2CHAR((char_u *)s + i + MB_PTR2LEN((char_u *)s + i));