From c7c3f9fc9c3a97cc8f48ea5cfffa1d0fc79abb5d Mon Sep 17 00:00:00 2001 From: glepnir Date: Wed, 13 Aug 2025 04:43:56 +0800 Subject: fix(api): fix crash in command preview with % #35228 Problem: parse_cmdline() sets eap->cmdlinep to address of local parameter, causing invalid memory access when expand_filename() tries to modify it. This leads to crashes when typing '%' in user commands with preview=true and complete=file. Solution: Change parse_cmdline() signature to accept char **cmdline, allowing cmdlinep to point to caller's variable for safe reallocation. --- src/nvim/api/command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/nvim/api/command.c') diff --git a/src/nvim/api/command.c b/src/nvim/api/command.c index 325de4c53d..4b334d3e3b 100644 --- a/src/nvim/api/command.c +++ b/src/nvim/api/command.c @@ -134,7 +134,7 @@ Dict(cmd) nvim_parse_cmd(String str, Dict(empty) *opts, Arena *arena, Error *err char *cmdline = arena_memdupz(arena, str.data, str.size); const char *errormsg = NULL; - if (!parse_cmdline(cmdline, &ea, &cmdinfo, &errormsg)) { + if (!parse_cmdline(&cmdline, &ea, &cmdinfo, &errormsg)) { if (errormsg != NULL) { api_set_error(err, kErrorTypeException, "Parsing command-line: %s", errormsg); } else { -- cgit