commit 5e34eec6f83222b1aa55c19d5f8f657d76d39121
author zeertzjq <zeertzjq@outlook.com> Sat Jul 05 15:37:17 2025 +0200
committer Christian Brabandt <cb@256bit.org> Sat Jul 05 15:37:17 2025 +0200
tree 783ab547b43e7ca24a8e6c4868d55d7643996f7d
parent 96b3ef23896ce70b2fdf3425ba2c013ce2840db6

patch 9.1.1510: Search completion may use invalid memory

Problem:  Search completion may use invalid memory (after 9.1.1490).
Solution: Don't get two line pointers at the same time (zeertzjq).

closes: #17661

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/cmdexpand.c

diff --git a/src/cmdexpand.c b/src/cmdexpand.c
index b1c9ed6..5fa631c 100644
--- a/src/cmdexpand.c
+++ b/src/cmdexpand.c
@@ -4638,14 +4638,11 @@
 	    || (start->lnum == end->lnum && start->col >= end->col))
 	return FAIL; // invalid range
 
-    // Get line pointers
-    start_line = ml_get(start->lnum);
-    end_line = ml_get(end->lnum);
-
     // Use a growable string (ga)
     ga_init2(&ga, 1, 128);
 
     // Append start line from start->col to end
+    start_line = ml_get(start->lnum);
     char_u  *start_ptr = start_line + start->col;
     int	    is_single_line = start->lnum == end->lnum;
 
@@ -4672,6 +4669,7 @@
     }
 
     // Append partial end line (up to word end)
+    end_line = ml_get(end->lnum);
     word_end = find_word_end(end_line + end->col);
     segment_len = (int)(word_end - end_line);
     if (ga_grow(&ga, segment_len) != OK)