[vim/vim] Double free detected in Vim (Issue #21060)
dvaave2025 (Vim Github Repository) <[email protected]>
| Newsgroups | gmane.editors.vim.devel |
|---|---|
| Message-ID | <vim/vim/issues/[email protected]> |
dvaave2025 created an issue (vim/vim#21060)
### Steps to reproduce
Build vim with provided build flags:
$ CC=clang
CFLAGS="-O0 -g -fno-omit-frame-pointer -fsanitize=address"
LDFLAGS="-fsanitize=address"
./configure --with-features=huge
run command: ./src/vim -u NONE -X -Z -e -s -S id:000024,sig:06,src:087178,time:1536831358,execs:13702119,op:havoc,rep:3 -c :qa!
poc download: https://drive.google.com/file/d/1N4MsVmbi2niaJyNWtPayMrV5wkAe1H4U/view
May I request a CVE assignment to this bug if confirmed by the developer? Thanks!
### Expected behaviour
Double-free detected
### Version of Vim
$ git rev-parse HEAD 5d41506eb4895fbf0b6ccf4067c7f6e3c8ac568b
### Environment
NAME="Fedora Linux"
VERSION="44 (Workstation Edition)"
RELEASE_TYPE=stable
clang version 22.1.7 (Fedora 22.1.7-1.fc44)
### Logs and stack traces
```shell
$ ../vim/src/vim -u NONE -X -Z -e -s -S id:000024,sig:06,src:087178,time:1536831358,execs:13702119,op:havoc,rep:3 -c :qa!
helplang=ennoloadplugins scroll=16 fileencodings=ucs-bom,utf-8,default,latin1
helplang=ennoloadplugins scroll=11 fileencodings=ucs-bom,utf-8,default,latin1
==================================================================3654050==ERROR: AddressSanitizer: attempting double-free on 0x7c0cb73f2950 in thread T0:
#0 0x0000004a6d6a in free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
#1 0x0000004ebb28 in vim_free /home/wen/testb/vim/src/alloc.c:622:2
#2 0x000000c9c92f in clear_tv /home/wen/testb/vim/src/typval.c:130:6
#3 0x000000cdc5f5 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2189:6
#4 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#5 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#6 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#7 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#8 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#9 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#10 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
#11 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
#12 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
#13 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
#14 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
#15 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
#16 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
#17 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#18 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#19 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#20 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#21 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#22 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#23 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
#24 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
#25 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
#26 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
#27 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
#28 0x0000006442c1 in eval0_retarg /home/wen/testb/vim/src/eval.c:3557:11
#29 0x000000631b31 in eval0 /home/wen/testb/vim/src/eval.c:3492:12
#30 0x0000006362ef in eval_to_string_eap /home/wen/testb/vim/src/eval.c:704:6
#31 0x000000abfc33 in get_expr_line /home/wen/testb/vim/src/register.c:154:10
#32 0x000000ac12cb in do_execreg /home/wen/testb/vim/src/register.c:707:6
#33 0x000000720cfa in ex_at /home/wen/testb/vim/src/ex_docmd.c:8783:9
#34 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
#35 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
#36 0x000000b06951 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
#37 0x000000b04380 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1428:6
#38 0x000000b040e9 in ex_source /home/wen/testb/vim/src/scriptfile.c:1471:2
#39 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
#40 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
#41 0x000000b06951 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
#42 0x000000b04a00 in do_source /home/wen/testb/vim/src/scriptfile.c:2099:12
#43 0x000000b045a9 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1445:14
#44 0x000000b040e9 in ex_source /home/wen/testb/vim/src/scriptfile.c:1471:2
#45 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
#46 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
#47 0x0000006ea0e0 in do_cmdline_cmd /home/wen/testb/vim/src/ex_docmd.c:635:12
#48 0x000000ed919c in exe_commands /home/wen/testb/vim/src/main.c:3322:2
#49 0x000000ed71af in vim_main2 /home/wen/testb/vim/src/main.c:866:6
#50 0x000000ed1cf6 in main /home/wen/testb/vim/src/main.c:453:12
#51 0x7fecb82bf680 in __libc_start_call_main (/lib64/libc.so.6+0x3680) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
#52 0x7fecb82bf797 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3797) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
#53 0x000000400f54 in _start (/home/wen/testb/vim/src/vim+0x400f54) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
0x7c0cb73f2950 is located 0 bytes inside of 2-byte region [0x7c0cb73f2950,0x7c0cb73f2952)
freed by thread T0 here:
#0 0x0000004a6d6a in free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
#1 0x0000004ebb28 in vim_free /home/wen/testb/vim/src/alloc.c:622:2
#2 0x000000c9c92f in clear_tv /home/wen/testb/vim/src/typval.c:130:6
#3 0x000000bbdf95 in string_reduce /home/wen/testb/vim/src/strings.c:1052:2
#4 0x000000846cc6 in f_reduce /home/wen/testb/vim/src/list.c:3487:2
#5 0x00000066814d in call_internal_func /home/wen/testb/vim/src/evalfunc.c:3513:5
#6 0x000000cde1f5 in call_func /home/wen/testb/vim/src/userfunc.c:4176:14
#7 0x000000cdc57e in get_func_tv /home/wen/testb/vim/src/userfunc.c:2183:8
#8 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#9 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#10 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#11 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#12 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#13 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#14 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
#15 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
#16 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
#17 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
#18 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
#19 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
#20 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
#21 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#22 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#23 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#24 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#25 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#26 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#27 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
#28 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
#29 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
previously allocated by thread T0 here:
#0 0x0000004a7008 in malloc (/home/wen/testb/vim/src/vim+0x4a7008) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
#1 0x0000004eb7ae in lalloc /home/wen/testb/vim/src/alloc.c:246:11
#2 0x0000004eb719 in alloc /home/wen/testb/vim/src/alloc.c:151:12
#3 0x000000bb9fbc in vim_strnsave /home/wen/testb/vim/src/strings.c:44:9
#4 0x000000bbdb22 in copy_first_char_to_tv /home/wen/testb/vim/src/strings.c:930:29
#5 0x000000bbde4b in string_reduce /home/wen/testb/vim/src/strings.c:1030:8
#6 0x000000846cc6 in f_reduce /home/wen/testb/vim/src/list.c:3487:2
#7 0x00000066814d in call_internal_func /home/wen/testb/vim/src/evalfunc.c:3513:5
#8 0x000000cde1f5 in call_func /home/wen/testb/vim/src/userfunc.c:4176:14
#9 0x000000cdc57e in get_func_tv /home/wen/testb/vim/src/userfunc.c:2183:8
#10 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#11 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#12 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#13 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#14 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#15 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#16 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
#17 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
#18 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
#19 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
#20 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
#21 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
#22 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
#23 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
#24 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
#25 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
#26 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
#27 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
#28 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
#29 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
SUMMARY: AddressSanitizer: double-free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666) in free
==3654050==ABORTING
```
--
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/issues/21060
You are receiving this because you are subscribed to this thread.
Message ID: <vim/vim/issues/[email protected]>
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/issues/21060%40github.com.