[vim/vim] Heap-buffer-overflow detected in Vim (Issue #21097)

dvaave2025 created an issue (vim/vim#21097)

### Steps to reproduce

Build vim with provided build flags:
$ CC=clang
CC=clang CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address,leak" LDFLAGS="-fsanitize=address,leak" ./configure --with-features=huge

run command: ./src/vim -u NONE -X -Z -e -s -S id:000035,sig:11,src:015688,time:1911381291,execs:14550084,op:havoc,rep:2 -c :qa!

poc download: https://drive.google.com/file/d/1GrzrHd7c8XGUIiw5MPbGo7se0PgCREji/view


### Expected behaviour

heap-buffer-overflow

### Version of Vim

$ git rev-parse HEAD f8799c5d0d5bad30e12ee1daa3034a2a58850690

### Environment

NAME="Fedora Linux"
VERSION="44 (Workstation Edition)"
RELEASE_TYPE=stable
clang version 22.1.7 (Fedora 22.1.7-1.fc44)

### Logs and stack traces

```shell
$ /home/wen/testb/vim/src/vim -u NONE -X -Z -e -s -S /home/wen/testb/crash5/id:000035,sig:11,src:015688,time:1911381291,execs:14550084,op:havoc,rep:2 -c :qa!
  helplang=ennoloadplugins  scroll=35  fileencodings=ucs-bom,utf-8,default,latin1
==================================================================2203745==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b3bf53ead1e at pc 0x0000009b17db bp 0x7ffd0a2521f0 sp 0x7ffd0a2521e8
READ of size 1 at 0x7b3bf53ead1e thread T0
    #0 0x0000009b17da in spell_find_suggest /home/wen/testb/vim/src/spellsuggest.c:798:9
    #1 0x0000009acc53 in spell_suggest /home/wen/testb/vim/src/spellsuggest.c:555:5
    #2 0x0000007ef727 in nv_zet /home/wen/testb/vim/src/normal.c:2998:7
    #3 0x0000007ca696 in normal_cmd /home/wen/testb/vim/src/normal.c:955:5
    #4 0x00000066419c in exec_normal /home/wen/testb/vim/src/ex_docmd.c
    #5 0x00000066398a in exec_normal_cmd /home/wen/testb/vim/src/ex_docmd.c:9505:5
    #6 0x00000066398a in ex_normal /home/wen/testb/vim/src/ex_docmd.c:9411:6
    #7 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #8 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #9 0x00000094c8c1 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #10 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #11 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #12 0x00000094c8c1 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #13 0x00000094b157 in do_source /home/wen/testb/vim/src/scriptfile.c:2099:12
    #14 0x00000094b157 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1445:14
    #15 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #16 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #17 0x000000bf558d in exe_commands /home/wen/testb/vim/src/main.c:3322:2
    #18 0x000000bf558d in vim_main2 /home/wen/testb/vim/src/main.c:866:6
    #19 0x000000bf3ad9 in main /home/wen/testb/vim/src/main.c:453:12
    #20 0x7f1bf6232680 in __libc_start_call_main (/lib64/libc.so.6+0x3680) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #21 0x7f1bf6232797 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3797) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #22 0x000000402dc4 in _start (/home/wen/testb/vim/src/vim+0x402dc4) (BuildId: c1f621da674ff89f5fa9fbc452508e997c7f9730)

0x7b3bf53ead1e is located 10 bytes after 4-byte region [0x7b3bf53ead10,0x7b3bf53ead14)
allocated by thread T0 here:
    #0 0x0000004a8e78 in malloc (/home/wen/testb/vim/src/vim+0x4a8e78) (BuildId: c1f621da674ff89f5fa9fbc452508e997c7f9730)
    #1 0x0000004ed627 in lalloc /home/wen/testb/vim/src/alloc.c:246:11
    #2 0x0000009c3f05 in vim_strnsave /home/wen/testb/vim/src/strings.c:44:9
    #3 0x0000009acbb3 in spell_suggest /home/wen/testb/vim/src/spellsuggest.c:545:12
    #4 0x0000007ef727 in nv_zet /home/wen/testb/vim/src/normal.c:2998:7
    #5 0x0000007ca696 in normal_cmd /home/wen/testb/vim/src/normal.c:955:5
    #6 0x00000066419c in exec_normal /home/wen/testb/vim/src/ex_docmd.c
    #7 0x00000066398a in exec_normal_cmd /home/wen/testb/vim/src/ex_docmd.c:9505:5
    #8 0x00000066398a in ex_normal /home/wen/testb/vim/src/ex_docmd.c:9411:6
    #9 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #10 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #11 0x00000094c8c1 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #12 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #13 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #14 0x00000094c8c1 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #15 0x00000094b157 in do_source /home/wen/testb/vim/src/scriptfile.c:2099:12
    #16 0x00000094b157 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1445:14
    #17 0x00000064b388 in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #18 0x00000064b388 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #19 0x000000bf558d in exe_commands /home/wen/testb/vim/src/main.c:3322:2
    #20 0x000000bf558d in vim_main2 /home/wen/testb/vim/src/main.c:866:6
    #21 0x000000bf3ad9 in main /home/wen/testb/vim/src/main.c:453:12
    #22 0x7f1bf6232680 in __libc_start_call_main (/lib64/libc.so.6+0x3680) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #23 0x7f1bf6232797 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3797) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #24 0x000000402dc4 in _start (/home/wen/testb/vim/src/vim+0x402dc4) (BuildId: c1f621da674ff89f5fa9fbc452508e997c7f9730)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/wen/testb/vim/src/spellsuggest.c:798:9 in spell_find_suggest
Shadow bytes around the buggy address:
  0x7b3bf53eaa80: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
  0x7b3bf53eab00: fa fa 00 00 fa fa fd fd fa fa fd fa fa fa fd fd
  0x7b3bf53eab80: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x7b3bf53eac00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x7b3bf53eac80: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x7b3bf53ead00: fa fa 04[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3bf53ead80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3bf53eae00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3bf53eae80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3bf53eaf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3bf53eaf80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2203745==ABORTING
```

-- 
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/issues/21097
You are receiving this because you are subscribed to this thread.

Message ID: <vim/vim/issues/[email protected]>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/issues/21097%40github.com.