[vim/vim] Double free detected in Vim (Issue #21060)

2 views

Skip to first unread message

dvaave2025

unread,

Aug 15, 2026, 2:12:24 PM (17 hours ago) Aug 15

to vim/vim, Subscribed

dvaave2025 created an issue (vim/vim#21060)

Steps to reproduce

Build vim with provided build flags:
$ CC=clang
CFLAGS="-O0 -g -fno-omit-frame-pointer -fsanitize=address"
LDFLAGS="-fsanitize=address"
./configure --with-features=huge

run command: ./src/vim -u NONE -X -Z -e -s -S id:000024,sig:06,src:087178,time:1536831358,execs:13702119,op:havoc,rep:3 -c :qa!

poc download: https://drive.google.com/file/d/1N4MsVmbi2niaJyNWtPayMrV5wkAe1H4U/view

May I request a CVE assignment to this bug if confirmed by the developer? Thanks!

Expected behaviour

Double-free detected

Version of Vim

$ git rev-parse HEAD 5d41506

Environment

NAME="Fedora Linux"
VERSION="44 (Workstation Edition)"
RELEASE_TYPE=stable
clang version 22.1.7 (Fedora 22.1.7-1.fc44)

Logs and stack traces

$ ../vim/src/vim -u NONE -X -Z -e -s -S id:000024,sig:06,src:087178,time:1536831358,execs:13702119,op:havoc,rep:3  -c :qa!
  helplang=ennoloadplugins  scroll=16  fileencodings=ucs-bom,utf-8,default,latin1
  helplang=ennoloadplugins  scroll=11  fileencodings=ucs-bom,utf-8,default,latin1
=================================================================
==3654050==ERROR: AddressSanitizer: attempting double-free on 0x7c0cb73f2950 in thread T0:
    #0 0x0000004a6d6a in free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
    #1 0x0000004ebb28 in vim_free /home/wen/testb/vim/src/alloc.c:622:2
    #2 0x000000c9c92f in clear_tv /home/wen/testb/vim/src/typval.c:130:6
    #3 0x000000cdc5f5 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2189:6
    #4 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #5 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #6 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #7 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #8 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #9 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #10 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
    #11 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
    #12 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
    #13 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
    #14 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
    #15 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
    #16 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
    #17 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #18 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #19 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #20 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #21 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #22 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #23 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
    #24 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
    #25 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
    #26 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
    #27 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
    #28 0x0000006442c1 in eval0_retarg /home/wen/testb/vim/src/eval.c:3557:11
    #29 0x000000631b31 in eval0 /home/wen/testb/vim/src/eval.c:3492:12
    #30 0x0000006362ef in eval_to_string_eap /home/wen/testb/vim/src/eval.c:704:6
    #31 0x000000abfc33 in get_expr_line /home/wen/testb/vim/src/register.c:154:10
    #32 0x000000ac12cb in do_execreg /home/wen/testb/vim/src/register.c:707:6
    #33 0x000000720cfa in ex_at /home/wen/testb/vim/src/ex_docmd.c:8783:9
    #34 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #35 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #36 0x000000b06951 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #37 0x000000b04380 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1428:6
    #38 0x000000b040e9 in ex_source /home/wen/testb/vim/src/scriptfile.c:1471:2
    #39 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #40 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #41 0x000000b06951 in do_source_ext /home/wen/testb/vim/src/scriptfile.c:1953:5
    #42 0x000000b04a00 in do_source /home/wen/testb/vim/src/scriptfile.c:2099:12
    #43 0x000000b045a9 in cmd_source /home/wen/testb/vim/src/scriptfile.c:1445:14
    #44 0x000000b040e9 in ex_source /home/wen/testb/vim/src/scriptfile.c:1471:2
    #45 0x0000006eef2d in do_one_cmd /home/wen/testb/vim/src/ex_docmd.c:2629:2
    #46 0x0000006e7cc7 in do_cmdline /home/wen/testb/vim/src/ex_docmd.c:1041:17
    #47 0x0000006ea0e0 in do_cmdline_cmd /home/wen/testb/vim/src/ex_docmd.c:635:12
    #48 0x000000ed919c in exe_commands /home/wen/testb/vim/src/main.c:3322:2
    #49 0x000000ed71af in vim_main2 /home/wen/testb/vim/src/main.c:866:6
    #50 0x000000ed1cf6 in main /home/wen/testb/vim/src/main.c:453:12
    #51 0x7fecb82bf680 in __libc_start_call_main (/lib64/libc.so.6+0x3680) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #52 0x7fecb82bf797 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3797) (BuildId: 18472003bbf1c5f098a09b5016b9b8bd4c7c59f0)
    #53 0x000000400f54 in _start (/home/wen/testb/vim/src/vim+0x400f54) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)

0x7c0cb73f2950 is located 0 bytes inside of 2-byte region [0x7c0cb73f2950,0x7c0cb73f2952)
freed by thread T0 here:
    #0 0x0000004a6d6a in free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
    #1 0x0000004ebb28 in vim_free /home/wen/testb/vim/src/alloc.c:622:2
    #2 0x000000c9c92f in clear_tv /home/wen/testb/vim/src/typval.c:130:6
    #3 0x000000bbdf95 in string_reduce /home/wen/testb/vim/src/strings.c:1052:2
    #4 0x000000846cc6 in f_reduce /home/wen/testb/vim/src/list.c:3487:2
    #5 0x00000066814d in call_internal_func /home/wen/testb/vim/src/evalfunc.c:3513:5
    #6 0x000000cde1f5 in call_func /home/wen/testb/vim/src/userfunc.c:4176:14
    #7 0x000000cdc57e in get_func_tv /home/wen/testb/vim/src/userfunc.c:2183:8
    #8 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #9 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #10 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #11 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #12 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #13 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #14 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
    #15 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
    #16 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
    #17 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
    #18 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
    #19 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
    #20 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
    #21 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #22 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #23 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #24 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #25 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #26 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #27 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
    #28 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
    #29 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9

previously allocated by thread T0 here:
    #0 0x0000004a7008 in malloc (/home/wen/testb/vim/src/vim+0x4a7008) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666)
    #1 0x0000004eb7ae in lalloc /home/wen/testb/vim/src/alloc.c:246:11
    #2 0x0000004eb719 in alloc /home/wen/testb/vim/src/alloc.c:151:12
    #3 0x000000bb9fbc in vim_strnsave /home/wen/testb/vim/src/strings.c:44:9
    #4 0x000000bbdb22 in copy_first_char_to_tv /home/wen/testb/vim/src/strings.c:930:29
    #5 0x000000bbde4b in string_reduce /home/wen/testb/vim/src/strings.c:1030:8
    #6 0x000000846cc6 in f_reduce /home/wen/testb/vim/src/list.c:3487:2
    #7 0x00000066814d in call_internal_func /home/wen/testb/vim/src/evalfunc.c:3513:5
    #8 0x000000cde1f5 in call_func /home/wen/testb/vim/src/userfunc.c:4176:14
    #9 0x000000cdc57e in get_func_tv /home/wen/testb/vim/src/userfunc.c:2183:8
    #10 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #11 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #12 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #13 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #14 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #15 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #16 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9
    #17 0x00000065d74e in eval4 /home/wen/testb/vim/src/eval.c:4073:9
    #18 0x00000065ca27 in eval3 /home/wen/testb/vim/src/eval.c:3934:9
    #19 0x000000644917 in eval2 /home/wen/testb/vim/src/eval.c:3808:9
    #20 0x000000633907 in eval1 /home/wen/testb/vim/src/eval.c:3646:9
    #21 0x000000cdbb66 in get_func_arguments /home/wen/testb/vim/src/userfunc.c:2093:6
    #22 0x000000cdc3f7 in get_func_tv /home/wen/testb/vim/src/userfunc.c:2162:11
    #23 0x0000006586d5 in eval_func /home/wen/testb/vim/src/eval.c:3273:8
    #24 0x000000657f77 in eval9_var_func_name /home/wen/testb/vim/src/eval.c:5182:12
    #25 0x000000656664 in eval9 /home/wen/testb/vim/src/eval.c:5397:8
    #26 0x0000006619b9 in eval8 /home/wen/testb/vim/src/eval.c:4860:11
    #27 0x000000660027 in eval7 /home/wen/testb/vim/src/eval.c:4758:9
    #28 0x00000065ebcb in eval6 /home/wen/testb/vim/src/eval.c:4508:9
    #29 0x00000065e2eb in eval5 /home/wen/testb/vim/src/eval.c:4298:9

SUMMARY: AddressSanitizer: double-free (/home/wen/testb/vim/src/vim+0x4a6d6a) (BuildId: f7a2c4a90fc9a91600ada13f659d855cc02e1666) in free
==3654050==ABORTING

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

Christian Brabandt

unread,

6:45 AM (25 minutes ago) 6:45 AM

to vim/vim, Subscribed

chrisbra left a comment (vim/vim#21060)

Didn't you already report this using the security list? As mentioned there, this does not appear to be security relevant, and as such I will not create a CVE for this. The fix should be in #21048