Description

Use After Free in function do_tag at vim/src/tag.c:807.

vim version

./vim --version
VIM - Vi IMproved 9.0 (2022 Jun 28, compiled Sep  2 2022 22:56:19)
Included patches: 1-363

Proof of Concept

./vim -u NONE -i NONE -n -m -X -Z -e -s -S /home/elva/fuzz_vim/test/poc8_huaf.dat -c :qa!
=================================================================
==122823==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500000c0b8 at pc 0x55e4bcacd1c9 bp 0x7fff7e8c46c0 sp 0x7fff7e8c46b0
WRITE of size 4 at 0x62500000c0b8 thread T0
    #0 0x55e4bcacd1c8 in do_tag /home/elva/fuzz_vim/vim/src/tag.c:807
    #1 0x55e4bc7035dc in ex_tag_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:9023
    #2 0x55e4bc7032fa in ex_tag /home/elva/fuzz_vim/vim/src/ex_docmd.c:8974
    #3 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #4 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #5 0x55e4bc6d381d in do_cmdline_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:584
    #6 0x55e4bcb1fc56 in f_assert_fails /home/elva/fuzz_vim/vim/src/testing.c:618
    #7 0x55e4bc67417f in call_internal_func /home/elva/fuzz_vim/vim/src/evalfunc.c:2990
    #8 0x55e4bcb88f41 in call_func /home/elva/fuzz_vim/vim/src/userfunc.c:3615
    #9 0x55e4bcb7f833 in get_func_tv /home/elva/fuzz_vim/vim/src/userfunc.c:1817
    #10 0x55e4bcb9540a in ex_call /home/elva/fuzz_vim/vim/src/userfunc.c:5576
    #11 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #12 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #13 0x55e4bca05b68 in do_source_ext /home/elva/fuzz_vim/vim/src/scriptfile.c:1664
    #14 0x55e4bca06d9d in do_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1808
    #15 0x55e4bca0385b in cmd_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1163
    #16 0x55e4bca038c0 in ex_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1189
    #17 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #18 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #19 0x55e4bc6d381d in do_cmdline_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:584
    #20 0x55e4bccdf8a6 in exe_commands /home/elva/fuzz_vim/vim/src/main.c:3133
    #21 0x55e4bccd83a3 in vim_main2 /home/elva/fuzz_vim/vim/src/main.c:780
    #22 0x55e4bccd7c2d in main /home/elva/fuzz_vim/vim/src/main.c:432
    #23 0x7f410bacf0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #24 0x55e4bc54462d in _start (/home/elva/fuzz_vim/vim/src/vim+0x14062d)

0x62500000c0b8 is located 8120 bytes inside of 9104-byte region [0x62500000a100,0x62500000c490)
freed by thread T0 here:
    #0 0x7f410c33540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x55e4bc544d1a in vim_free /home/elva/fuzz_vim/vim/src/alloc.c:623
    #2 0x55e4bcc3fe40 in win_free /home/elva/fuzz_vim/vim/src/window.c:5281
    #3 0x55e4bcc35544 in win_free_mem /home/elva/fuzz_vim/vim/src/window.c:2933
    #4 0x55e4bcc33b7a in win_close /home/elva/fuzz_vim/vim/src/window.c:2667
    #5 0x55e4bc6f61e4 in ex_exit /home/elva/fuzz_vim/vim/src/ex_docmd.c:6445
    #6 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #7 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #8 0x55e4bcb85336 in call_user_func /home/elva/fuzz_vim/vim/src/userfunc.c:2884
    #9 0x55e4bcb86584 in call_user_func_check /home/elva/fuzz_vim/vim/src/userfunc.c:3041
    #10 0x55e4bcb88e38 in call_func /home/elva/fuzz_vim/vim/src/userfunc.c:3597
    #11 0x55e4bcb876ca in call_callback /home/elva/fuzz_vim/vim/src/userfunc.c:3342
    #12 0x55e4bcad139c in find_tagfunc_tags /home/elva/fuzz_vim/vim/src/tag.c:1470
    #13 0x55e4bcad321c in findtags_apply_tfu /home/elva/fuzz_vim/vim/src/tag.c:1837
    #14 0x55e4bcadaef1 in find_tags /home/elva/fuzz_vim/vim/src/tag.c:3145
    #15 0x55e4bcacc885 in do_tag /home/elva/fuzz_vim/vim/src/tag.c:687
    #16 0x55e4bc7035dc in ex_tag_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:9023
    #17 0x55e4bc7032fa in ex_tag /home/elva/fuzz_vim/vim/src/ex_docmd.c:8974
    #18 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #19 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #20 0x55e4bc6d381d in do_cmdline_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:584
    #21 0x55e4bcb1fc56 in f_assert_fails /home/elva/fuzz_vim/vim/src/testing.c:618
    #22 0x55e4bc67417f in call_internal_func /home/elva/fuzz_vim/vim/src/evalfunc.c:2990
    #23 0x55e4bcb88f41 in call_func /home/elva/fuzz_vim/vim/src/userfunc.c:3615
    #24 0x55e4bcb7f833 in get_func_tv /home/elva/fuzz_vim/vim/src/userfunc.c:1817
    #25 0x55e4bcb9540a in ex_call /home/elva/fuzz_vim/vim/src/userfunc.c:5576
    #26 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #27 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #28 0x55e4bca05b68 in do_source_ext /home/elva/fuzz_vim/vim/src/scriptfile.c:1664
    #29 0x55e4bca06d9d in do_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1808

previously allocated by thread T0 here:
    #0 0x7f410c335808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x55e4bc544a6a in lalloc /home/elva/fuzz_vim/vim/src/alloc.c:246
    #2 0x55e4bc544900 in alloc_clear /home/elva/fuzz_vim/vim/src/alloc.c:177
    #3 0x55e4bcc3ee49 in win_alloc /home/elva/fuzz_vim/vim/src/window.c:5053
    #4 0x55e4bcc2af38 in win_split_ins /home/elva/fuzz_vim/vim/src/window.c:1105
    #5 0x55e4bcc297f8 in win_split /home/elva/fuzz_vim/vim/src/window.c:844
    #6 0x55e4bc6f6f9a in ex_splitview /home/elva/fuzz_vim/vim/src/ex_docmd.c:6772
    #7 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #8 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #9 0x55e4bca05b68 in do_source_ext /home/elva/fuzz_vim/vim/src/scriptfile.c:1664
    #10 0x55e4bca06d9d in do_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1808
    #11 0x55e4bca0385b in cmd_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1163
    #12 0x55e4bca038c0 in ex_source /home/elva/fuzz_vim/vim/src/scriptfile.c:1189
    #13 0x55e4bc6de148 in do_one_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:2569
    #14 0x55e4bc6d5483 in do_cmdline /home/elva/fuzz_vim/vim/src/ex_docmd.c:990
    #15 0x55e4bc6d381d in do_cmdline_cmd /home/elva/fuzz_vim/vim/src/ex_docmd.c:584
    #16 0x55e4bccdf8a6 in exe_commands /home/elva/fuzz_vim/vim/src/main.c:3133
    #17 0x55e4bccd83a3 in vim_main2 /home/elva/fuzz_vim/vim/src/main.c:780
    #18 0x55e4bccd7c2d in main /home/elva/fuzz_vim/vim/src/main.c:432
    #19 0x7f410bacf0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/elva/fuzz_vim/vim/src/tag.c:807 in do_tag
Shadow bytes around the buggy address:
  0x0c4a7fff97c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff97d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff97e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff97f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff9800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a7fff9810: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
  0x0c4a7fff9820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff9830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff9840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff9850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fff9860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==122823==ABORTING

poc download url: https://github.com/Janette88/vim/blob/main/poc8_huaf.dat

Impact

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.