Created attachment 1749739 [details]
five pocs

To Reproduce

```shell
vim -u NONE -X -Z -e -s -S poc -c :qa!
```

Debug Info

```shell
/src/vim# ASAN_OPTIONS=alloc_dealloc_mismatch=0:allocator_may_return_null=1:allocator_release_to_os_interval_ms=500:check_malloc_usable_size=0:detect_container_overflow=1:detect_odr_violation=0:detect_leaks=1:detect_stack_use_after_return=1:fast_unwind_on_fatal=0:handle_abort=1:handle_segv=1:handle_sigill=1:max_uar_stack_size_log=16:print_scariness=1:quarantine_size_mb=10:strict_memcmp=1:strict_string_check=1:strip_path_prefix=/workspace/:symbolize=1:use_sigaltstack=1 src/vim_asan -u NONE -X -Z -e -s -S ../poc -c :qa!
=================================================================
==22327==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500000c9d8 at pc 0x0000009c0cf8 bp 0x625000001ad0 sp 0x625000001ac8
READ of size 8 at 0x62500000c9d8 thread T0
SCARINESS: 51 (8-byte-read-heap-use-after-free)
Segmentation fault

/src/vim# gdb --args src/vim -u NONE -X -Z -e -s -S ../poc  -c :qa!
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x905e30 --> 0x3e9
RBX: 0x0
RCX: 0x0
RDX: 0x0
RSI: 0x1
RDI: 0x0
RBP: 0x0
RSP: 0x7fffffffad60 --> 0x905e68 --> 0x1
RIP: 0x4ca5a7 (<ml_get_buf+7>:  cmp    QWORD PTR [rdi],rsi)
R8 : 0x1
R9 : 0x0
R10: 0x0
R11: 0x7ffff745eed0 --> 0xfff1ebb0fff1eba0
R12: 0x1
R13: 0x0
R14: 0x41 ('A')
R15: 0x0
EFLAGS: 0x10246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x4ca5a1 <ml_get_buf+1>:     push   r14
   0x4ca5a3 <ml_get_buf+3>:     push   rbx
   0x4ca5a4 <ml_get_buf+4>:     mov    rbx,rdi
=> 0x4ca5a7 <ml_get_buf+7>:     cmp    QWORD PTR [rdi],rsi
   0x4ca5aa <ml_get_buf+10>:    jge    0x4ca5f2 <ml_get_buf+82>
   0x4ca5ac <ml_get_buf+12>:    cmp    DWORD PTR [rip+0x417f6d],0x0        # 0x8e2520 <ml_get_buf.recursive>
   0x4ca5b3 <ml_get_buf+19>:    jne    0x4ca5d2 <ml_get_buf+50>
   0x4ca5b5 <ml_get_buf+21>:    mov    DWORD PTR [rip+0x417f61],0x1        # 0x8e2520 <ml_get_buf.recursive>
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffad60 --> 0x905e68 --> 0x1
0008| 0x7fffffffad68 --> 0x41 ('A')
0016| 0x7fffffffad70 --> 0x0
0024| 0x7fffffffad78 --> 0x4c4c4f (<mb_adjustpos+31>:   mov    r14,rax)
0032| 0x7fffffffad80 --> 0x41 ('A')
0040| 0x7fffffffad88 --> 0x41 ('A')
0048| 0x7fffffffad90 --> 0x0
0056| 0x7fffffffad98 --> 0x4e29e1 (<normal_cmd+2641>:   mov    rax,QWORD PTR [rip+0x405fe0]        # 0x8e89c8 <curwin>)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
ml_get_buf (buf=0x0, lnum=0x1, will_change=will_change@entry=0x0) at memline.c:2555
2555        if (lnum > buf->b_ml.ml_line_count) // invalid line number
gdb-peda$ bt
#0  ml_get_buf (buf=0x0, lnum=0x1, will_change=will_change@entry=0x0) at memline.c:2555
#1  0x00000000004c4c4f in mb_adjustpos (buf=0x0, lp=0x905e68) at mbyte.c:4255
#2  0x00000000004c4c27 in mb_adjust_cursor () at mbyte.c:4241
#3  0x00000000004e29e1 in normal_cmd (oap=oap@entry=0x7fffffffae48, toplevel=toplevel@entry=0x1) at normal.c:1244
#4  0x000000000046eaed in exec_normal (was_typed=was_typed@entry=0x0, use_vpeekc=use_vpeekc@entry=0x0, may_use_terminal_loop=may_use_terminal_loop@entry=0x0) at ex_docmd.c:8281
#5  0x000000000046e9b2 in exec_normal_cmd (cmd=<optimized out>, remap=<optimized out>, silent=0x0) at ex_docmd.c:8265
#6  ex_normal (eap=0x7fffffffb010) at ex_docmd.c:8183
#7  0x000000000046897a in do_one_cmd (cmdlinep=0x7fffffffafe8, flags=0x7, cstack=0x7fffffffb1c8, fgetline=0x566f30 <getsourceline>, cookie=0x7fffffffb960) at ex_docmd.c:2588
#8  do_cmdline (cmdline=<optimized out>, cmdline@entry=0x904d00 "vimA788)\026\025\026\026\020\070\"\177", fgetline=<optimized out>, cookie=<optimized out>, cookie@entry=0x7fffffffb960,
    flags=flags@entry=0x7) at ex_docmd.c:1003
#9  0x0000000000566d15 in do_source (fname=<optimized out>, fname@entry=0x8f8e03 "../poc", check_other=<optimized out>, check_other@entry=0x0, is_vimrc=is_vimrc@entry=0x0, ret_sid=<optimized out>,
    ret_sid@entry=0x0) at scriptfile.c:1401
#10 0x0000000000566489 in cmd_source (fname=0x8f8e03 "../poc", eap=<optimized out>) at scriptfile.c:971
#11 0x000000000046897a in do_one_cmd (cmdlinep=0x7fffffffba58, flags=0xb, cstack=0x7fffffffbc38, fgetline=0x0, cookie=0x0) at ex_docmd.c:2588
#12 do_cmdline (cmdline=<optimized out>, fgetline=<optimized out>, fgetline@entry=0x0, cookie=<optimized out>, cookie@entry=0x0, flags=flags@entry=0xb) at ex_docmd.c:1003
#13 0x00000000004692de in do_cmdline_cmd (cmd=0x0) at ex_docmd.c:592
#14 0x000000000062860d in exe_commands (parmp=<optimized out>) at main.c:3056
#15 vim_main2 () at main.c:760
#16 0x0000000000627772 in main (argc=<optimized out>, argc@entry=0xb, argv=<optimized out>, argv@entry=0x7fffffffe578) at main.c:412
#17 0x00007ffff72f7840 in __libc_start_main (main=0x625f40 <main>, argc=0xb, argv=0x7fffffffe578, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe568)
    at ../csu/libc-start.c:291
#18 0x0000000000404269 in _start ()
```



Environment:

- version : commit e2edc2ed4a9a229870b1e1811b0ecf045b84e429
- OS: Ubuntu 16.04



Additional context

compile argument：

```shell
#!/bin/bash -eux
export CC="clang-11"
export CXX="clang-11++"
export LDFLAGS="-fsanitize=address"
export CFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer"
export CXXFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer"
cd /src/vim/ && ./configure --with-features=huge --enable-gui=none && make
```



Five pocs are provided, with the same crash point but different stack tracebacks, not sure wether they are the same vulnerability point



Credit: 1vanChen of NSFOCUS Security Team