Bug 1919218

Created attachment 1749725 [details]
poc

To Reproduce

```shell
vim -u NONE -X -Z -e -s -S poc -c :qa!
```

Debug Info

```shell
/src/vim# ASAN_OPTIONS=alloc_dealloc_mismatch=0:allocator_may_return_null=1:allocator_release_to_os_interval_ms=500:check_malloc_usable_size=0:detect_container_overflow=1:detect_odr_violation=0:detect_leaks=1:detect_stack_use_after_return=1:fast_unwind_on_fatal=0:handle_abort=1:handle_segv=1:handle_sigill=1:max_uar_stack_size_log=16:print_scariness=1:quarantine_size_mb=10:strict_memcmp=1:strict_string_check=1:strip_path_prefix=/workspace/:symbolize=1:use_sigaltstack=1 src/vim_asan -u NONE -X -Z -e -s -S /mnt/disk/out/vim/vim-fuzzer-out/bV7emu/crashes/id:000132,sig:11,src:055561,op:havoc,rep:2 -c :qa!
=================================================================
==18610==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000014128 at pc 0x0000005bf1a5 bp 0x7fffffffd730 sp 0x7fffffffd728
WRITE of size 4 at 0x625000014128 thread T0
SCARINESS: 46 (4-byte-write-heap-use-after-free)
    #0 0x5bf1a4 in do_ecmd /src/vim/src/ex_cmds.c:2762:25
    #1 0x4ca0a2 in do_argfile /src/vim/src/arglist.c:692:6
    #2 0x4ca5ce in ex_argument /src/vim/src/arglist.c:628:5
    #3 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #4 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #5 0x7ec3ee in do_source /src/vim/src/scriptfile.c:1401:5
    #6 0x7eb03d in cmd_source /src/vim/src/scriptfile.c:971:14
    #7 0x7eaf1e in ex_source /src/vim/src/scriptfile.c:997:2
    #8 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #9 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #10 0x5cf181 in do_cmdline_cmd /src/vim/src/ex_docmd.c:592:12
    #11 0x9c0df7 in exe_commands /src/vim/src/main.c:3056:2
    #12 0x9bfc44 in vim_main2 /src/vim/src/main.c:760:2
    #13 0x9bd071 in main /src/vim/src/main.c:412:12
    #14 0x7ffff6cba83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291
    #15 0x41d768 in _start (/src/vim/src/vim_asan+0x41d768)

0x625000014128 is located 40 bytes inside of 8736-byte region [0x625000014100,0x625000016320)
freed by thread T0 here:
    #0 0x49733d in free (/src/vim/src/vim_asan+0x49733d)
    #1 0x6cfd9b in vim_free /src/vim/src/misc2.c:1807:2
    #2 0x4d1815 in apply_autocmds_group /src/vim/src/autocmd.c:2172:6
    #3 0x4d363d in apply_autocmds /src/vim/src/autocmd.c:1621:12
    #4 0x4d8ba2 in close_buffer /src/vim/src/buffer.c:598:6
    #5 0x5bd77f in do_ecmd /src/vim/src/ex_cmds.c:2759:19
    #6 0x4ca0a2 in do_argfile /src/vim/src/arglist.c:692:6
    #7 0x4ca5ce in ex_argument /src/vim/src/arglist.c:628:5
    #8 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #9 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #10 0x7ec3ee in do_source /src/vim/src/scriptfile.c:1401:5
    #11 0x7eb03d in cmd_source /src/vim/src/scriptfile.c:971:14
    #12 0x7eaf1e in ex_source /src/vim/src/scriptfile.c:997:2
    #13 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #14 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #15 0x5cf181 in do_cmdline_cmd /src/vim/src/ex_docmd.c:592:12
    #16 0x9c0df7 in exe_commands /src/vim/src/main.c:3056:2
    #17 0x9bfc44 in vim_main2 /src/vim/src/main.c:760:2
    #18 0x9bd071 in main /src/vim/src/main.c:412:12
    #19 0x7ffff6cba83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291

previously allocated by thread T0 here:
    #0 0x4975bd in malloc (/src/vim/src/vim_asan+0x4975bd)
    #1 0x6ce307 in lalloc /src/vim/src/misc2.c:925:11
    #2 0x6ce423 in alloc_clear /src/vim/src/misc2.c:852:9
    #3 0x94efa9 in win_alloc /src/vim/src/window.c:4892:14
    #4 0x94cdac in win_split_ins /src/vim/src/window.c
    #5 0x949216 in win_split /src/vim/src/window.c:817:12
    #6 0x4ebb9b in ex_buffer_all /src/vim/src/buffer.c:5231:18
    #7 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #8 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #9 0x4d14d2 in apply_autocmds_group /src/vim/src/autocmd.c:2109:2
    #10 0x4d363d in apply_autocmds /src/vim/src/autocmd.c:1621:12
    #11 0x4de4c9 in buflist_new /src/vim/src/buffer.c:2215:6
    #12 0x4e5012 in buflist_add /src/vim/src/buffer.c:3501:11
    #13 0x4c7e54 in alist_add /src/vim/src/arglist.c:188:6
    #14 0x4c7cb0 in alist_set /src/vim/src/arglist.c:157:6
    #15 0x4c8aa0 in do_arglist /src/vim/src/arglist.c:458:6
    #16 0x4c9bc2 in ex_next /src/vim/src/arglist.c:721:10
    #17 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #18 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #19 0x7ec3ee in do_source /src/vim/src/scriptfile.c:1401:5
    #20 0x7eb03d in cmd_source /src/vim/src/scriptfile.c:971:14
    #21 0x7eaf1e in ex_source /src/vim/src/scriptfile.c:997:2
    #22 0x5d277b in do_one_cmd /src/vim/src/ex_docmd.c:2588:2
    #23 0x5cc8b8 in do_cmdline /src/vim/src/ex_docmd.c:1003:17
    #24 0x5cf181 in do_cmdline_cmd /src/vim/src/ex_docmd.c:592:12
    #25 0x9c0df7 in exe_commands /src/vim/src/main.c:3056:2
    #26 0x9bfc44 in vim_main2 /src/vim/src/main.c:760:2
    #27 0x9bd071 in main /src/vim/src/main.c:412:12
    #28 0x7ffff6cba83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-use-after-free /src/vim/src/ex_cmds.c:2762:25 in do_ecmd
Shadow bytes around the buggy address:
  0x0c4a7fffa7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fffa7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fffa800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fffa810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c4a7fffa820: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fffa830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fffa840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fffa850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fffa860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7fffa870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==18610==ABORTING
```



Environment:

- version : commit e2edc2ed4a9a229870b1e1811b0ecf045b84e429
- OS: Ubuntu 16.04



Additional context

compile argument：

```shell
#!/bin/bash -eux
export CC="clang-11"
export CXX="clang-11++"
export LDFLAGS="-fsanitize=address"
export CFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer"
export CXXFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer"
cd /src/vim/ && ./configure --with-features=huge --enable-gui=none && make
```



Credit: 1vanChen of NSFOCUS Security Team