Use of Uninitialized Variable in vim/vim

Greetings,

A Stack Buffer Overflow issue was discovered in Vim.

The POC file is reduced to the absolute minimum to reproduce the problem.
Please see sanitizer output and the “trimmed” POC file link below.

System info
OS version : Ubuntu 20.04.2 LTS + Clang 12 with ASan
Vim Version : master(2446ec9) - Tue Oct 26 12:00:01 2021 +0100

Steps to reproduce:

git clone https://github.com/vim/vim

LD=lld-12 AS=llvm-as-12 AR=llvm-ar-12 RANLIB=llvm-ranlib-12 CC=clang-12 CXX=clang++-12 CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" LDFLAGS="-ldl -fsanitize=address" ./configure --with-features=huge --enable-gui=none && make

3. Download POC from This URL

./vim -u NONE -X -Z -e -s -S POC -c :qa!

Sanitizer output:

=================================================================
==132419==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe5bab86df at pc 0x00000141c1d7 bp 0x7ffe5bab57a0 sp 0x7ffe5bab5798
READ of size 1 at 0x7ffe5bab86df thread T0
    #0 0x141c1d6 in spell_iswordp /src/fuzzer13/triage_yeni/vim/src/spell.c:2668:50
    #1 0x14ff6ec in suggest_trie_walk /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:1626:8
    #2 0x14dd15b in suggest_try_change /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:1199:2
    #3 0x14dd15b in spell_suggest_intern /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:995:5
    #4 0x14dd15b in spell_find_suggest /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:870:6
    #5 0x14d6dc1 in spell_suggest /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:545:5
    #6 0xef065e in nv_zet /src/fuzzer13/triage_yeni/vim/src/normal.c:3218:7
    #7 0xe845de in normal_cmd /src/fuzzer13/triage_yeni/vim/src/normal.c:1099:5
    #8 0x9aefb4 in exec_normal /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c
    #9 0x9ad0aa in exec_normal_cmd /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:8548:5
    #10 0x9ad0aa in ex_normal /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:8466:6
    #11 0x94ff7b in do_one_cmd /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:2614:2
    #12 0x94ff7b in do_cmdline /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:1000:17
    #13 0x136cde4 in do_source /src/fuzzer13/triage_yeni/vim/src/scriptfile.c:1406:5
    #14 0x13699e1 in cmd_source /src/fuzzer13/triage_yeni/vim/src/scriptfile.c:971:14
    #15 0x13699e1 in ex_source /src/fuzzer13/triage_yeni/vim/src/scriptfile.c:997:2
    #16 0x94ff7b in do_one_cmd /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:2614:2
    #17 0x94ff7b in do_cmdline /src/fuzzer13/triage_yeni/vim/src/ex_docmd.c:1000:17
    #18 0x1bcecfc in exe_commands /src/fuzzer13/triage_yeni/vim/src/main.c:3081:2
    #19 0x1bcecfc in vim_main2 /src/fuzzer13/triage_yeni/vim/src/main.c:773:2
    #20 0x1bc5a8f in main /src/fuzzer13/triage_yeni/vim/src/main.c:425:12
    #21 0x7f3170aab0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #22 0x41f64d in _start (/src/fuzzer13/triage_yeni/vim/src/vim+0x41f64d)

Address 0x7ffe5bab86df is located in stack of thread T0 at offset 12031 in frame
    #0 0x14f007f in suggest_trie_walk /src/fuzzer13/triage_yeni/vim/src/spellsuggest.c:1247

  This frame has 11 object(s):
    [32, 152) 'stack.i.i.i' (line 4307)
    [192, 200) 'p.i.i.i' (line 4316)
    [224, 1240) 'wbadword.i.i.i' (line 4317)
    [1376, 2392) 'wgoodword.i.i.i' (line 4318)
    [2528, 2648) 'stack.i.i' (line 4132)
    [2688, 2942) 'theword.i' (line 3169)
    [3008, 3262) 'cword.i' (line 3267)
    [3328, 3582) 'tword' (line 1248)
    [3648, 11776) 'stack' (line 1249)
    [12032, 12794) 'preword' (line 1250) <== Memory access at offset 12031 underflows this variable
    [12928, 13182) 'compflags' (line 1255)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /src/fuzzer13/triage_yeni/vim/src/spell.c:2668:50 in spell_iswordp
Shadow bytes around the buggy address:
  0x10004b74f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f0b0: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2
  0x10004b74f0c0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
=>0x10004b74f0d0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2[f2]00 00 00 00
  0x10004b74f0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004b74f120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==132419==ABORTING

References:

CWE-121: Stack-based Buffer Overflow - https://cwe.mitre.org/data/definitions/121.html

This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution