libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c.
cpe:2.3:a:leonerd:libvterm:*:*:*:*:*:*:*:*
E906BAA8-91DB-4D6B-901F-DB13B8565FE0
0\+bzr726
OR
Hi, recently I use fuzzing to check the vim and I find an NPD problem.
In **src/libvterm/src/termscreen.c**
<img width="681" alt="image" src="https://user-images.githubusercontent.com/7632714/50393633-728d6700-0792-11e9-8e38-9a10b38c7f0f.png">
This could return a null pointer for the caller function **vterm_obtain_screen** and store in the vt->screen.
<img width="706" alt="image" src="https://user-images.githubusercontent.com/7632714/50393673-bed8a700-0792-11e9-8acd-0a3e552f88e6.png">
This null screen is return to **create_vterm** function in **src/terminal.c**
<img width="889" alt="image" src="https://user-images.githubusercontent.com/7632714/50393689-d6179480-0792-11e9-9888-cc251e0089d5.png">
then again in **vterm_screen_set_callbacks** function defined in **src/libvterm/src/termscreen.c**
<img width="881" alt="image" src="https://user-images.githubusercontent.com/7632714/50393768-65bd4300-0793-11e9-8bed-389cab888d7c.png">
The callback function is set to a null pointer screen.
The potential problem is that you can set a callback function to a predefined NULL memory address which might lead to more problem.

I wonder this is a true problem in vim or not, could you help to verify it?

I am looking forward to your reply!
Possible NPD error 
This is a GitHub Issue
repo:vim
owner:vim
Title : Possible NPD error 
Issue date:

--- start body ---
Hi, recently I use fuzzing to check the vim and I find an NPD problem.
In **src/libvterm/src/termscreen.c**
<img width="681" alt="image" src="https://user-images.githubusercontent.com/7632714/50393633-728d6700-0792-11e9-8e38-9a10b38c7f0f.png">
This could return a null pointer for the caller function **vterm_obtain_screen** and store in the vt->screen.
<img width="706" alt="image" src="https://user-images.githubusercontent.com/7632714/50393673-bed8a700-0792-11e9-8acd-0a3e552f88e6.png">
This null screen is return to **create_vterm** function in **src/terminal.c**
<img width="889" alt="image" src="https://user-images.githubusercontent.com/7632714/50393689-d6179480-0792-11e9-9888-cc251e0089d5.png">
then again in **vterm_screen_set_callbacks** function defined in **src/libvterm/src/termscreen.c**
<img width="881" alt="image" src="https://user-images.githubusercontent.com/7632714/50393768-65bd4300-0793-11e9-8bed-389cab888d7c.png">
The callback function is set to a null pointer screen.
The potential problem is that you can set a callback function to a predefined NULL memory address which might lead to more problem.

I wonder this is a true problem in vim or not, could you help to verify it?

I am looking forward to your reply!
--- end body ---

comments :
--- start comments ---

--- end comments ---