Heap-based Buffer Overflow

Summary

Vim is an improved version of the unix vi text editor. When flushing the "typeahead" buffer, Vim moves the current position in the "typeahead" buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the "tb_off" position within the "typebuf" variable to point outside of the valid buffer size, which can then later lead to a heap buffer overflow in e.g. "ins_typebuf()". Therefore, when flushing the "typeahead" buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current "typebuf" contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in combination with several long mappings and so it may eventually move the off position out of a valid buffer size. The impact is low since it is not easily reproducible and requires several mappings active and run into some error conditions. But when this happens, it will cause a crash. This issue affects vim versions prior to 9.1.0697.