vim-9.1.1016 (sync with lfs)

[Bruce Dubbs]

LFS has been updated.

[Douglas R. Reno]

heap-buffer-overflow with visual mode in Vim < 9.1.1003
=======================================================
Date: 11.01.2025
Severity: Medium
CVE: CVE-2025-22134
CWE: Heap-based Buffer Overflow (CWE-122)

When switching to other buffers using the :all command and visual mode
still being active, this may cause a heap-buffer overflow, because Vim
does not properly end visual mode and therefore may try to access
beyond the end of a line in a buffer.

In Patch 9.1.1003 Vim will correctly reset the visual mode before
opening other windows and buffers and therefore fix this bug.  In
addition it does verify that it won't try to access a position if the
position is greater than the corresponding buffer line.

Impact is medium since the user must have switched on visual mode when
executing the :all ex command.

The issue has been fixed as of Vim patch v9.1.1003

The Vim project would like to thank github user gandalf4a for reporting
this issue.

References:
https://github.com/vim/vim/commit/c9a1e257f1630a0866447e53a564f7ff96a80ead
https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8

[Douglas R. Reno]

Fixed at 05a89c49f68b6b17c5b0b397de1cf8c0

SA-12.2-067 issued