vim: Vim is an improved version of the unix vi text editor

Vim is an improved version of the unix vi text editor. When flushing thetypeahead buffer, Vim moves the current position in the typeahead bufferbut does not check whether there is enough space left in the buffer tohandle the next characters. So this may lead to the tb_off position withinthe typebuf variable to point outside of the valid buffer size, which canthen later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore,when flushing the typeahead buffer, check if there is enough space leftbefore advancing the off position. If not, fall back to flush currenttypebuf contents. It's not quite clear yet, what can lead to thissituation. It seems to happen when error messages occur (which will causeVim to flush the typeahead buffer) in comnination with several longmappgins and so it may eventually move the off position out of a validbuffer size. Impact is low since it is not easily reproducible and requiresto have several mappings active and run into some error condition. But whenthis happens, this will cause a crash. The issue has been fixed as of Vimpatch v9.1.0697. Users are advised to upgrade. There are no knownworkarounds for this issue.

Where it's fixed