Use of Out-of-range Pointer Offset in vim/vim

An attacker can craft a sequence of Vim commands that triggers the use of a quickfix buffer after it has been wiped. The test case in the patch shows a reproduction: calling a function that opens a quickfix list (`tab lopen`), editing a file, and then using `bwipe` while switching windows. This causes `do_buffer_ext()` to select a quickfix buffer that is about to be deleted, leading to an out-of-range pointer offset when the buffer's memory is accessed after deallocation [ref_id=1].

The vulnerability is in the `do_buffer_ext()` function in Vim's buffer management code. The patch modifies multiple locations within this function where buffer selection logic failed to exclude quickfix buffers, which could be deleted soon after being referenced.

The patch adds `bt_quickfix(buf)` checks at four points in `do_buffer_ext()` to skip quickfix buffers when selecting the next buffer to switch to. The commit message explains: "Skip current and unlisted bufs. Also skip a quickfix buffer, it might be deleted soon" [ref_id=1]. This prevents the function from returning a pointer to a quickfix buffer that could be wiped before it is used, closing the use-after-free / out-of-range pointer offset.

The patch includes a test function `Test_lopen_bwipe_all()` that reproduces the issue [ref_id=1]:

1. Create a Vim script with a function `R()` that runs `silent! tab lopen`, `e foo`, and `silent! lfile`. 2. Call `R()`, then execute `exe "norm \<C-W>\<C-V>0"` to split the window, then call `R()` again. 3. Run `bwipe` to wipe the current buffer. 4. Without the fix, this sequence causes all buffers to be wiped out, triggering the out-of-range pointer offset.