Use of Out-of-range Pointer Offset in vim/vim

An attacker can trigger this vulnerability by opening a file or typing a command containing a specially crafted multi-byte character (e.g., "űŤŤŤ¦*") in a context where Vim performs wildcard expansion with `'wildignorecase'` enabled. The `isalpha()` call on the lead byte of such a character can return a negative value, which is then used as an out-of-range pointer offset, leading to a crash [ref_id=1]. The test added in the patch shows the crash is reproducible with the command `tc űŤŤŤ¦*` when `'wic'` (wildignorecase) is set [ref_id=1].

The vulnerable code is in `src/misc2.c` (now `src/charclass.c`) in the `unix_expandpath()` function, where `isalpha(PTR2CHAR(path_end))` is called on a multi-byte character's lead byte [ref_id=1]. The patch also adds the new `vim_isalpha()` function to `src/proto/charclass.pro` and the test to `src/testdir/test_cmdline.vim` [ref_id=1].

The patch replaces the C library `isalpha()` call with a new `vim_isalpha()` function that internally calls `vim_islower()` and `vim_isupper()`, which are already safe for multi-byte characters [ref_id=1]. This ensures the character classification works correctly on multi-byte lead bytes and never returns a negative value that could be used as an out-of-range pointer offset. The fix also adds a test case (`Test_multibyte`) that verifies the crash no longer occurs [ref_id=1].

1. Run Vim with a version prior to 8.2.4418. 2. Execute the command: `:set wic` 3. Execute the command: `:tc űŤŤŤ¦*` 4. Vim will crash with an out-of-range pointer offset [ref_id=1].