Use After Free in vim/vim

An attacker can trigger a use-after-free by crafting a buffer that causes Vim's spell-checking logic to call `ml_get_buf()` while iterating over lines. As noted in the patch comment at [ref_id=1], "this ml_get_buf() may make 'line' invalid." After that call, the code continues to use the now-stale `line` pointer (e.g., at the original `*skipwhite(line) == NUL` check), reading freed memory. The attacker needs to supply a text file with specific line lengths and spell-checking conditions that force the internal buffer reallocation during the `ml_get_buf()` call.

The vulnerability is in the `spell_move_to()` function in Vim's spell-checking code. The patch modifies `src/spell.c` (referenced via the commit at [ref_id=1]), specifically around line 1275 where `hlf_T attr` is initialized to 0, and around lines 1308-1497 where an `empty_line` variable is introduced to capture the line state before a subsequent `ml_get_buf()` call may invalidate the `line` pointer.

The patch fixes the use-after-free by saving the result of `*skipwhite(line) == NUL` into a local `empty_line` variable *before* the `ml_get_buf()` call that can invalidate `line`. The later check `if (*skipwhite(line) == NUL)` is replaced with `if (empty_line)`, so the stale pointer is never dereferenced. Additionally, `hlf_T attr` is initialized to 0 to prevent use of an uninitialized value. No advisory or additional fix documentation beyond this commit is present in the bundle.