Use After Free in vim/vim

An attacker can trigger a use-after-free by crafting a buffer diff scenario where `:diffget` or `:diffput` is invoked, causing `mark_adjust()` to reallocate the diff block list. After `mark_adjust()` returns, the existing `dp` pointer may reference freed memory [ref_id=1]. The code then continues to access `dp->df_count[idx_to]` on the freed memory, leading to a crash or potentially exploitable memory corruption. The attack requires the victim to open a diff view and execute a diffget/diffput command on a crafted buffer.

The vulnerable code is in `ex_diffgetput()` in Vim's diff mode implementation [ref_id=1]. After calling `mark_adjust()`, the function dereferences `dp->df_count[idx_to]` without first verifying that `dp` still points to a valid diff block in the current tab's diff list. The patch introduces a `valid_diff()` helper function that iterates `curtab->tp_first_diff` to check pointer validity.

The patch adds a `valid_diff()` function that walks the current tab's diff block list (`curtab->tp_first_diff`) to verify that `dp` is still a valid entry [ref_id=1]. After `mark_adjust()` is called (when `added != 0`), the code now checks `valid_diff(dp)` and breaks out of the loop if `dp` is no longer valid, preventing access to freed memory. The comment "mark_adjust() may have made 'dp' invalid" is also moved to the correct location — before the validity check — to document the fix [ref_id=1].