patch 9.2.1248: invalid memory access when converting a tuple to a string fails

Problem:  Invalid memory access when allocating memory fails while
          converting a tuple to a string.
Solution: Check the return value of ga_grow() in tuple_join_inner()
          and free the item string (Yegappan Lakshmanan).

The result of ga_grow() was ignored and the next item was written to
the unallocated array.  Use ga_grow_id() so that the allocation failure
can be tested.

closes: #21598

Assisted-by: Claude Code (Claude Opus 5.5)
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/tuple.c

@@ -677,7 +677,11 @@ tuple_join_inner(
 	s.length = STRLEN(s.string);
 	sumlen += (int)s.length;
 
-	(void)ga_grow(join_gap, 1);
+	if (ga_grow(join_gap, 1) == FAIL)
+	{
+	    vim_free(tofree);
+	    return FAIL;
+	}
 	p = ((join_T *)join_gap->ga_data) + (join_gap->ga_len++);
 	if (tofree != NULL || s.string != numbuf)
 	{

src/version.c

@@ -743,6 +743,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1248,
 /**/
     1247,
 /**/