# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1488114904 -3600
# Node ID ab9f7bbe443900f60e28fbc4b6ab018708d5d0de
# Parent  beefabd60ec9df5ab90930901687d8e3786fc4b1
patch 8.0.0374: invalid memory access when using :sc in Ex mode

commit https://github.com/vim/vim/commit/ba748c8a847561c043a63827bcb1d98bdebe16e6
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sun Feb 26 14:00:07 2017 +0100

    patch 8.0.0374: invalid memory access when using :sc in Ex mode

    Problem:    Invalid memory access when using :sc in Ex mode. (Dominique Pelle)
    Solution:   Avoid the column being negative.  Also fix a hang in Ex mode.

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -5288,6 +5288,8 @@ do_sub(exarg_T *eap)
 
 			    getvcol(curwin, &curwin->w_cursor, &sc, NULL, NULL);
 			    curwin->w_cursor.col = regmatch.endpos[0].col - 1;
+			    if (curwin->w_cursor.col < 0)
+				curwin->w_cursor.col = 0;
 			    getvcol(curwin, &curwin->w_cursor, NULL, NULL, &ec);
 			    if (subflags.do_number || curwin->w_p_nu)
 			    {
diff --git a/src/ex_getln.c b/src/ex_getln.c
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -2369,9 +2369,16 @@ getexmodeline(
 	if (ga_grow(&line_ga, 40) == FAIL)
 	    break;
 
-	/* Get one character at a time. */
+	/*
+	 * Get one character at a time.
+	 */
 	prev_char = c1;
-	c1 = vgetc();
+
+	/* Check for a ":normal" command and no more characters left. */
+	if (ex_normal_busy > 0 && typebuf.tb_len == 0)
+	    c1 = '\n';
+	else
+	    c1 = vgetc();
 
 	/*
 	 * Handle line editing.
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -106,3 +106,11 @@ function! Test_substitute_variants()
     endfor
   endfor
 endfunction
+
+func Test_substitute_repeat()
+  " This caused an invalid memory access.
+  split Xfile
+  s/^/x
+  call feedkeys("Qsc\<CR>y", 'tx')
+  bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    374,
+/**/
     373,
 /**/
     372,