Blame SOURCES/0001-patch-8.2.4151-reading-beyond-the-end-of-a-line.patch

13ea7f
diff --git a/src/ops.c b/src/ops.c
13ea7f
index 88992b6..80e0ea1 100644
13ea7f
--- a/src/ops.c
13ea7f
+++ b/src/ops.c
13ea7f
@@ -527,24 +527,8 @@ block_insert(
13ea7f
 	}
13ea7f
 
13ea7f
 	if (has_mbyte && spaces > 0)
13ea7f
-	{
13ea7f
-	    int off;
13ea7f
-
13ea7f
-	    // Avoid starting halfway a multi-byte character.
13ea7f
-	    if (b_insert)
13ea7f
-	    {
13ea7f
-		off = (*mb_head_off)(oldp, oldp + offset + spaces);
13ea7f
-		spaces -= off;
13ea7f
-		count -= off;
13ea7f
-	    }
13ea7f
-	    else
13ea7f
-	    {
13ea7f
-		// spaces fill the gap, the character that's at the edge moves
13ea7f
-		// right
13ea7f
-		off = (*mb_head_off)(oldp, oldp + offset);
13ea7f
-		offset -= off;
13ea7f
-	    }
13ea7f
-	}
13ea7f
+	    // avoid copying part of a multi-byte character
13ea7f
+	    offset -= (*mb_head_off)(oldp, oldp + offset);
13ea7f
 
13ea7f
 	// Make sure the allocated size matches what is actually copied below.
13ea7f
 	newp = alloc(STRLEN(oldp) + spaces + s_len
13ea7f
diff --git a/src/testdir/test_utf8.vim b/src/testdir/test_utf8.vim
13ea7f
index 5454e43..bedec20 100644
13ea7f
--- a/src/testdir/test_utf8.vim
13ea7f
+++ b/src/testdir/test_utf8.vim
13ea7f
@@ -7,7 +7,7 @@ func Test_visual_block_insert()
13ea7f
   new
13ea7f
   call setline(1, ["aaa", "あああ", "bbb"])
13ea7f
   exe ":norm! gg0l\<C-V>jjIx\<Esc>"
13ea7f
-  call assert_equal(['axaa', 'xあああ', 'bxbb'], getline(1, '$'))
13ea7f
+  call assert_equal(['axaa', ' xあああ', 'bxbb'], getline(1, '$'))
13ea7f
   bwipeout!
13ea7f
 endfunc
13ea7f
 
13ea7f
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
13ea7f
index dc8e376..8de9e3d 100644
13ea7f
--- a/src/testdir/test_visual.vim
13ea7f
+++ b/src/testdir/test_visual.vim
13ea7f
@@ -976,4 +976,13 @@ func Test_visual_block_append_invalid_char()
13ea7f
   bwipe!
13ea7f
 endfunc
13ea7f
 
13ea7f
+func Test_visual_block_insert_round_off()
13ea7f
+  new
13ea7f
+  " The number of characters are tuned to fill a 4096 byte allocated block,
13ea7f
+  " so that valgrind reports going over the end.
13ea7f
+  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
13ea7f
+  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
13ea7f
+  bwipe!
13ea7f
+endfunc
13ea7f
+
13ea7f
 " vim: shiftwidth=2 sts=2 expandtab