Blame SOURCES/vim-cve3796.patch

85c1c7
diff --git a/src/normal.c b/src/normal.c
85c1c7
index be0e75e..7d62e20 100644
85c1c7
--- a/src/normal.c
85c1c7
+++ b/src/normal.c
85c1c7
@@ -7147,19 +7147,23 @@ nv_replace(cmdarg_T *cap)
85c1c7
 	    {
85c1c7
 		/*
85c1c7
 		 * Get ptr again, because u_save and/or showmatch() will have
85c1c7
-		 * released the line.  At the same time we let know that the
85c1c7
-		 * line will be changed.
85c1c7
+		 * released the line.  This may also happen in ins_copychar().
85c1c7
+		 * At the same time we let know that the line will be changed.
85c1c7
 		 */
85c1c7
-		ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
85c1c7
 		if (cap->nchar == Ctrl_E || cap->nchar == Ctrl_Y)
85c1c7
 		{
85c1c7
 		  int c = ins_copychar(curwin->w_cursor.lnum
85c1c7
 					   + (cap->nchar == Ctrl_Y ? -1 : 1));
85c1c7
+
85c1c7
+		  ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
85c1c7
 		  if (c != NUL)
85c1c7
 		    ptr[curwin->w_cursor.col] = c;
85c1c7
 		}
85c1c7
 		else
85c1c7
+		{
85c1c7
+		    ptr = ml_get_buf(curbuf, curwin->w_cursor.lnum, TRUE);
85c1c7
 		    ptr[curwin->w_cursor.col] = cap->nchar;
85c1c7
+		}
85c1c7
 		if (p_sm && msg_silent == 0)
85c1c7
 		    showmatch(cap->nchar);
85c1c7
 		++curwin->w_cursor.col;
85c1c7
diff --git a/src/testdir/test_edit.vim b/src/testdir/test_edit.vim
85c1c7
index 7278bcd..8818805 100644
85c1c7
--- a/src/testdir/test_edit.vim
85c1c7
+++ b/src/testdir/test_edit.vim
85c1c7
@@ -1387,3 +1387,15 @@ func Test_edit_quit()
85c1c7
   only
85c1c7
 endfunc
85c1c7
 
85c1c7
+" Test for getting the character of the line below after "p"
85c1c7
+func Test_edit_put_CTRL_E()
85c1c7
+  set encoding=latin1
85c1c7
+  new
85c1c7
+  let @" = ''
85c1c7
+  sil! norm or?ggRx
85c1c7
+  sil! norm pr?
85c1c7
+  call assert_equal(['r', 'r'], getline(1, 2))
85c1c7
+  bwipe!
85c1c7
+  set encoding=utf-8
85c1c7
+endfunc
85c1c7
+