From 1c73b65229c25e3c1fd8824ba958f7cc4d604f9c Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 3 Mar 2023 21:11:52 +0000
Subject: [PATCH] patch 9.0.1376: accessing invalid memory with put in Visual
 block mode

Problem:    Accessing invalid memory with put in Visual block mode.
Solution:   Adjust the cursor column if needed.
---
 src/register.c           | 11 ++++++++++-
 src/testdir/test_put.vim | 11 +++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/register.c b/src/register.c
index 4dc0a68fd7a4..461363be378d 100644
--- a/src/register.c
+++ b/src/register.c
@@ -1913,7 +1913,7 @@ do_put(
 		ptr += yanklen;
 
 		// insert block's trailing spaces only if there's text behind
-		if ((j < count - 1 || !shortline) && spaces)
+		if ((j < count - 1 || !shortline) && spaces > 0)
 		{
 		    vim_memset(ptr, ' ', (size_t)spaces);
 		    ptr += spaces;
@@ -2274,6 +2274,15 @@ do_put(
     msgmore(nr_lines);
     curwin->w_set_curswant = TRUE;
 
+    // Make sure the cursor is not after the NUL.
+    int len = (int)STRLEN(ml_get_curline());
+    if (curwin->w_cursor.col > len)
+    {
+	if (cur_ve_flags == VE_ALL)
+	    curwin->w_cursor.coladd = curwin->w_cursor.col - len;
+	curwin->w_cursor.col = len;
+    }
+
 end:
     if (cmdmod.cmod_flags & CMOD_LOCKMARKS)
     {
diff --git a/src/testdir/test_put.vim b/src/testdir/test_put.vim
index 66438bd3f69c..a6cea74efb6c 100644
--- a/src/testdir/test_put.vim
+++ b/src/testdir/test_put.vim
@@ -231,5 +231,16 @@ func Test_put_visual_mode()
   set selection&
 endfunc
 
+func Test_put_visual_block_mode()
+  enew
+  exe "norm 0R\<CR>\<C-C>V"
+  sil exe "norm \<C-V>c	\<MiddleDrag>"
+  set ve=all
+  sil norm vz=p
+
+  bwipe!
+  set ve=
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab