patch 8.2.4151: reading beyond the end of a linev8.2.4151

Problem:    Reading beyond the end of a line.
Solution:   For block insert only use the offset for correcting the length.

3 files changed, 13 insertions, 17 deletions

diff --git a/src/ops.c b/src/ops.c
index a99680249..e0fa344d8 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -529,24 +529,9 @@ block_insert(
 	}
 
 	if (has_mbyte && spaces > 0)
-	{
-	    int off;
+	    // avoid copying part of a multi-byte character
+	    offset -= (*mb_head_off)(oldp, oldp + offset);
 
-	    // Avoid starting halfway a multi-byte character.
-	    if (b_insert)
-	    {
-		off = (*mb_head_off)(oldp, oldp + offset + spaces);
-		spaces -= off;
-		count -= off;
-	    }
-	    else
-	    {
-		// spaces fill the gap, the character that's at the edge moves
-		// right
-		off = (*mb_head_off)(oldp, oldp + offset);
-		offset -= off;
-	    }
-	}
 	if (spaces < 0)  // can happen when the cursor was moved
 	    spaces = 0;
 
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index b438fa1e6..a187aa8e0 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -1309,5 +1309,14 @@ func Test_visual_reselect_with_count()
   call delete('XvisualReselect')
 endfunc
 
+func Test_visual_block_insert_round_off()
+  new
+  " The number of characters are tuned to fill a 4096 byte allocated block,
+  " so that valgrind reports going over the end.
+  call setline(1, ['xxxxx', repeat('0', 1350), "\t", repeat('x', 60)])
+  exe "normal gg0\<C-V>GI" .. repeat('0', 1320) .. "\<Esc>"
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 53f1619f9..227eaa958 100644
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4151,
+/**/
     4150,
 /**/
     4149,