diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 5b118e5..c38687d 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -5288,6 +5288,8 @@
 
 			    getvcol(curwin, &curwin->w_cursor, &sc, NULL, NULL);
 			    curwin->w_cursor.col = regmatch.endpos[0].col - 1;
+			    if (curwin->w_cursor.col < 0)
+				curwin->w_cursor.col = 0;
 			    getvcol(curwin, &curwin->w_cursor, NULL, NULL, &ec);
 			    if (subflags.do_number || curwin->w_p_nu)
 			    {
diff --git a/src/ex_getln.c b/src/ex_getln.c
index 3c40ff7..9180319 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -2369,9 +2369,16 @@
 	if (ga_grow(&line_ga, 40) == FAIL)
 	    break;
 
-	/* Get one character at a time. */
+	/*
+	 * Get one character at a time.
+	 */
 	prev_char = c1;
-	c1 = vgetc();
+
+	/* Check for a ":normal" command and no more characters left. */
+	if (ex_normal_busy > 0 && typebuf.tb_len == 0)
+	    c1 = '\n';
+	else
+	    c1 = vgetc();
 
 	/*
 	 * Handle line editing.
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index a3bc04d..f2dfdc7 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -106,3 +106,11 @@
     endfor
   endfor
 endfunction
+
+func Test_substitute_repeat()
+  " This caused an invalid memory access.
+  split Xfile
+  s/^/x
+  call feedkeys("Qsc\<CR>y", 'tx')
+  bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
index b008d14..b96daff 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    374,
+/**/
     373,
 /**/
     372,