diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 7cf63adaf9..3a598ddfa0 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -4144,6 +4144,8 @@ ex_substitute(exarg_T *eap)
 	pat = NULL;		// search_regcomp() will use previous pattern
 	patlen = 0;
 	sub = vim_strsave(old_sub);
+	if (sub == NULL)
+	    return;
 
 	// Vi compatibility quirk: repeating with ":s" keeps the cursor in the
 	// last column after using "$".
@@ -5003,6 +5005,12 @@ ex_substitute(exarg_T *eap)
 		    vim_free(sub_firstline);
 		    sub_firstline = vim_strnsave(ml_get(sub_firstlnum),
 						    ml_get_len(sub_firstlnum));
+		    if (sub_firstline == NULL)
+		    {
+			vim_free(new_start);
+			goto outofmem;
+		    }
+
 		    // When going beyond the last line, stop substituting.
 		    if (sub_firstlnum <= line2)
 			do_again = TRUE;
@@ -5019,6 +5027,11 @@ ex_substitute(exarg_T *eap)
 		    // less than what it ought to be.
 		    vim_free(sub_firstline);
 		    sub_firstline = vim_strsave((char_u *)"");
+		    if (sub_firstline == NULL)
+		    {
+			vim_free(new_start);
+			goto outofmem;
+		    }
 		    copycol = 0;
 		}
 
diff --git a/src/version.c b/src/version.c
index 175d7ab57c..91bfa5761c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    526,
 /**/
     525,
 /**/