[Libreoffice-commits] core.git: sc/qa svl/source

[Caolán McNamara]

 sc/qa/unit/data/slk/pass/numfmt.slk |    2 ++
 svl/source/numbers/zforscan.cxx     |   19 +++++++++++--------
 2 files changed, 13 insertions(+), 8 deletions(-)

New commits:
commit 0ac1e2ad19d4fdb46dcf54f67db2df081f4675bb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Aug 2 09:39:43 2017 +0100

    Resolves: ofz#2833 null deref
    
    Change-Id: I021a716aa76d430a1d3c6fac2dddec4daa01e563
    Reviewed-on: https://gerrit.libreoffice.org/40667
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/qa/unit/data/slk/pass/numfmt.slk b/sc/qa/unit/data/slk/pass/numfmt.slk
new file mode 100644
index 000000000000..85ea7b65c8f2
--- /dev/null
+++ b/sc/qa/unit/data/slk/pass/numfmt.slk
@@ -0,0 +1,2 @@
+
+P;Pÿ                           s  ÿ0                                                                  0
\ No newline at end of file
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 13c0362e873f..5fe02e7f54c3 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2412,17 +2412,20 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                         nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                         OUString& rStr = sStrArray[i];
                         i++;
-                        nPos = nPos + sStrArray[i].getLength();
-                        nCounter++;
-                        while (i < nAnzStrings &&
-                               sStrArray[i][0] == '0')
+                        if (i < nAnzStrings)
                         {
-                            rStr += sStrArray[i];
                             nPos = nPos + sStrArray[i].getLength();
-                            nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                            nAnzResStrings--;
                             nCounter++;
-                            i++;
+                            while (i < nAnzStrings &&
+                                   sStrArray[i][0] == '0')
+                            {
+                                rStr += sStrArray[i];
+                                nPos = nPos + sStrArray[i].getLength();
+                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                nAnzResStrings--;
+                                nCounter++;
+                                i++;
+                            }
                         }
                     }
                     else