[Libreoffice-commits] core.git: sc/qa svl/source

[Caolán McNamara]

 sc/qa/unit/data/slk/pass/numfmt-2.slk |    1 +
 svl/source/numbers/zforscan.cxx       |   19 +++++++++++--------
 2 files changed, 12 insertions(+), 8 deletions(-)

New commits:
commit 42b894f80a6d0c39bb0f7092eb204a15c22c4f38
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Aug 5 19:15:36 2017 +0100

    ofz#2867 null deref
    
    Change-Id: If856473683685d79d88b024f7fafa2920b403bb7
    Reviewed-on: https://gerrit.libreoffice.org/40792
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/qa/unit/data/slk/pass/numfmt-2.slk b/sc/qa/unit/data/slk/pass/numfmt-2.slk
new file mode 100644
index 000000000000..5989cdc3e64e
--- /dev/null
+++ b/sc/qa/unit/data/slk/pass/numfmt-2.slk
@@ -0,0 +1 @@
+P;Pÿ                                                               ÿ  ÿ                    ÿ  ÿ  dÿ Sÿ0
\ No newline at end of file
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 449d6d7ad9fe..77e0f75c4afc 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2565,17 +2565,20 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                             nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                             OUString& rStr = sStrArray[i];
                             i++;
-                            nPos = nPos + sStrArray[i].getLength();
-                            nCounter++;
-                            while (i < nStringsCnt &&
-                                   sStrArray[i][0] == '0')
+                            if (i < nStringsCnt)
                             {
-                                rStr += sStrArray[i];
                                 nPos = nPos + sStrArray[i].getLength();
-                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                                nResultStringsCnt--;
                                 nCounter++;
-                                i++;
+                                while (i < nStringsCnt &&
+                                       sStrArray[i][0] == '0')
+                                {
+                                    rStr += sStrArray[i];
+                                    nPos = nPos + sStrArray[i].getLength();
+                                    nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                    nResultStringsCnt--;
+                                    nCounter++;
+                                    i++;
+                                }
                             }
                         }
                         else