[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - sc/qa svl/source

[Caolán McNamara]

 sc/qa/unit/data/slk/pass/numfmt.slk |    2 ++
 svl/source/numbers/zforscan.cxx     |   19 +++++++++++--------
 2 files changed, 13 insertions(+), 8 deletions(-)

New commits:
commit 40ca8f569c9c7f24e94af3688ff32f5679c2f8f8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Aug 2 09:39:43 2017 +0100

    Resolves: ofz#2833 null deref
    
    Change-Id: I021a716aa76d430a1d3c6fac2dddec4daa01e563
    Reviewed-on: https://gerrit.libreoffice.org/40669
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sc/qa/unit/data/slk/pass/numfmt.slk b/sc/qa/unit/data/slk/pass/numfmt.slk
new file mode 100644
index 000000000000..85ea7b65c8f2
--- /dev/null
+++ b/sc/qa/unit/data/slk/pass/numfmt.slk
@@ -0,0 +1,2 @@
+
+P;Pÿ                           s  ÿ0                                                                  0
\ No newline at end of file
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 363a6219137e..2f08c600730d 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2350,17 +2350,20 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                         nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                         OUString& rStr = sStrArray[i];
                         i++;
-                        nPos = nPos + sStrArray[i].getLength();
-                        nCounter++;
-                        while (i < nAnzStrings &&
-                               sStrArray[i][0] == '0')
+                        if (i < nAnzStrings)
                         {
-                            rStr += sStrArray[i];
                             nPos = nPos + sStrArray[i].getLength();
-                            nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                            nAnzResStrings--;
                             nCounter++;
-                            i++;
+                            while (i < nAnzStrings &&
+                                   sStrArray[i][0] == '0')
+                            {
+                                rStr += sStrArray[i];
+                                nPos = nPos + sStrArray[i].getLength();
+                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                nAnzResStrings--;
+                                nCounter++;
+                                i++;
+                            }
                         }
                     }
                     else