[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - sc/qa svl/source

[Caolán McNamara]

 sc/qa/unit/data/slk/pass/numfmt-2.slk |    1 +
 svl/source/numbers/zforscan.cxx       |   19 +++++++++++--------
 2 files changed, 12 insertions(+), 8 deletions(-)

New commits:
commit bd0c6fb52bd7af947936f736c7357200e2d17fc2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Aug 5 19:15:36 2017 +0100

    ofz#2867 null deref
    
    Reviewed-on: https://gerrit.libreoffice.org/40792
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 42b894f80a6d0c39bb0f7092eb204a15c22c4f38)
    
    Change-Id: If856473683685d79d88b024f7fafa2920b403bb7
    Reviewed-on: https://gerrit.libreoffice.org/40793
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sc/qa/unit/data/slk/pass/numfmt-2.slk b/sc/qa/unit/data/slk/pass/numfmt-2.slk
new file mode 100644
index 000000000000..5989cdc3e64e
--- /dev/null
+++ b/sc/qa/unit/data/slk/pass/numfmt-2.slk
@@ -0,0 +1 @@
+P;Pÿ                                                               ÿ  ÿ                    ÿ  ÿ  dÿ Sÿ0
\ No newline at end of file
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index e1187ffae7dd..5a5019d12e7c 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2562,17 +2562,20 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                             nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                             OUString& rStr = sStrArray[i];
                             i++;
-                            nPos = nPos + sStrArray[i].getLength();
-                            nCounter++;
-                            while (i < nAnzStrings &&
-                                   sStrArray[i][0] == '0')
+                            if (i < nAnzStrings)
                             {
-                                rStr += sStrArray[i];
                                 nPos = nPos + sStrArray[i].getLength();
-                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                                nAnzResStrings--;
                                 nCounter++;
-                                i++;
+                                while (i < nAnzStrings &&
+                                       sStrArray[i][0] == '0')
+                                {
+                                    rStr += sStrArray[i];
+                                    nPos = nPos + sStrArray[i].getLength();
+                                    nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                    nAnzResStrings--;
+                                    nCounter++;
+                                    i++;
+                                }
                             }
                         }
                         else