[Libreoffice-commits] core.git: sc/source

[Eike Rathke]

 sc/source/core/tool/rangelst.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit f59cf3874a91158e82fc9d09d28d23e053ad06a3
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Mar 13 22:23:31 2018 +0100

    ofz#6845 use of "deleted" ScRange
    
    If nOverPos<i and i was last element, the next pOver=&rRange was
    invalid, though not deleted because std::vector::erase() does not
    reallocate.
    
    Change-Id: I22d9302e2d45403dd47ac1947d2cf003b3a4f291

diff --git a/sc/source/core/tool/rangelst.cxx b/sc/source/core/tool/rangelst.cxx
index 3b68a8fd5032..84c6764ab79a 100644
--- a/sc/source/core/tool/rangelst.cxx
+++ b/sc/source/core/tool/rangelst.cxx
@@ -320,7 +320,11 @@ Label_Range_Join:
             if ( bIsInList )
             {   // delete range pOver within the list
                 if (nOverPos != std::numeric_limits<size_t>::max())
+                {
                     Remove(nOverPos);
+                    if (nOverPos < i)
+                        --i;
+                }
                 else
                 {
                     for (size_t nOver = 0, nRanges = maRanges.size(); nOver < nRanges; ++nOver)
@@ -334,7 +338,7 @@ Label_Range_Join:
                 }
             }
             bJoinedInput = true;
-            pOver = &rRange;
+            pOver = &maRanges[i];
             bIsInList = true;
             goto Label_Range_Join;
         }