commit aee0babb24f18c6f47f315ffce504e0b49363a68
author Eike Rathke <erack@redhat.com> Wed Jan 16 18:19:54 2019 +0100
committer Eike Rathke <erack@redhat.com> Thu Jan 17 19:09:57 2019 +0100
tree d33460db7dbed6b231cf8537e9bba5cf48cd4915
parent 7d4859d1bd07fc316c67f79b5c54f6c4b0627c3c

Related: tdf#122509 prevent access of not existing base format

Call to pFormat->HasPositiveBracketPlaceholder() with nullptr as
obtained for the not existing nIndex was the immediate cause of
the crash.

Also obtain the type from the format if found instead of the
separate GetType() call that again would need to find the format
first. This clarifies that the other places accessing pFormat
don't need additional checks because eType isn't UNDEFINED there.

Reviewed-on: https://gerrit.libreoffice.org/66476
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins

According to
https://crashreport.libreoffice.org/stats/signature/SvNumberformat::HasPositiveBracketPlaceholder()
this occasionally happened in ~all releases, independent of the
circumstances in tdf#122509, so let's backport to available release.

Change-Id: I5d78ad73eeb4c3820c45d6a91b0e729ed22951a4
Reviewed-on: https://gerrit.libreoffice.org/66520
Tested-by: Jenkins
Reviewed-by: Eike Rathke <erack@redhat.com>

svl/source/numbers/zforlist.cxx

diff --git a/svl/source/numbers/zforlist.cxx b/svl/source/numbers/zforlist.cxx
index aab66e2..82727dd 100644
--- a/svl/source/numbers/zforlist.cxx
+++ b/svl/source/numbers/zforlist.cxx
@@ -2868,7 +2868,10 @@ OUString SvNumberFormatter::GenerateFormat(sal_uInt32 nIndex,
    {
        eLnge = IniLnge;
    }
    SvNumFormatType eType = GetType(nIndex);

    const SvNumberformat* pFormat = GetFormatEntry( nIndex );
    const SvNumFormatType eType = (pFormat ? pFormat->GetMaskedType() : SvNumFormatType::UNDEFINED);

    ImpGenerateCL(eLnge);           // create new standard formats if necessary

    utl::DigitGroupingIterator aGrouping( xLocaleData->getDigitGrouping());
@@ -2876,8 +2879,6 @@ OUString SvNumberFormatter::GenerateFormat(sal_uInt32 nIndex,
    const sal_Int32 nDigitsInFirstGroup = ( bThousand && (eType == SvNumFormatType::SCIENTIFIC) ) ? 3 : aGrouping.get();
    const OUString& rThSep = GetNumThousandSep();

    SvNumberformat* pFormat = GetFormatEntry( nIndex );

    OUStringBuffer sString;
    using comphelper::string::padToLength;

@@ -3025,7 +3026,7 @@ OUString SvNumberFormatter::GenerateFormat(sal_uInt32 nIndex,
        {
            OUStringBuffer sTmpStr(sString);

            if ( pFormat->HasPositiveBracketPlaceholder() )
            if (pFormat && pFormat->HasPositiveBracketPlaceholder())
            {
                 sTmpStr.append('_');
                 sTmpStr.append(')');