Fix bug #9112: There is a test here that seems intended to catch the

case where there are unbalanced braces, but it comes too late. In that
case, we try to check cmd[docstring::npos] and crash.
(cherry picked from commit 6b0a8fbc9614433e7db4e6f994fd62886da8b8eb)

diff --git a/src/Encoding.cpp b/src/Encoding.cpp
index a231106d245a7cfc1d0e6901b08295b406a9967e..bc27675f13f7dad16f822a687aef8227f77e74f8 100644 (file)
--- a/src/Encoding.cpp
+++ b/src/Encoding.cpp
@@ -537,8 +537,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & cmd, int cmdtype,
                if (j + 1 < cmdend && cmd[j + 1] == '{') {
                        size_t k = j + 1;
                        int count = 1;
-                       while (k < cmdend && count && k != docstring::npos) {
+                       while (k < cmdend && count) {
                                k = cmd.find_first_of(from_ascii("{}"), k + 1);
+                               // braces may not be balanced
+                               if (k == docstring::npos)
+                                       break;
                                if (cmd[k] == '{')
                                        ++count;
                                else
@@ -603,8 +606,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & cmd, int cmdtype,
                            k < cmdend && cmd[k] == '{') {
                                size_t l = k;
                                int count = 1;
-                               while (l < cmdend && count && l != docstring::npos) {
+                               while (l < cmdend && count) {
                                        l = cmd.find_first_of(from_ascii("{}"), l + 1);
+                                       // braces may not be balanced
+                                       if (l == docstring::npos)
+                                               break;
                                        if (cmd[l] == '{')
                                                ++count;
                                        else

diff --git a/status.21x b/status.21x
index 07e3e4e9c3a0342ca6fd4cfeb5ee796e61b82436..9f32d4f3c20de29ab3772cc74524ccc6749be866 100644 (file)
--- a/status.21x
+++ b/status.21x
@@ -91,6 +91,8 @@ What's new
 - Fix crash when performing "Change Case" operation on a selection with font
   changes (bug 7943).
 
+- Fix crash involving certain sorts of BibTeX files (bug 9112).
+
 - Fix assertion when entering a path into the import dialog (bug 7437).
 
 - Fix assertion when doing advanced replace with table cells selected (bug