From: Stephan Witt <switt@lyx.org>
Date: Sat, 8 Feb 2020 15:33:51 +0000 (+0100)
Subject: Fix a crash with uninitialized buffer member of MathData
X-Git-Tag: 2.3.5~102
X-Git-Url: https://git.lyx.org/gitweb/?a=commitdiff_plain;h=058283515a5601e99494c0496f45b616b0fff436;p=features.git

Fix a crash with uninitialized buffer member of MathData

See the details here: https://www.mail-archive.com/lyx-devel@lists.lyx.org/msg210294.html
---

diff --git a/src/mathed/InsetMathNest.cpp b/src/mathed/InsetMathNest.cpp
index bc3c2add0e..db03dabcaf 100644
--- a/src/mathed/InsetMathNest.cpp
+++ b/src/mathed/InsetMathNest.cpp
@@ -1232,10 +1232,12 @@ void InsetMathNest::doDispatch(Cursor & cur, FuncRequest & cmd)
 		cur.recordUndoSelection();
 		if (cmd.argument() == "^" || cmd.argument() == "_")
 			interpretChar(cur, cmd.argument()[0]);
+		else if (!cur.selection())
+			cur.niceInsert(cmd.argument());
 		else {
-			MathData ar;
+			MathData ar(cur.buffer());
 			asArray(cmd.argument(), ar);
-			if (cur.selection() && ar.size() == 1
+			if (ar.size() == 1
 			    && ar[0]->asNestInset()
 			    && ar[0]->asNestInset()->nargs() > 1)
 				handleNest(cur, ar[0]);
diff --git a/status.23x b/status.23x
index f93844e61e..147b17bad7 100644
--- a/status.23x
+++ b/status.23x
@@ -53,7 +53,6 @@ What's new
 
 - Correctly strike out deleted text after deleted display math (bug 11716).
 
-
 * USER INTERFACE
 
 - Fix backspace deletion of selected items with change tracking (bug 11630).
@@ -65,6 +64,9 @@ What's new
 
 - Properly resize columns of child document table widget.
 
+- Fix a crash reported on lyx users.
+  There was an uninitialized buffer member of MathData in LFUN dispatch.
+
 
 * INTERNALS