commit b17802ba81b4a71e9a2b05eea8c0e76589a66f4b
Author: Richard Heck <[email protected]>
Date:   Thu May 8 18:19:55 2014 -0400

    Fix bug #9112: There is a test here that seems intended to catch the
    case where there are unbalanced braces, but it comes too late. In that
    case, we try to check cmd[docstring::npos] and crash.
    (cherry picked from commit 6b0a8fbc9614433e7db4e6f994fd62886da8b8eb)

diff --git a/src/Encoding.cpp b/src/Encoding.cpp
index a231106..bc27675 100644
--- a/src/Encoding.cpp
+++ b/src/Encoding.cpp
@@ -537,8 +537,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & 
cmd, int cmdtype,
                if (j + 1 < cmdend && cmd[j + 1] == '{') {
                        size_t k = j + 1;
                        int count = 1;
-                       while (k < cmdend && count && k != docstring::npos) {
+                       while (k < cmdend && count) {
                                k = cmd.find_first_of(from_ascii("{}"), k + 1);
+                               // braces may not be balanced
+                               if (k == docstring::npos)
+                                       break;
                                if (cmd[k] == '{')
                                        ++count;
                                else
@@ -603,8 +606,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & 
cmd, int cmdtype,
                            k < cmdend && cmd[k] == '{') {
                                size_t l = k;
                                int count = 1;
-                               while (l < cmdend && count && l != 
docstring::npos) {
+                               while (l < cmdend && count) {
                                        l = cmd.find_first_of(from_ascii("{}"), 
l + 1);
+                                       // braces may not be balanced
+                                       if (l == docstring::npos)
+                                               break;
                                        if (cmd[l] == '{')
                                                ++count;
                                        else
diff --git a/status.21x b/status.21x
index 07e3e4e..9f32d4f 100644
--- a/status.21x
+++ b/status.21x
@@ -91,6 +91,8 @@ What's new
 - Fix crash when performing "Change Case" operation on a selection with font
   changes (bug 7943).
 
+- Fix crash involving certain sorts of BibTeX files (bug 9112).
+
 - Fix assertion when entering a path into the import dialog (bug 7437).
 
 - Fix assertion when doing advanced replace with table cells selected (bug

Reply via email to