tdf#118442: Fix incorrect index calculation

If a number string has leading spaces and/or minus, then calculating
index into the aBuf as the difference between p and pStart gives
wrong (too big) number. This asserts in debug builds, when e.g. an
assignment is made in a BASIC macro:

  Dim f As Double
  f = " -12.20"

"include/rtl/ustrbuf.hxx:490:
sal_Unicode &rtl::OUStringBuffer::operator[](sal_Int32):
Assertion `index >= 0 && index < pData->length' failed."

This affects, e.g., https://gerrit.libreoffice.org/56610 (see
https://ci.libreoffice.org/job/gerrit_linux_clang_dbgutil/9527/consoleFull#1820989527d893063f-7f3d-4b7e-b56f-4e0f225817cd)

Change-Id: I14654166be721907e2a26ea6f4091f203a9437d7
Reviewed-on: https://gerrit.libreoffice.org/56611
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Tested-by: Jenkins
(cherry picked from commit b24b0b9856b42eb6598c053703a11f86b6a6346c)
Reviewed-on: https://gerrit.libreoffice.org/56755

2 files changed, 67 insertions, 2 deletions

diff --git a/basic/qa/basic_coverage/test_types_conversion.vb b/basic/qa/basic_coverage/test_types_conversion.vb
new file mode 100644
index 000000000000..0de109bc984f
--- /dev/null
+++ b/basic/qa/basic_coverage/test_types_conversion.vb
@@ -0,0 +1,63 @@
+'
+' This file is part of the LibreOffice project.
+'
+' This Source Code Form is subject to the terms of the Mozilla Public
+' License, v. 2.0. If a copy of the MPL was not distributed with this
+' file, You can obtain one at http://mozilla.org/MPL/2.0/.
+'
+Option Explicit
+
+Dim nTotalCount As Integer
+Dim nPassCount As Integer
+Dim nFailCount As Integer
+
+Function doUnitTest() As Integer
+    nTotalCount = 0
+    nPassCount = 0
+    nFailCount = 0
+
+    ' Test implicit conversions from string to number
+    Dim nVal As Double
+    ' Simple integer
+    StartTest()
+    nVal = "123"
+    AssertTest(nVal = 123)
+
+    ' Negative integer
+    StartTest()
+    nVal = "-123"
+    AssertTest(nVal = -123)
+
+    ' Negative floating-point
+    StartTest()
+    nVal = "-123.45"
+    AssertTest(nVal = -123.45)
+
+    ' Negative floating-point with leading and trailing spaces
+    StartTest()
+    nVal = " -123.45 "
+    AssertTest(nVal = -123.45)
+
+    ' Wrong decimal separator
+    StartTest()
+    nVal = " -123,45 "
+    AssertTest(nVal = -123)
+
+    If ((nFailCount > 0) Or (nPassCount <> nTotalCount)) Then
+        doUnitTest = 0
+    Else
+        doUnitTest = 1
+    End If
+End Function
+
+Sub StartTest()
+    nTotalCount = nTotalCount + 1
+End Sub
+
+Sub AssertTest(testResult As Boolean)
+    If (testResult) Then
+        nPassCount = nPassCount + 1
+    Else
+        nFailCount = nFailCount + 1
+    End If
+End Sub
diff --git a/basic/source/sbx/sbxscan.cxx b/basic/source/sbx/sbxscan.cxx
index 3003906678d1..7f9b4931ea48 100644
--- a/basic/source/sbx/sbxscan.cxx
+++ b/basic/source/sbx/sbxscan.cxx
@@ -120,6 +120,8 @@ ErrCode ImpScan( const OUString& rWSrc, double& nVal, SbxDataType& rType,
                     (cIntntlDecSep && *p == cIntntlGrpSep) || (cIntntlDecSepAlt && *p == cIntntlDecSepAlt)) &&
                 rtl::isAsciiDigit( *(p+1) )))
     {
+        // tdf#118442: Whitespace and minus are skipped; store the position to calculate index
+        const sal_Unicode* const pDigitsStart = p;
         short exp = 0;
         short decsep = 0;
         short ndig = 0;
@@ -145,7 +147,7 @@ ErrCode ImpScan( const OUString& rWSrc, double& nVal, SbxDataType& rType,
             if( *p == cNonIntntlDecSep || *p == cIntntlDecSep || (cIntntlDecSepAlt && *p == cIntntlDecSepAlt) )
             {
                 // Use the separator that is passed to stringToDouble()
-                aBuf[ p - pStart ] = cIntntlDecSep;
+                aBuf[p - pDigitsStart] = cIntntlDecSep;
                 p++;
                 if( ++decsep > 1 )
                     continue;
@@ -159,7 +161,7 @@ ErrCode ImpScan( const OUString& rWSrc, double& nVal, SbxDataType& rType,
                 }
                 if( *p == 'D' || *p == 'd' )
                     eScanType = SbxDOUBLE;
-                aBuf[ p - pStart ] = 'E';
+                aBuf[p - pDigitsStart] = 'E';
                 p++;
                 if (*p == '+')
                     ++p;