ofz#6845 use of "deleted" ScRange

If nOverPos<i and i was last element, the next pOver=&rRange was
invalid, though not deleted because std::vector::erase() does not
reallocate.

Change-Id: I22d9302e2d45403dd47ac1947d2cf003b3a4f291

1 files changed, 5 insertions, 1 deletions

diff --git a/sc/source/core/tool/rangelst.cxx b/sc/source/core/tool/rangelst.cxx
index 3b68a8fd5032..84c6764ab79a 100644
--- a/sc/source/core/tool/rangelst.cxx
+++ b/sc/source/core/tool/rangelst.cxx
@@ -320,7 +320,11 @@ Label_Range_Join:
             if ( bIsInList )
             {   // delete range pOver within the list
                 if (nOverPos != std::numeric_limits<size_t>::max())
+                {
                     Remove(nOverPos);
+                    if (nOverPos < i)
+                        --i;
+                }
                 else
                 {
                     for (size_t nOver = 0, nRanges = maRanges.size(); nOver < nRanges; ++nOver)
@@ -334,7 +338,7 @@ Label_Range_Join:
                 }
             }
             bJoinedInput = true;
-            pOver = &rRange;
+            pOver = &maRanges[i];
             bIsInList = true;
             goto Label_Range_Join;
         }