From 2bf2294697212cceed9873165b584f896e310993 Mon Sep 17 00:00:00 2001
From: Stephan Witt <switt@lyx.org>
Date: Fri, 7 Feb 2020 10:17:33 +0100
Subject: [PATCH] Fix a crash with uninitialized buffer member of MathData

See the details here: https://www.mail-archive.com/lyx-devel@lists.lyx.org/msg210294.html

(cherry picked from commit 59fa0b25928b43c8d32d19a6193dc3bd07716947)
---
 src/mathed/InsetMathNest.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mathed/InsetMathNest.cpp b/src/mathed/InsetMathNest.cpp
index bc3c2add0e..db03dabcaf 100644
--- a/src/mathed/InsetMathNest.cpp
+++ b/src/mathed/InsetMathNest.cpp
@@ -1232,10 +1232,12 @@ void InsetMathNest::doDispatch(Cursor & cur, FuncRequest & cmd)
 		cur.recordUndoSelection();
 		if (cmd.argument() == "^" || cmd.argument() == "_")
 			interpretChar(cur, cmd.argument()[0]);
+		else if (!cur.selection())
+			cur.niceInsert(cmd.argument());
 		else {
-			MathData ar;
+			MathData ar(cur.buffer());
 			asArray(cmd.argument(), ar);
-			if (cur.selection() && ar.size() == 1
+			if (ar.size() == 1
 			    && ar[0]->asNestInset()
 			    && ar[0]->asNestInset()->nargs() > 1)
 				handleNest(cur, ar[0]);