From b17802ba81b4a71e9a2b05eea8c0e76589a66f4b Mon Sep 17 00:00:00 2001
From: Richard Heck <rgheck@lyx.org>
Date: Thu, 8 May 2014 18:19:55 -0400
Subject: [PATCH] Fix bug #9112: There is a test here that seems intended to
 catch the case where there are unbalanced braces, but it comes too late. In
 that case, we try to check cmd[docstring::npos] and crash. (cherry picked
 from commit 6b0a8fbc9614433e7db4e6f994fd62886da8b8eb)

---
 src/Encoding.cpp | 10 ++++++++--
 status.21x       |  2 ++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/Encoding.cpp b/src/Encoding.cpp
index a231106d24..bc27675f13 100644
--- a/src/Encoding.cpp
+++ b/src/Encoding.cpp
@@ -537,8 +537,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & cmd, int cmdtype,
 		if (j + 1 < cmdend && cmd[j + 1] == '{') {
 			size_t k = j + 1;
 			int count = 1;
-			while (k < cmdend && count && k != docstring::npos) {
+			while (k < cmdend && count) {
 				k = cmd.find_first_of(from_ascii("{}"), k + 1);
+				// braces may not be balanced
+				if (k == docstring::npos)
+					break;
 				if (cmd[k] == '{')
 					++count;
 				else
@@ -603,8 +606,11 @@ docstring Encodings::fromLaTeXCommand(docstring const & cmd, int cmdtype,
 			    k < cmdend && cmd[k] == '{') {
 				size_t l = k;
 				int count = 1;
-				while (l < cmdend && count && l != docstring::npos) {
+				while (l < cmdend && count) {
 					l = cmd.find_first_of(from_ascii("{}"), l + 1);
+					// braces may not be balanced
+					if (l == docstring::npos)
+						break;
 					if (cmd[l] == '{')
 						++count;
 					else
diff --git a/status.21x b/status.21x
index 07e3e4e9c3..9f32d4f3c2 100644
--- a/status.21x
+++ b/status.21x
@@ -91,6 +91,8 @@ What's new
 - Fix crash when performing "Change Case" operation on a selection with font
   changes (bug 7943).
 
+- Fix crash involving certain sorts of BibTeX files (bug 9112).
+
 - Fix assertion when entering a path into the import dialog (bug 7437).
 
 - Fix assertion when doing advanced replace with table cells selected (bug