Function Wizard shoots itself in the foot

Currently the Function Wizard is broken in that editing a function call
as argument within another function's parameter leads to selections
being reset and mismatching argument/function information being
evaluated. Not sure yet what's going on there, but at least don't access
vectors out-of-bounds or crash.

Change-Id: I633c775556a0b90278d22d0f74d2975c20a08a5d
(cherry picked from commit 88f3c8f9)

formula/source/ui/dlg/formula.cxx

@@ -1417,12 +1417,21 @@ void FormulaDlg_Impl::UpdateSelection()
     sal_Int32 nArgPos=m_aFormulaHelper.GetArgStart( aFormula,PrivStart,0);
 
     sal_uInt16 nPos=pParaWin->GetActiveLine();
+    if (nPos >= m_aArguments.size())
+    {
+        SAL_WARN("formula.ui","FormulaDlg_Impl::UpdateSelection - shot in foot: nPos " <<
+                nPos << " >= m_aArguments.size() " << m_aArguments.size() <<
+                " for aFormula '" << aFormula << "'");
+        nPos = m_aArguments.size();
+        if (nPos)
+            --nPos;
+    }
 
     for(sal_uInt16 i=0;i<nPos;i++)
     {
         nArgPos += (m_aArguments[i].getLength() + 1);
     }
-    sal_Int32 nLength= m_aArguments[nPos].getLength();
+    sal_Int32 nLength = (nPos < m_aArguments.size()) ? m_aArguments[nPos].getLength() : 0;
 
     Selection aSel(nArgPos,nArgPos+nLength);
     m_pHelper->setSelection((sal_uInt16)nArgPos,(sal_uInt16)(nArgPos+nLength));

formula/source/ui/dlg/parawin.cxx

@@ -638,9 +638,18 @@ IMPL_LINK_TYPED( ParaWin, ModifyHdl, ArgInput&, rPtr, void )
     }
     if(nEdFocus!=NOT_FOUND)
     {
-        aParaArray[nEdFocus+nOffset] = aArgInput[nEdFocus].GetArgVal();
+        size_t nPara = nEdFocus + nOffset;
+        if (nPara < aParaArray.size())
+            aParaArray[nPara] = aArgInput[nEdFocus].GetArgVal();
+        else
+        {
+            SAL_WARN("formula.ui","ParaWin::ModifyHdl - shot in foot: nPara " <<
+                    nPara << " >= aParaArray.size() " << aParaArray.size() <<
+                    " with nEdFocus " << nEdFocus <<
+                    " and aArgInput[nEdFocus].GetArgVal() '" << aArgInput[nEdFocus].GetArgVal() << "'");
+        }
         UpdateArgDesc( nEdFocus);
-        nActiveLine=nEdFocus+nOffset;
+        nActiveLine = static_cast<sal_uInt16>(nPara);
     }
 
     ArgumentModified();