Memory corruption can occur on parsing a custom cell formatting pattern with a date and/or time macro

There appears to be a bug in the dxSpreadSheetNumberFormatParser.pas module in the v18.2.4 release (haven't checked earlier versions).

This is the method that's been crashing for us:

Delphi
procedure TdxNumberFormatParser.OnSecond;  
var  
  AElement: TdxNumberFormatElement;  
  I: Integer;  
begin  
  // try convert month to minute  
  for I := FElements.Count - 1 downto 0 do  
  begin  
    AElement := FElements[I];  
    if AElement is TdxNumberFormatElementDateBase then  
    begin  
      if AElement is TdxNumberFormatElementMonth then  
        FElements[I] := TdxNumberFormatElementMinutes.Create(TdxNumberFormatElementMonth(AElement).Count, False);  
      if not (AElement is TdxNumberFormatElementAmPm) then  
        Break;  
    end;  
  end;  
  FElements.Add(TdxNumberFormatElementSeconds.Create(IfThen(GetDateTimeBlockLength > 1, 2, 1), False));  
end;  

The FElements field is dereived from TObjectList and owns the objects held in it so if/when the "if AElement is TdxNumberFormatElementMonth then" condition executes, the previously held item in FElements[I] is freed when the reassignment to the element's made.

The local variable AElement is holding a reference to that previous item, so becomes stale at that point and potentially crashes when the immediately following "is TdxNumberFormatElementAmPm" test's applied.

Updating AElement after the FElement[I] assignment seems to fix this:

Delphi
procedure TdxNumberFormatParser.OnSecond;  
var  
  AElement: TdxNumberFormatElement;  
  I: Integer;  
begin  
  // try convert month to minute  
  for I := FElements.Count - 1 downto 0 do  
  begin  
    AElement := FElements[I];  
    if AElement is TdxNumberFormatElementDateBase then  
    begin  
      if AElement is TdxNumberFormatElementMonth then begin  
        FElements[I] := TdxNumberFormatElementMinutes.Create(TdxNumberFormatElementMonth(AElement).Count, False);  
        AElement := FElements[I]; // New line, with aooompanying begin/end block  
      end ;  
      if not (AElement is TdxNumberFormatElementAmPm) then  
        Break;  
    end;  
  end;  
  FElements.Add(TdxNumberFormatElementSeconds.Create(IfThen(GetDateTimeBlockLength > 1, 2, 1), False));  
end;  

This does seem to work, but please let me know if I've missed somethng and have misunderstood the problem/fix.

Cheers,
Ian