Fix and simplify QString::mid

'position' was being used to initialize 'n' before being fully
validated. To compensate for this, the code attempted to fix 'n' once
'position' was found to be invalid (negative). This would, however, also
attempt to "fix" a perfectly valid value of 'n'.

By fully validating 'position' beforehand we avoid this trap and can
safely use it to validate and reset 'n', as needed.

Arithmetic for boundary conditions of 'n' was rearranged to avoid
triggering integer overflow.

Removed explicit check for shared_null, as the same behaviour can be
supported without it.

Change-Id: Ie9bff7b8137a74f55c7dcfe629bd569045e28f3c
Reviewed-by: Bradley T. Hughes <bradley.hughes@nokia.com>

1 files changed, 6 insertions, 14 deletions

diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp
index 28e8b6be83..e12cf1f910 100644
--- a/src/corelib/tools/qstring.cpp
+++ b/src/corelib/tools/qstring.cpp
@@ -3391,15 +3391,11 @@ QString QString::right(int n) const
 
 QString QString::mid(int position, int n) const
 {
-    if (d == &shared_null.str || position > d->size)
+    if (position > d->size)
         return QString();
-    if (n < 0)
-        n = d->size - position;
-    if (position < 0) {
-        n += position;
+    if (position < 0)
         position = 0;
-    }
-    if (n + position > d->size)
+    if (n < 0 || n > d->size - position)
         n = d->size - position;
     if (position == 0 && n == d->size)
         return *this;
@@ -8061,15 +8057,11 @@ QStringRef QString::rightRef(int n) const
 
 QStringRef QString::midRef(int position, int n) const
 {
-    if (d == &shared_null.str || position > d->size)
+    if (position > d->size)
         return QStringRef();
-    if (n < 0)
-        n = d->size - position;
-    if (position < 0) {
-        n += position;
+    if (position < 0)
         position = 0;
-    }
-    if (n + position > d->size)
+    if (n < 0 || n > d->size - position)
         n = d->size - position;
     return QStringRef(this, position, n);
 }