Merge remote-tracking branch 'origin/5.6' into 5.7

Conflicts:
	mkspecs/features/qml_module.prf
	mkspecs/features/qt_common.prf
	src/gui/text/qzip.cpp
	src/plugins/platforms/cocoa/qnsview.mm
	src/plugins/platforms/windows/array.h
	src/testlib/qtestcase.cpp
	src/widgets/dialogs/qfilesystemmodel.h

Change-Id: Ie41c5868415b81f7693c80e045497035504bb210

5 files changed, 24 insertions, 14 deletions

diff --git a/src/corelib/tools/qarraydata.cpp b/src/corelib/tools/qarraydata.cpp
index 21ad799e25..bf336a8f31 100644
--- a/src/corelib/tools/qarraydata.cpp
+++ b/src/corelib/tools/qarraydata.cpp
@@ -38,6 +38,7 @@
 ****************************************************************************/
 
 #include <QtCore/qarraydata.h>
+#include <QtCore/private/qnumeric_p.h>
 #include <QtCore/private/qtools_p.h>
 
 #include <stdlib.h>
@@ -93,16 +94,22 @@ QArrayData *QArrayData::allocate(size_t objectSize, size_t alignment,
         if (capacity > std::numeric_limits<size_t>::max() / objectSize)
             return 0;
 
-        size_t alloc = objectSize * capacity;
+        size_t alloc;
+        if (mul_overflow(objectSize, capacity, &alloc))
+            return 0;
 
-        // Make sure qAllocMore won't overflow.
+        // Make sure qAllocMore won't overflow qAllocMore.
         if (headerSize > size_t(MaxAllocSize) || alloc > size_t(MaxAllocSize) - headerSize)
             return 0;
 
         capacity = qAllocMore(int(alloc), int(headerSize)) / int(objectSize);
     }
 
-    size_t allocSize = headerSize + objectSize * capacity;
+    size_t allocSize;
+    if (mul_overflow(objectSize, capacity, &allocSize))
+        return 0;
+    if (add_overflow(allocSize, headerSize, &allocSize))
+        return 0;
 
     QArrayData *header = static_cast<QArrayData *>(::malloc(allocSize));
     if (header) {
diff --git a/src/corelib/tools/qlist.h b/src/corelib/tools/qlist.h
index 5509c3adce..ec279769eb 100644
--- a/src/corelib/tools/qlist.h
+++ b/src/corelib/tools/qlist.h
@@ -852,7 +852,7 @@ inline bool QList<T>::op_eq_impl(const QList &l, QListData::ArrayCompatibleLayou
     const T *lb = reinterpret_cast<const T*>(l.p.begin());
     const T *b  = reinterpret_cast<const T*>(p.begin());
     const T *e  = reinterpret_cast<const T*>(p.end());
-    return std::equal(b, e, lb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(lb, l.p.size()));
 }
 
 template <typename T>
diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp
index c3aae2fd22..9f968978dc 100644
--- a/src/corelib/tools/qstring.cpp
+++ b/src/corelib/tools/qstring.cpp
@@ -712,8 +712,8 @@ static int findChar(const QChar *str, int len, QChar ch, int from,
 }
 
 #define REHASH(a) \
-    if (sl_minus_1 < (int)sizeof(int) * CHAR_BIT)       \
-        hashHaystack -= (a) << sl_minus_1; \
+    if (sl_minus_1 < sizeof(uint) * CHAR_BIT)  \
+        hashHaystack -= uint(a) << sl_minus_1; \
     hashHaystack <<= 1
 
 inline bool qIsUpper(char ch)
@@ -3096,8 +3096,9 @@ int qFindString(
     const ushort *needle = (const ushort *)needle0;
     const ushort *haystack = (const ushort *)haystack0 + from;
     const ushort *end = (const ushort *)haystack0 + (l-sl);
-    const int sl_minus_1 = sl-1;
-    int hashNeedle = 0, hashHaystack = 0, idx;
+    const uint sl_minus_1 = sl - 1;
+    uint hashNeedle = 0, hashHaystack = 0;
+    int idx;
 
     if (cs == Qt::CaseSensitive) {
         for (idx = 0; idx < sl; ++idx) {
@@ -3172,10 +3173,11 @@ static int lastIndexOfHelper(const ushort *haystack, int from, const ushort *nee
 
     const ushort *end = haystack;
     haystack += from;
-    const int sl_minus_1 = sl-1;
+    const uint sl_minus_1 = sl - 1;
     const ushort *n = needle+sl_minus_1;
     const ushort *h = haystack+sl_minus_1;
-    int hashNeedle = 0, hashHaystack = 0, idx;
+    uint hashNeedle = 0, hashHaystack = 0;
+    int idx;
 
     if (cs == Qt::CaseSensitive) {
         for (idx = 0; idx < sl; ++idx) {
diff --git a/src/corelib/tools/qvarlengtharray.h b/src/corelib/tools/qvarlengtharray.h
index 24574dc90b..c3ac104399 100644
--- a/src/corelib/tools/qvarlengtharray.h
+++ b/src/corelib/tools/qvarlengtharray.h
@@ -102,7 +102,8 @@ public:
     QVarLengthArray<T, Prealloc> &operator=(std::initializer_list<T> list)
     {
         resize(list.size());
-        std::copy(list.begin(), list.end(), this->begin());
+        std::copy(list.begin(), list.end(),
+                  QT_MAKE_CHECKED_ARRAY_ITERATOR(this->begin(), this->size()));
         return *this;
     }
 #endif
@@ -473,7 +474,7 @@ Q_OUTOFLINE_TEMPLATE typename QVarLengthArray<T, Prealloc>::iterator QVarLengthA
     int l = int(aend - ptr);
     int n = l - f;
     if (QTypeInfo<T>::isComplex) {
-        std::copy(ptr + l, ptr + s, ptr + f);
+        std::copy(ptr + l, ptr + s, QT_MAKE_CHECKED_ARRAY_ITERATOR(ptr + f, s - f));
         T *i = ptr + s;
         T *b = ptr + s - n;
         while (i != b) {
@@ -495,7 +496,7 @@ bool operator==(const QVarLengthArray<T, Prealloc1> &l, const QVarLengthArray<T,
     const T *rb = r.begin();
     const T *b  = l.begin();
     const T *e  = l.end();
-    return std::equal(b, e, rb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(rb, r.size()));
 }
 
 template <typename T, int Prealloc1, int Prealloc2>
diff --git a/src/corelib/tools/qvector.h b/src/corelib/tools/qvector.h
index 806a127cc2..557bec9676 100644
--- a/src/corelib/tools/qvector.h
+++ b/src/corelib/tools/qvector.h
@@ -773,7 +773,7 @@ bool QVector<T>::operator==(const QVector<T> &v) const
     const T *vb = v.d->begin();
     const T *b  = d->begin();
     const T *e  = d->end();
-    return std::equal(b, e, vb);
+    return std::equal(b, e, QT_MAKE_CHECKED_ARRAY_ITERATOR(vb, v.d->size));
 }
 
 template <typename T>