path: root/src/corelib
diff options
authorGiuseppe D'Angelo <>2019-05-27 19:00:09 +0200
committerMarc Mutz <>2019-05-27 17:33:30 +0000
commitb9f96cacc99c8a242f45f4581843a6b1c67501f4 (patch)
tree2a2a96a3bd34fd4900beb6cfa17c788cc2187114 /src/corelib
parentc04bd30de072793faee5166cff866a4c4e0a9dd7 (diff)
QRegExp: remove an out of bounds access into QString
... spotted with the brand-new checks for that in QCharRef. The rx[i] == ~~~ check is clearly wrong, as rx is the regexp we're building and `i` was not supposed to index into it. The intended meaning was wc[i] == ~~~, testing if we were seeing the closing bracket of a character set. We need to check for that immediately for dealing with the special syntax of []...] where the ] belongs to the character set (it can't be the closing one as character sets cannot be empty). Fix and add a regression test. Bonus: this code was almost unchanged since 2009. Change-Id: I958cd87fc25558e9d202d18b3dd4a35d0db16d8d Reviewed-by: Marc Mutz <> Reviewed-by: hjk <>
Diffstat (limited to 'src/corelib')
1 files changed, 1 insertions, 1 deletions
diff --git a/src/corelib/tools/qregexp.cpp b/src/corelib/tools/qregexp.cpp
index 87b30c952e..ef24c952eb 100644
--- a/src/corelib/tools/qregexp.cpp
+++ b/src/corelib/tools/qregexp.cpp
@@ -825,7 +825,7 @@ static QString wc2rx(const QString &wc_str, const bool enableEscaping)
if (wc[i] == QLatin1Char('^'))
rx += wc[i++];
if (i < wclen) {
- if (rx[i] == QLatin1Char(']'))
+ if (wc[i] == QLatin1Char(']'))
rx += wc[i++];
while (i < wclen && wc[i] != QLatin1Char(']')) {
if (wc[i] == QLatin1Char('\\'))