diff options
| author | Giuseppe D'Angelo <giuseppe.dangelo@kdab.com> | 2019-05-27 19:00:09 +0200 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@kdab.com> | 2019-05-27 17:33:30 +0000 |
| commit | b9f96cacc99c8a242f45f4581843a6b1c67501f4 (patch) | |
| tree | 2a2a96a3bd34fd4900beb6cfa17c788cc2187114 /src | |
| parent | c04bd30de072793faee5166cff866a4c4e0a9dd7 (diff) | |
QRegExp: remove an out of bounds access into QString
... spotted with the brand-new checks for that in QCharRef.
The rx[i] == ~~~ check is clearly wrong, as rx is the regexp
we're building and `i` was not supposed to index into it.
The intended meaning was wc[i] == ~~~, testing if we were seeing
the closing bracket of a character set. We need to check for
that immediately for dealing with the special syntax of []...] where
the ] belongs to the character set (it can't be the closing one
as character sets cannot be empty).
Fix and add a regression test. Bonus: this code was almost
unchanged since 2009.
Change-Id: I958cd87fc25558e9d202d18b3dd4a35d0db16d8d
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Reviewed-by: hjk <hjk@qt.io>
Diffstat (limited to 'src')
| -rw-r--r-- | src/corelib/tools/qregexp.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/corelib/tools/qregexp.cpp b/src/corelib/tools/qregexp.cpp index 87b30c952e..ef24c952eb 100644 --- a/src/corelib/tools/qregexp.cpp +++ b/src/corelib/tools/qregexp.cpp @@ -825,7 +825,7 @@ static QString wc2rx(const QString &wc_str, const bool enableEscaping) if (wc[i] == QLatin1Char('^')) rx += wc[i++]; if (i < wclen) { - if (rx[i] == QLatin1Char(']')) + if (wc[i] == QLatin1Char(']')) rx += wc[i++]; while (i < wclen && wc[i] != QLatin1Char(']')) { if (wc[i] == QLatin1Char('\\')) |