QRegExp: remove an out of bounds access into QString

... spotted with the brand-new checks for that in QCharRef.

The rx[i] == ~~~ check is clearly wrong, as rx is the regexp
we're building and `i` was not supposed to index into it.

The intended meaning was wc[i] == ~~~, testing if we were seeing
the closing bracket of a character set. We need to check for
that immediately for dealing with the special syntax of []...] where
the ] belongs to the character set (it can't be the closing one
as character sets cannot be empty).

Fix and add a regression test. Bonus: this code was almost
unchanged since 2009.

Change-Id: I958cd87fc25558e9d202d18b3dd4a35d0db16d8d
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Reviewed-by: hjk <hjk@qt.io>
 

1 files changed, 7 insertions, 0 deletions

diff --git a/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp b/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp
index a98d37d733..a8111af6c1 100644
--- a/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp
+++ b/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp
@@ -834,6 +834,13 @@ void tst_QRegExp::testEscapingWildcard_data(){
     QTest::newRow("a true '\\' in input") << "\\Qt;" <<  "\\Qt;" << true;
     QTest::newRow("two true '\\' in input") << "\\\\Qt;" <<  "\\\\Qt;" << true;
     QTest::newRow("a '\\' at the end") << "\\\\Qt;\\" <<  "\\\\Qt;\\" << true;
+
+    QTest::newRow("[]\\] matches ]") << "[]\\]" << "]" << true;
+    QTest::newRow("[]\\] matches \\") << "[]\\]" << "\\" << true;
+    QTest::newRow("[]\\] does not match [") << "[]\\]" << "[" << false;
+    QTest::newRow("[]\\]a matches ]a") << "[]\\]a" << "]a" << true;
+    QTest::newRow("[]\\]a matches \\a") << "[]\\]a" << "\\a" << true;
+    QTest::newRow("[]\\]a does not match [a") << "[]\\]a" << "[a" << false;
 }
 
 void tst_QRegExp::testEscapingWildcard(){