QString::replace(): protect sought text and replacement

When replacing each copy of one text with a copy of another, we do so
in batches of 1024; if we get more than one batch, we need to keep a
copy of the sought text and replacement if they're part of the string
we're modifying, for use in later batches.

Also do the replacements in full batches of 1024, not 1023 (which left
the last entry in an array unused); marked some related tests as
(un)likely; and move some repeated code out into a pair of little
local functions to save duplcation.

Those new functions can also serve replace_helper(); and it can shed a
const_cast and some conditioning of free() by using them the same way
replace() now does.  (There was also one place it still used the raw
after, rather than the replacement copy; which could have produced
errors if memcpy were to exercise its right to assume no overlap in
arrays.  This error is what prompted me to notice all of the above.)

Added tests.  The last error proved untestable as my memcpy is in fact
as fussy as memmove.  The first two tests added were attempts to get a
failure out of it.  The third did get a failure, but also tripped over
the problem in replace() itself.  Added to an existing test function
and renamed it to generally cover extra tests for replace.

Change-Id: I9ba6928c84ece266dbbe52b91e333ea54ab6d95e
Reviewed-by: Robin Burchell <robin.burchell@viroteck.net>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 40 insertions, 2 deletions

diff --git a/tests/auto/corelib/tools/qstring/tst_qstring.cpp b/tests/auto/corelib/tools/qstring/tst_qstring.cpp
index 3bacf5d942..da6cdddd4f 100644
--- a/tests/auto/corelib/tools/qstring/tst_qstring.cpp
+++ b/tests/auto/corelib/tools/qstring/tst_qstring.cpp
@@ -360,7 +360,7 @@ private slots:
     void replace_qchar_qstring();
     void replace_uint_uint_data();
     void replace_uint_uint();
-    void replace_uint_uint_extra();
+    void replace_extra();
     void replace_string_data();
     void replace_string();
     void replace_regexp_data();
@@ -2790,7 +2790,7 @@ void tst_QString::replace_uint_uint()
     }
 }
 
-void tst_QString::replace_uint_uint_extra()
+void tst_QString::replace_extra()
 {
     /*
         This test is designed to be extremely slow if QString::replace() doesn't optimize the case
@@ -2827,6 +2827,44 @@ void tst_QString::replace_uint_uint_extra()
     QString str5("abcdefghij");
     str5.replace(8, 10, str5);
     QCOMPARE(str5, QString("abcdefghabcdefghij"));
+
+    // Replacements using only part of the string modified:
+    QString str6("abcdefghij");
+    str6.replace(1, 8, str6.constData() + 3, 3);
+    QCOMPARE(str6, QString("adefj"));
+
+    QString str7("abcdefghibcdefghij");
+    str7.replace(str7.constData() + 1, 6, str7.constData() + 2, 3);
+    QCOMPARE(str7, QString("acdehicdehij"));
+
+    const int many = 1024;
+    /*
+      QS::replace(const QChar *, int, const QChar *, int, Qt::CaseSensitivity)
+      does its replacements in batches of many (please keep in sync with any
+      changes to batch size), which lead to misbehaviour if ether QChar * array
+      was part of the data being modified.
+    */
+    QString str8("abcdefg"), ans8("acdeg");
+    {
+        // Make str8 and ans8 repeat themselves many + 1 times:
+        int i = many;
+        QString big(str8), small(ans8);
+        while (i && !(i & 1)) { // Exploit many being a power of 2:
+            big += big;
+            small += small;
+            i >>= 1;
+        }
+        while (i-- > 0) {
+            str8 += big;
+            ans8 += small;
+        }
+    }
+    str8.replace(str8.constData() + 1, 5, str8.constData() + 2, 3);
+    // Pre-test the bit where the diff happens, so it gets displayed:
+    QCOMPARE(str8.mid((many - 3) * 5), ans8.mid((many - 3) * 5));
+    // Also check the full values match, of course:
+    QCOMPARE(str8.size(), ans8.size());
+    QCOMPARE(str8, ans8);
 }
 
 void tst_QString::replace_string()