Improve QString autotest.

The QString autotest shares test data between the remove() and replace()
tests because those functions are very similar.  Unfortunately, when an
integer overflow bug was found in remove() the regression test was not
shared with replace(), which prevented the same integer overflow bug
from being discovered in replace().

This commit improves the test by sharing the overflow test data between
both functions, thus demonstrating the remaining bug.

Task-number: QTBUG-22967
Change-Id: I2778249800f74799d890eefa9227ca8ddd8fbaa3
Reviewed-by: Rohan McGovern <rohan.mcgovern@nokia.com>

1 files changed, 7 insertions, 8 deletions

diff --git a/tests/auto/corelib/tools/qstring/tst_qstring.cpp b/tests/auto/corelib/tools/qstring/tst_qstring.cpp
index 3011c6c9bc..cb9a3fa70a 100644
--- a/tests/auto/corelib/tools/qstring/tst_qstring.cpp
+++ b/tests/auto/corelib/tools/qstring/tst_qstring.cpp
@@ -213,7 +213,6 @@ private slots:
     void repeatedSignature() const;
     void repeated() const;
     void repeated_data() const;
-    void task262677remove();
     void compareRef();
     void arg_locale();
 
@@ -450,6 +449,11 @@ void tst_QString::replace_uint_uint_data()
     QTest::newRow( "rep13" ) << QString("short") << 0 << 10 << QString("X") << QString("X");
     QTest::newRow( "rep14" ) << QString() << 0 << 10 << QString("XX") << QString("XX");
     QTest::newRow( "rep15" ) << QString("short") << 0 << 10 << QString("XX") << QString("XX");
+
+    // This is a regression test for an old bug where QString would add index and len parameters,
+    // potentially causing integer overflow.
+    QTest::newRow( "no overflow" ) << QString("ACABCAB") << 1 << INT_MAX - 1 << QString("") << QString("A");
+    QTest::newRow( "overflow" ) << QString("ACABCAB") << 1 << INT_MAX << QString("") << QString("A");
 }
 
 void tst_QString::replace_string_data()
@@ -1885,6 +1889,8 @@ void tst_QString::replace_uint_uint()
     QFETCH( int, len );
     QFETCH( QString, after );
 
+    QEXPECT_FAIL("overflow", "QTBUG-22967: integer overflow if (index + len) > INT_MAX", Abort);
+
     QString s1 = string;
     s1.replace( (uint) index, (int) len, after );
     QTEST( s1, "result" );
@@ -4953,13 +4959,6 @@ void tst_QString::repeated_data() const
         << 4;
 }
 
-void tst_QString::task262677remove()
-{
-    QString driveName = QLatin1String("V:\\blahblah\\more_blahblah\\");
-    driveName.remove(2, INT_MAX); // should be "V:" - instead, it's "V::\\blahblah\\more_blahblah\\"
-    QVERIFY(driveName == QLatin1String("V:"));
-}
-
 void tst_QString::compareRef()
 {
     QString a = "ABCDEFGH";