1 files changed, 18 insertions, 17 deletions

diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp
index f48eaf5721..a4d7dcff3a 100644
--- a/src/corelib/tools/qstring.cpp
+++ b/src/corelib/tools/qstring.cpp
@@ -1049,11 +1049,11 @@ QString::QString(const QChar *unicode, int size)
         if (!size) {
             d = shared_empty.data_ptr();
         } else {
-            d = (Data*) ::malloc(sizeof(Data)+(size+1)*sizeof(QChar));
+            d = (Data*) ::malloc(sizeof(Data) + (uint(size) + 1u) * sizeof(QChar));
             Q_CHECK_PTR(d);
             d->ref.initializeOwned();
             d->size = size;
-            d->alloc = (uint) size;
+            d->alloc = uint(size) + 1u;
             d->capacityReserved = false;
             d->offset = sizeof(QStringData);
             memcpy(d->data(), unicode, size * sizeof(QChar));
@@ -1073,11 +1073,11 @@ QString::QString(int size, QChar ch)
    if (size <= 0) {
         d = shared_empty.data_ptr();
     } else {
-        d = (Data*) ::malloc(sizeof(Data)+(size+1)*sizeof(QChar));
+        d = (Data*) ::malloc(sizeof(Data) + (uint(size) + 1u) * sizeof(QChar));
         Q_CHECK_PTR(d);
         d->ref.initializeOwned();
         d->size = size;
-        d->alloc = (uint) size;
+        d->alloc = uint(size) + 1u;
         d->capacityReserved = false;
         d->offset = sizeof(QStringData);
         d->data()[size] = '\0';
@@ -1097,11 +1097,11 @@ QString::QString(int size, QChar ch)
 */
 QString::QString(int size, Qt::Initialization)
 {
-    d = (Data*) ::malloc(sizeof(Data)+(size+1)*sizeof(QChar));
+    d = (Data*) ::malloc(sizeof(Data) + (uint(size) + 1u) * sizeof(QChar));
     Q_CHECK_PTR(d);
     d->ref.initializeOwned();
     d->size = size;
-    d->alloc = (uint) size;
+    d->alloc = uint(size) + 1u;
     d->capacityReserved = false;
     d->offset = sizeof(QStringData);
     d->data()[size] = '\0';
@@ -1123,7 +1123,7 @@ QString::QString(QChar ch)
     Q_CHECK_PTR(d);
     d->ref.initializeOwned();
     d->size = 1;
-    d->alloc = 1;
+    d->alloc = 2u;
     d->capacityReserved = false;
     d->offset = sizeof(QStringData);
     d->data()[0] = ch.unicode();
@@ -1234,8 +1234,9 @@ void QString::resize(int size)
             QString::free(d);
         d = x;
     } else {
-        if (d->ref.isShared() || size > int(d->alloc) ||
-            (!d->capacityReserved && size < d->size && size < int(d->alloc) >> 1))
+        if (d->ref.isShared() || uint(size) + 1u > d->alloc
+                || (!d->capacityReserved && size < d->size
+                    && uint(size) + 1u < uint(d->alloc >> 1)))
             reallocData(uint(size) + 1u, true);
         if (d->alloc) {
             d->size = size;
@@ -1304,7 +1305,7 @@ void QString::reallocData(uint alloc, bool grow)
         Q_CHECK_PTR(x);
         x->ref.initializeOwned();
         x->size = qMin(int(alloc) - 1, d->size);
-        x->alloc = alloc - 1u;
+        x->alloc = alloc;
         x->capacityReserved = d->capacityReserved;
         x->offset = sizeof(QStringData);
         ::memcpy(x->data(), d->data(), x->size * sizeof(QChar));
@@ -1316,7 +1317,7 @@ void QString::reallocData(uint alloc, bool grow)
         Data *p = static_cast<Data *>(::realloc(d, sizeof(Data) + alloc * sizeof(QChar)));
         Q_CHECK_PTR(p);
         d = p;
-        d->alloc = alloc - 1u;
+        d->alloc = alloc;
         d->offset = sizeof(QStringData);
     }
 }
@@ -1524,7 +1525,7 @@ QString &QString::append(const QString &str)
         if (d == &shared_null.str) {
             operator=(str);
         } else {
-            if (d->ref.isShared() || d->size + str.d->size > int(d->alloc))
+            if (d->ref.isShared() || uint(d->size + str.d->size) + 1u > d->alloc)
                 reallocData(uint(d->size + str.d->size) + 1u, true);
             memcpy(d->data() + d->size, str.d->data(), str.d->size * sizeof(QChar));
             d->size += str.d->size;
@@ -1544,7 +1545,7 @@ QString &QString::append(const QLatin1String &str)
     const uchar *s = (const uchar *)str.latin1();
     if (s) {
         int len = str.size();
-        if (d->ref.isShared() || d->size + len > int(d->alloc))
+        if (d->ref.isShared() || uint(d->size + len) + 1u > d->alloc)
             reallocData(uint(d->size + len) + 1u, true);
         ushort *i = d->data() + d->size;
         while ((*i++ = *s++))
@@ -1587,7 +1588,7 @@ QString &QString::append(const QLatin1String &str)
 */
 QString &QString::append(QChar ch)
 {
-    if (d->ref.isShared() || d->size + 1 > int(d->alloc))
+    if (d->ref.isShared() || uint(d->size) + 2u > d->alloc)
         reallocData(uint(d->size) + 2u, true);
     d->data()[d->size++] = ch.unicode();
     d->data()[d->size] = '\0';
@@ -4056,11 +4057,11 @@ QString::Data *QString::fromLatin1_helper(const char *str, int size)
     } else {
         if (size < 0)
             size = qstrlen(str);
-        d = static_cast<Data *>(::malloc(sizeof(Data) + (size+1) * sizeof(QChar)));
+        d = static_cast<Data *>(::malloc(sizeof(Data) + (uint(size) + 1u) * sizeof(QChar)));
         Q_CHECK_PTR(d);
         d->ref.initializeOwned();
         d->size = size;
-        d->alloc = (uint) size;
+        d->alloc = uint(size) + 1u;
         d->capacityReserved = false;
         d->offset = sizeof(QStringData);
         d->data()[size] = '\0';
@@ -6502,7 +6503,7 @@ QString QString::repeated(int times) const
 
     QString result;
     result.reserve(resultSize);
-    if (int(result.d->alloc) != resultSize)
+    if (result.d->alloc != uint(resultSize) + 1u)
         return QString(); // not enough memory
 
     memcpy(result.d->data(), d->data(), d->size * sizeof(ushort));