From b9f96cacc99c8a242f45f4581843a6b1c67501f4 Mon Sep 17 00:00:00 2001 From: Giuseppe D'Angelo Date: Mon, 27 May 2019 19:00:09 +0200 Subject: [PATCH] QRegExp: remove an out of bounds access into QString ... spotted with the brand-new checks for that in QCharRef. The rx[i] == ~~~ check is clearly wrong, as rx is the regexp we're building and `i` was not supposed to index into it. The intended meaning was wc[i] == ~~~, testing if we were seeing the closing bracket of a character set. We need to check for that immediately for dealing with the special syntax of []...] where the ] belongs to the character set (it can't be the closing one as character sets cannot be empty). Fix and add a regression test. Bonus: this code was almost unchanged since 2009. Change-Id: I958cd87fc25558e9d202d18b3dd4a35d0db16d8d Reviewed-by: Marc Mutz Reviewed-by: hjk --- src/corelib/tools/qregexp.cpp | 2 +- tests/auto/corelib/tools/qregexp/tst_qregexp.cpp | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/corelib/tools/qregexp.cpp b/src/corelib/tools/qregexp.cpp index 87b30c952e..ef24c952eb 100644 --- a/src/corelib/tools/qregexp.cpp +++ b/src/corelib/tools/qregexp.cpp @@ -825,7 +825,7 @@ static QString wc2rx(const QString &wc_str, const bool enableEscaping) if (wc[i] == QLatin1Char('^')) rx += wc[i++]; if (i < wclen) { - if (rx[i] == QLatin1Char(']')) + if (wc[i] == QLatin1Char(']')) rx += wc[i++]; while (i < wclen && wc[i] != QLatin1Char(']')) { if (wc[i] == QLatin1Char('\\')) diff --git a/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp b/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp index a98d37d733..a8111af6c1 100644 --- a/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp +++ b/tests/auto/corelib/tools/qregexp/tst_qregexp.cpp @@ -834,6 +834,13 @@ void tst_QRegExp::testEscapingWildcard_data(){ QTest::newRow("a true '\\' in input") << "\\Qt;" << "\\Qt;" << true; QTest::newRow("two true '\\' in input") << "\\\\Qt;" << "\\\\Qt;" << true; QTest::newRow("a '\\' at the end") << "\\\\Qt;\\" << "\\\\Qt;\\" << true; + + QTest::newRow("[]\\] matches ]") << "[]\\]" << "]" << true; + QTest::newRow("[]\\] matches \\") << "[]\\]" << "\\" << true; + QTest::newRow("[]\\] does not match [") << "[]\\]" << "[" << false; + QTest::newRow("[]\\]a matches ]a") << "[]\\]a" << "]a" << true; + QTest::newRow("[]\\]a matches \\a") << "[]\\]a" << "\\a" << true; + QTest::newRow("[]\\]a does not match [a") << "[]\\]a" << "[a" << false; } void tst_QRegExp::testEscapingWildcard(){