lupdate: Fix assert when applying number heuristics

There's an edge case in the number heuristics of lupdate that triggers a
Q_ASSERT due to an out-of-bounds string character access. To run into
the assert, the following must be true:

- oldSource == oldTranslation
- oldSource must contain a number followed immediately by more than one
  characters
- oldSource and newSource must differ only in the character after the
  number

Examples that trigger the assert:

| oldSource  | newSource  |
|------------+------------|
| "%1MiB"    | "%1Kib"    |
| "1Mi"      | "1Ki"      |
| "1M "      | "1Ki "     |
| "123abcde" | "123xbcde" |

Examples that do not trigger the assert:

| oldSource  | newSource  |
|------------+------------|
| "%1MiB"    | "%1Kob"    |
| "1M"       | "1K"       |
| "123abcde" | "123xxcde" |

Add a test case that triggers the Q_ASSERT.

Add a check to avoid the out-of-bounds access as a minimal fix. The
whole number heuristics algorithm is fishy and produces results that
don't match the source code comments. But it's been like that "forever",
so let's not change existing behavior people may rely on.

Pick-to: 6.5
Fixes: QTBUG-111775
Change-Id: Ibb6bcce9115f7060b6de3f97451e38105623c003
Reviewed-by: Kai Köhne <kai.koehne@qt.io>

5 files changed, 23 insertions, 5 deletions

diff --git a/src/linguist/lupdate/merge.cpp b/src/linguist/lupdate/merge.cpp
index 910aa1845..273ace6ad 100644
--- a/src/linguist/lupdate/merge.cpp
+++ b/src/linguist/lupdate/merge.cpp
@@ -106,10 +106,12 @@ static QString translationAttempt(const QString &oldTranslation,
     for (i = 0; i < oldTranslation.size(); i++) {
         attempt += oldTranslation[i];
         for (k = 0; k < p; k++) {
-            if (oldTranslation[i] == oldNumbers[k][matchedYet[k]])
+            if (matchedYet[k] < oldNumbers[k].size() &&
+                oldTranslation[i] == oldNumbers[k][matchedYet[k]]) {
                 matchedYet[k]++;
-            else
+            } else {
                 matchedYet[k] = 0;
+            }
         }
 
         /*
diff --git a/tests/auto/linguist/lupdate/testdata/good/heuristics/expectedoutput.txt b/tests/auto/linguist/lupdate/testdata/good/heuristics/expectedoutput.txt
index 1eed403b7..e363cc8cb 100644
--- a/tests/auto/linguist/lupdate/testdata/good/heuristics/expectedoutput.txt
+++ b/tests/auto/linguist/lupdate/testdata/good/heuristics/expectedoutput.txt
@@ -1,5 +1,5 @@
 Updating 'project\.ts'\.\.\.
-    Found 3 source text\(s\) \(3 new and 0 already existing\)
-    Removed 5 obsolete entries
-    Number heuristic provided 1 translation\(s\)
+    Found 4 source text\(s\) \(4 new and 0 already existing\)
+    Removed 6 obsolete entries
+    Number heuristic provided 2 translation\(s\)
     Same-text heuristic provided 1 translation\(s\)
diff --git a/tests/auto/linguist/lupdate/testdata/good/heuristics/main.cpp b/tests/auto/linguist/lupdate/testdata/good/heuristics/main.cpp
index 41cedf52a..0915b556c 100644
--- a/tests/auto/linguist/lupdate/testdata/good/heuristics/main.cpp
+++ b/tests/auto/linguist/lupdate/testdata/good/heuristics/main.cpp
@@ -44,6 +44,9 @@ class A: public QObject {
 
         // failed same text
         tr("this is the non-matched same text");
+
+        // number heuristics QTBUG-111775
+        tr("1xb");
     }
 };
 
diff --git a/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.before b/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.before
index e72debed9..ca731d961 100644
--- a/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.before
+++ b/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.before
@@ -35,4 +35,12 @@
         <translation>völlig andere variante des reinfalls mit same-text</translation>
     </message>
 </context>
+<context>
+    <name>D</name>
+    <message>
+        <location filename="main.cpp" line="62"/>
+        <source>1ab</source>
+        <translation>1ab</translation>
+    </message>
+</context>
 </TS>
diff --git a/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.result b/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.result
index 351bdff7d..546d1f1f4 100644
--- a/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.result
+++ b/tests/auto/linguist/lupdate/testdata/good/heuristics/project.ts.result
@@ -18,5 +18,10 @@
         <source>this is the non-matched same text</source>
         <translation type="unfinished"></translation>
     </message>
+    <message>
+        <location filename="main.cpp" line="49"/>
+        <source>1xb</source>
+        <translation type="unfinished">1ab {1x?}</translation>
+    </message>
 </context>
 </TS>