QTextHtmlParser: fix prefix lookahead and html comments

The hasPrefix() function would only use the second 'lookahead' parameter
to check if there was more unparsed text after the current character.
When it's obvious from the codebase that it should actually look ahead
of the current character being processed, and compare againt that future
character.

Html comments were also not handled quite right. Partially because of
the broken hasPrefix() function, but also because it would advance the
current index tracker by 3 instead of 2. Remember that the beginning of
an html comment is <!-- meaning that there are only supposed to be 2
dashes required, not 3. The result would be that something like this
<!----> would not automatically close, because the current index tracker
would jump over the first 3 dashes when it begins a comment, and the
remaining unprocessed string would be ->

Also, because of the broken lookahead in hasPrefix(), a comment could
actually be started with just <!- not requiring a second dash at all.

Pick-to: 6.3 6.2 5.15
Fixes: QTBUG-99147
Change-Id: I8f4d4a1107eaf2dae16d16b7b860525d45a1c474
Reviewed-by: Qt CI Bot <[email protected]>
Reviewed-by: Volker Hilsheimer <[email protected]>

2 files changed, 6 insertions, 4 deletions

diff --git a/src/gui/text/qtexthtmlparser.cpp b/src/gui/text/qtexthtmlparser.cpp
index 85877bfe475..f97b8a672a3 100644
--- a/src/gui/text/qtexthtmlparser.cpp
+++ b/src/gui/text/qtexthtmlparser.cpp
@@ -785,8 +785,8 @@ void QTextHtmlParser::parseCloseTag()
 void QTextHtmlParser::parseExclamationTag()
 {
     ++pos;
-    if (hasPrefix(QLatin1Char('-'),1) && hasPrefix(QLatin1Char('-'),2)) {
-        pos += 3;
+    if (hasPrefix(QLatin1Char('-')) && hasPrefix(QLatin1Char('-'), 1)) {
+        pos += 2;
         // eat comments
         int end = txt.indexOf(QLatin1String("-->"), pos);
         pos = (end >= 0 ? end + 3 : len);
@@ -882,7 +882,7 @@ QString QTextHtmlParser::parseWord()
         while (pos < len) {
             QChar c = txt.at(pos++);
             if (c == QLatin1Char('>')
-                || (c == QLatin1Char('/') && hasPrefix(QLatin1Char('>'), 1))
+                || (c == QLatin1Char('/') && hasPrefix(QLatin1Char('>')))
                 || c == QLatin1Char('<')
                 || c == QLatin1Char('=')
                 || c.isSpace()) {
diff --git a/src/gui/text/qtexthtmlparser_p.h b/src/gui/text/qtexthtmlparser_p.h
index 06bbc032a83..a96bf3244f7 100644
--- a/src/gui/text/qtexthtmlparser_p.h
+++ b/src/gui/text/qtexthtmlparser_p.h
@@ -333,7 +333,9 @@ protected:
     void applyAttributes(const QStringList &attributes);
     void eatSpace();
     inline bool hasPrefix(QChar c, int lookahead = 0) const
-        {return pos + lookahead < len && txt.at(pos) == c; }
+    {
+        return pos + lookahead < len && txt.at(pos + lookahead) == c;
+    }
     int margin(int i, int mar) const;
 
     bool nodeIsChildOf(int i, QTextHTMLElements id) const;