Fix for integer overflow in QString::replace

Task-number: QTBUG-22967

Change-Id: I604e6a725d46eab4c4369ebb54e8c9ea1350f492
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

src/corelib/tools/qstring.cpp

@@ -1752,6 +1752,10 @@ QString &QString::remove(QChar ch, Qt::CaseSensitivity cs)
   Replaces \a n characters beginning at index \a position with
   the string \a after and returns a reference to this string.
 
+  \note If the specified \a position index is within the string,
+  but \a position + \a n goes outside the strings range,
+  then \a n will be adjusted to stop at the end of the string.
+
   Example:
 
   \snippet qstring/main.cpp 40
@@ -1775,7 +1779,7 @@ QString &QString::replace(int pos, int len, const QChar *unicode, int size)
 {
     if (pos < 0 || pos > d->size)
         return *this;
-    if (pos + len > d->size)
+    if (len > d->size - pos)
         len = d->size - pos;
 
     uint index = pos;

tests/auto/corelib/tools/qstring/tst_qstring.cpp

@@ -2230,8 +2230,6 @@ void tst_QString::replace_uint_uint()
     QFETCH( int, len );
     QFETCH( QString, after );
 
-    QEXPECT_FAIL("overflow", "QTBUG-22967: integer overflow if (index + len) > INT_MAX", Abort);
-
     QString s1 = string;
     s1.replace( (uint) index, (int) len, after );
     QTEST( s1, "result" );