Add bounds check to getVariableFromVarId()

While poking around the memory leak check,
I managed to trigger an out-of-bounds access
in the symbol database.

Fix it by sanity checking the variable id
passed to getVariableFromVarId().

lib/symboldatabase.h

@@ -968,6 +968,9 @@ public:
     }
 
     const Variable *getVariableFromVarId(std::size_t varId) const {
+        if (varId >= _variableList.size())
+            return nullptr;
+
         return _variableList[varId];
     }
 

test/testsymboldatabase.cpp

@@ -128,6 +128,7 @@ private:
         TEST_CASE(arrayMemberVar2);
         TEST_CASE(arrayMemberVar3);
         TEST_CASE(staticMemberVar);
+        TEST_CASE(getVariableFromVarIdBoundsCheck);
 
         TEST_CASE(hasRegularFunction);
         TEST_CASE(hasInlineClassFunction);
@@ -750,6 +751,18 @@ private:
         ASSERT(v && v->isStatic() && v->isConst() && v->isPrivate());
     }
 
+    void getVariableFromVarIdBoundsCheck() {
+        GET_SYMBOL_DB("int x;\n"
+                      "int y;\n");
+
+        const Variable* v = db->getVariableFromVarId(2);
+        // three elements: varId 0 also counts via a fake-entry
+        ASSERT(v && db->getVariableListSize() == 3);
+
+        const Variable* v_must_be_null = db->getVariableFromVarId(3);
+        ASSERT(v_must_be_null == nullptr);
+    }
+
     void hasRegularFunction() {
         GET_SYMBOL_DB("void func() { }\n")