potential out-of-bounds access in qcssparser

In qcssparser.cpp:1701

features |= static_cast<int>(findKnownValue(d->values.value(i).variant.toString(),
                             styleFeatures, NumKnownStyleFeatures));

styleFeatures is an array of length 3, and NumKnownStyleFeatures is 4. Inside findKnownValue() the array is accessed at index 3, which is an out-of-bounds access.

See screenshot for visualisation of the issue.

Coverity ID: 183557