Debian Patches
Status for qt6-5compat/6.10.2-4
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| upstream_CVE-2026-9499.diff | QTextCodec: avoid read-past-buffer in codecForName() The old code passed a QByteArray to a function taking const char*, invoking QByteArray::operator const char*() implicitly. The callee expects the argument to be NUL-terminated, but if the QByteArray was created fromRawData(), that is not guaranteed. In newer Qt versions we have nullTerminated(), but this needs to be picked furthr back, so use a std::string to do the null-termination. [ChangeLog][QTextCodec] Fixed an out-of-bounds read in codecForName(). which could read past the end of the QByteArray argument if the argument was created fromRawData() with no NUL-termination. Amends the start of the public history even in qtbase (where nameMatch() took QByteArrays, yes, but then proceeded to qstricmp() them, invoking said operator). Manual conflict resolution for 6.11: - removed the auto-pick-to 5.15: the dashboard anyway doesn't track picks cross repos and the 5.15 pick-to causes sanity bot to -2 each step of the way. (cherry picked from commit 894079b4932dc878b505056cab9887cca67a011a) (cherry picked from commit 9b009208be7914f5673c4311ba702d22c8d62f65) |
Marc Mutz <marc.mutz@qt.io> | no | 2024-12-18 |