Debian Patches

Status for qt6-base/6.11.2+dfsg-8

Patch Description Author Forwarded Bugs Origin Last update
fix_sparc64_detection.patch qprocessordetection.h: Detect 64-bit SPARC when building with GCC
GCC defines __sparc64__ only for the BSD targets. On Linux and Solaris
it defines __arch64__, so Q_PROCESSOR_SPARC_64 was never set in a GCC
build there. Check for __arch64__ as well, which GCC and clang both
define on every 64-bit SPARC target.

This only changes qtdeclarative, whose sparc64 heap pointer encoding
was never compiled in. The other users test Q_PROCESSOR_SPARC_V9 first.		 Stian Halseth <stian@itx.no> no 2026-10-08
upstream_87c5b3e_CVE-2026-15037.patch QDom: Change default InvalidDataPolicy to ReturnNullNode
Previously, the default InvalidDataPolicy was AcceptInvalidChars, which
caused QDomDocument factory functions to silently accept data containing
characters not permitted in XML 1.0. The resulting document could then
be serialized producing malformed XML without any indication to the
caller.
Change the default to ReturnNullNode so that factory functions called
with invalid data return a null node.

[ChangeLog][QtXml][QDomImplementation] The default InvalidDataPolicy has
changed from AcceptInvalidChars to ReturnNullNode. Factory functions in
QDomDocument now return a null node when called with data invalid per
XML 1.0, instead of silently accepting it.

(cherry picked from commit bf1ae5862807ec2b9a411506d59ccd566937a4c7)		 Magdalena Stojek <magdalena.stojek@qt.io> no 2026-06-26
upstream_444b479_dont_consider_fallbackthemename_in_themename.diff QIconLoader: Don't consider fallbackThemeName() in themeName()
themeName and fallbackThemeName are independent things.

bebbf84167a4341eed27ecfca480ff62dfa1b159 mixes the two together,
which results in setFallbackThemeName() incorrectly changing
themeName().

Restore that part to how it was before.

Amends bebbf84167a4341eed27ecfca480ff62dfa1b159

(cherry picked from commit 85420d5d4f78a6ba4cf70ed8ee092e0ef4fb9a54)
(cherry picked from commit e80e3f0cebae9c3a45a1b7ce81d6454c699d89c6)		 Nicolas Fella <nicolas.fella@kde.org> no 2026-08-24
upstream_CVE-2026-95620.patch QHttp2Stream: fix use-after-free on upload device teardown mid-upload

uploadDeviceDestroyed() only cleared m_uploadDevice, leaving
m_uploadByteDevice dangling. If the peer later grows the stream's
receive window (SETTINGS INITIAL_WINDOW_SIZE), maybeResumeUpload()
resumes the upload through the now-freed QNonContiguousByteDevice,
causing a heap-use-after-free with virtual dispatch on attacker-
controlled timing.

Also clear m_owningByteDevice so the dangling pointer is never
revisited or deleted again.

Changes in 6.12:
- Resolved trivial merge conflict (adjecent test missing).
Changes in 6.11:
- Resolved conflict in test (other change not picked)

(cherry picked from commit deedcc1b9b711ec7f32e9caf68defed4aead379f)
(cherry picked from commit c60dd9c20425ce3571718b2711b05bfd9878f401)		 Mårten Nordheim <marten.nordheim@qt.io> no 2026-08-03
upstream_CVE-2026-96432.patch QHttp2Connection: guard against null-QPointer plant via RST_STREAM

handleRST_STREAM() used QHash::operator[] to look up the stream for an
incoming RST_STREAM, which inserts a default-constructed (null)
QPointer<QHttp2Stream> entry when the stream ID is unknown -- e.g.
because the client already disposed of a completed stream and its
destructor removed the entry from m_streams. A later PUSH_PROMISE
referencing that same stream ID passed the existence check in
handlePUSH_PROMISE() (constEnd() only) and dereferenced the null
QPointer via (*it)->state(), undefined behavior that segfaults under
this build's optimizer.

Switch both RST_STREAM lookups to QHash::value(), which never inserts,
and add an explicit isNull() check in handlePUSH_PROMISE() so a
previously-planted (or otherwise absent) entry takes the existing
"invalid associated stream" connection-error path instead.

(cherry picked from commit 7773b221b4c893809574ddadc1d2c3dfbed55fcd)
(cherry picked from commit 139efc479b6e7adf1afb1888a3fd5daf9c8e2ae3)		 Mårten Nordheim <marten.nordheim@qt.io> no 2026-08-03
upstream_CVE-2026-105923.patch Clamp coordinates in QTriangulator
We assume 21 bits for the absolute value of the POD point components
and we assert for this deeper in the code. Up until now the contract
has been that the user of QTriangulator clamps the values before
passing them in, but to make this less error prone, we make sure they
are clamped as part of the fixed point conversion.

(cherry picked from commit 4366caf9893c0fa225e95901f8930b88c52309e1)
(cherry picked from commit 7a78b19f853949011ee439bf3f96b501a28ac359)		 Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io> no 2026-08-20
upstream_CVE-2026-105924.patch JSON/CBOR: fix crash converting an empty URL tag to JSON
A CBOR URL (tag 32) wrapping an empty, definite-length text string has
no backing ByteData after decoding via QCborValue::fromCbor(), so
byteData() returns nullptr. convertExtendedTypeToJson() dereferenced it
unconditionally and crashed. Guard against the null pointer.

(cherry picked from commit 9e9988ee57c0210a5ba57435182b094f50b50f28)
(cherry picked from commit a2cd9d2a70575c37153d43e9c5396a9144af1923)		 Thiago Macieira <thiago.macieira@intel.com> no 2026-09-02
Add-SH-detection.patch Add SH description Upstream processes archs from time to time and tends to disable those that
they do not know wether they are working or not.
.
SH is working on Debian, so as an intermediate measure re enable it here.		 John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> no debian
remove_privacy_breaches.diff remove non-used privacy-breach code This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.		 Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org> not-needed 2015-02-18
build_path_embedded_qtbuildinternalsextra_cmake.patch cmake/QtBuildInternalsExtra.cmake.in: Patch out embedded build path.

The original build path should not be needed in the shipped package,
and causes reproducibility issues when built in different paths.

https://reproducible-builds.org/docs/build-path/		 Vagrant Cascadian <vagrant@reproducible-builds.org> no 2022-02-25
cross.patch no
cross2.patch diff --git a/cmake/QtWrapperScriptHelpers.cmake b/cmake/QtWrapperScriptHelpers.cmake
index f76d52bca91..273eea323d0 100644		 no
remove_rpath_from_examples.patch remove RPATH/RUNPATH from examples' binaries. On Debian the examples are built against system's libraries, so there is no
need to set RPATH/RUNPATH.		 Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org> not-needed 2024-02-15
forkfd_grow_stack_upwards_on_hppa.patch Change how stack grows on HPPA. On HPPA stack grows upwards. This patch introduces this change for
this 3rd party code.		 John David Anglin <dave.anglin@bell.net> no debian 2023-07-28
enable_skip_plugins.patch Enable skipping plugins search at build time. This patch sets
QT_SKIP_AUTO_PLUGIN_INCLUSION and QT_SKIP_AUTO_QML_PLUGIN_INCLUSION to ON
by default, thus avoiding unnecesary build dependencies on plugins.
.
The variables can still be set to OFF by the user at build time, allowing
them to find the packages if necessary. But if you need so for a Debian
package please reach the Qt maintainers first. We want to know why you
need to do so. Thanks in advance!		 Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org> not-needed

All known versions for source package 'qt6-base'

Links