1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Description: qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()
It is a precondition violation to call QByteArrayView::at() with
size() as argument. The code used that, though, as an implicit
end-of-string check, assuming == ' ' and == '=' would both fail for
null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
need not be null-terminated, so this could read even past size().
.
To fix, use higher-level API (startsWith()), consuming parsed tokens
along the way.
Origin: upstream, https://download.qt.io/official_releases/qt/5.15/CVE-2025-5455-qtbase-5.15.patch
Last-Update: 2025-06-29
--- a/src/corelib/io/qdataurl.cpp
+++ b/src/corelib/io/qdataurl.cpp
@@ -76,10 +76,11 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const
}
if (data.toLower().startsWith("charset")) {
- int i = 7; // strlen("charset")
- while (data.at(i) == ' ')
- ++i;
- if (data.at(i) == '=')
+ int prefixSize = 7; // strlen("charset")
+ QLatin1String copy(data.constData() + prefixSize, data.size() - prefixSize);
+ while (copy.startsWith(QLatin1String(" ")))
+ copy = copy.mid(1);
+ if (copy.startsWith(QLatin1String("=")))
data.prepend("text/plain;");
}
|
