[vlc-commits] [Git][videolan/vlc][3.0.x] 7 commits: contrib: qt: use proper git patch
Steve Lhomme (@robUx4)
gitlab at videolan.org
Thu Jul 9 07:06:02 UTC 2026
Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC
Commits:
93f933b4 by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qt: use proper git patch
- - - - -
a84d1fcd by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qt: use UNPACK_DIR rather than moving the folder manually
- - - - -
f4749733 by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qtsvg: use UNPACK_DIR rather than moving the folder manually
- - - - -
4edf0ade by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qt: apply security patches found in Qt 5.15
Cherry picked patches corresponding to https://download.qt.io/archive/qt/5.15/
Corresponds to these patches (with test code patches removed):
* CVE-2025-5455-qtbase-5.15.patch
* CVE-2025-4211-qtbase-5.15.diff
* CVE-2023-38197-qtbase-5.15.diff
* CVE-2023-37369-qtbase-5.15.diff
* CVE-2023-32763-qtbase-5.15.diff
* CVE-2023-24607-qtbase-5.15.diff
- - - - -
4789bbe0 by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qtsvg: apply security patches found in Qt 5.15
Cherry picked patches corresponding to https://download.qt.io/archive/qt/5.15/
Corresponds to these patches (with test code patches removed):
* CVE-2023-32573-qtsvg-5.15.diff
- - - - -
15df2ec5 by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qt: update some patches
We don't need to patch the test code.
- - - - -
a5b4002c by Steve Lhomme at 2026-07-09T05:51:31+00:00
contrib: qt: use the zlib from contribs
- - - - -
14 changed files:
- contrib/src/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames_56.patch → contrib/src/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames.patch
- + contrib/src/qt/0001-qDecodeDataUrl-fix-precondition-violation-in-call-to.patch
- + contrib/src/qt/0002-QFileSystemEngine-Win-Use-GetTempPath2-when-availabl.patch
- contrib/src/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi_56.patch → contrib/src/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi.patch
- + contrib/src/qt/0003-QXmlStreamReader-change-fastScanName-to-take-a-Value.patch
- + contrib/src/qt/0004-QXmlStreamReader-make-fastScanName-indicate-parsing-.patch
- + contrib/src/qt/0005-Fix-specific-overflow-in-qtextlayout.patch
- + contrib/src/qt/0006-ODBC-SQL-driver-deal-with-different-sizes-of-SQLTCHA.patch
- + contrib/src/qt/0007-Fix-crash-when-reading-corrupt-font-data.patch
- contrib/src/qt/0023-moc-get-the-system-defines-from-the-compiler-itself.patch
- contrib/src/qt/rules.mak
- contrib/src/qt/systray-no-sound.patch
- + contrib/src/qtsvg/0001-QSvgFont-Initialize-used-member-remove-unused.patch
- contrib/src/qtsvg/rules.mak
Changes:
=====================================
contrib/src/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames_56.patch → contrib/src/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames.patch
=====================================
@@ -1,7 +1,7 @@
-From 81ead1ff68711fed609cb47b33b3906c14ed95d5 Mon Sep 17 00:00:00 2001
+From 7b7c6312500a9e326ff94df5b016422e5b04e9f8 Mon Sep 17 00:00:00 2001
From: Friedemann Kleint <Friedemann.Kleint at qt.io>
Date: Mon, 14 Nov 2016 16:08:51 +0100
-Subject: [PATCH 1/2] Windows QPA: Reimplement calculation of window frames
+Subject: [PATCH 01/31] Windows QPA: Reimplement calculation of window frames
Instead of relying on AdjustWindowRectEx() and dirty-handling,
capture the rectangles before and after the processing of
@@ -16,14 +16,14 @@ Change-Id: If8364a5440a6324ea5d470bf5b74e68942285abe
Reviewed-by: Tim Jenssen <tim.jenssen at qt.io>
Reviewed-by: Oliver Wolff <oliver.wolff at qt.io>
---
- src/plugins/platforms/windows/qwindowscontext.cpp | 66 +++++++++++++++++++++--
- src/plugins/platforms/windows/qwindowscontext.h | 4 +-
- src/plugins/platforms/windows/qwindowswindow.cpp | 30 ++++-------
- src/plugins/platforms/windows/qwindowswindow.h | 2 +-
+ .../platforms/windows/qwindowscontext.cpp | 66 +++++++++++++++++--
+ .../platforms/windows/qwindowscontext.h | 4 +-
+ .../platforms/windows/qwindowswindow.cpp | 30 +++------
+ .../platforms/windows/qwindowswindow.h | 2 +-
4 files changed, 74 insertions(+), 28 deletions(-)
diff --git a/src/plugins/platforms/windows/qwindowscontext.cpp b/src/plugins/platforms/windows/qwindowscontext.cpp
-index b611843..9058993 100644
+index b6118431d32..90589934469 100644
--- a/src/plugins/platforms/windows/qwindowscontext.cpp
+++ b/src/plugins/platforms/windows/qwindowscontext.cpp
@@ -453,6 +453,11 @@ void QWindowsContext::setWindowCreationContext(const QSharedPointer<QWindowCreat
@@ -142,7 +142,7 @@ index b611843..9058993 100644
}
diff --git a/src/plugins/platforms/windows/qwindowscontext.h b/src/plugins/platforms/windows/qwindowscontext.h
-index 14baec9..dcac77c 100644
+index 14baec96d85..dcac77c2ff3 100644
--- a/src/plugins/platforms/windows/qwindowscontext.h
+++ b/src/plugins/platforms/windows/qwindowscontext.h
@@ -210,12 +210,14 @@ public:
@@ -162,10 +162,10 @@ index 14baec9..dcac77c 100644
void setTabletAbsoluteRange(int a);
void setProcessDpiAwareness(QtWindows::ProcessDpiAwareness dpiAwareness);
diff --git a/src/plugins/platforms/windows/qwindowswindow.cpp b/src/plugins/platforms/windows/qwindowswindow.cpp
-index b38d7c2..11ba9c1 100644
+index c2238639431..bd8149acf9c 100644
--- a/src/plugins/platforms/windows/qwindowswindow.cpp
+++ b/src/plugins/platforms/windows/qwindowswindow.cpp
-@@ -1630,7 +1630,6 @@ QWindowsWindowData QWindowsWindow::setWindowFlags_sys(Qt::WindowFlags wt,
+@@ -1644,7 +1644,6 @@ QWindowsWindowData QWindowsWindow::setWindowFlags_sys(Qt::WindowFlags wt,
QWindowsWindowData result = m_data;
result.flags = creationData.flags;
result.embedded = creationData.embedded;
@@ -173,7 +173,7 @@ index b38d7c2..11ba9c1 100644
return result;
}
-@@ -1638,7 +1637,6 @@ void QWindowsWindow::handleWindowStateChange(Qt::WindowState state)
+@@ -1652,7 +1651,6 @@ void QWindowsWindow::handleWindowStateChange(Qt::WindowState state)
{
qCDebug(lcQpaWindows) << __FUNCTION__ << this << window()
<< "\n from " << m_windowState << " to " << state;
@@ -181,7 +181,7 @@ index b38d7c2..11ba9c1 100644
m_windowState = state;
QWindowSystemInterface::handleWindowStateChanged(window(), state);
switch (state) {
-@@ -1715,8 +1713,6 @@ void QWindowsWindow::setWindowState_sys(Qt::WindowState newState)
+@@ -1729,8 +1727,6 @@ void QWindowsWindow::setWindowState_sys(Qt::WindowState newState)
const bool visible = isVisible();
@@ -190,7 +190,7 @@ index b38d7c2..11ba9c1 100644
if ((oldState == Qt::WindowFullScreen) != (newState == Qt::WindowFullScreen)) {
#ifdef Q_OS_WINCE
HWND handle = FindWindow(L"HHTaskBar", L"");
-@@ -1826,7 +1822,6 @@ void QWindowsWindow::setStyle(unsigned s) const
+@@ -1840,7 +1836,6 @@ void QWindowsWindow::setStyle(unsigned s) const
{
qCDebug(lcQpaWindows) << __FUNCTION__ << this << window() << debugWinStyle(s);
setFlag(WithinSetStyle);
@@ -198,7 +198,7 @@ index b38d7c2..11ba9c1 100644
SetWindowLongPtr(m_data.hwnd, GWL_STYLE, s);
clearFlag(WithinSetStyle);
}
-@@ -1835,7 +1830,6 @@ void QWindowsWindow::setExStyle(unsigned s) const
+@@ -1849,7 +1844,6 @@ void QWindowsWindow::setExStyle(unsigned s) const
{
qCDebug(lcQpaWindows).nospace() << __FUNCTION__ << ' ' << this << ' ' << window()
<< " 0x" << QByteArray::number(s, 16);
@@ -206,7 +206,7 @@ index b38d7c2..11ba9c1 100644
SetWindowLongPtr(m_data.hwnd, GWL_EXSTYLE, s);
}
-@@ -1909,22 +1903,17 @@ bool QWindowsWindow::handleGeometryChanging(MSG *message) const
+@@ -1923,22 +1917,17 @@ bool QWindowsWindow::handleGeometryChanging(MSG *message) const
return QWindowsWindow::handleGeometryChangingMessage(message, window(), margins);
}
@@ -238,7 +238,7 @@ index b38d7c2..11ba9c1 100644
}
void QWindowsWindow::setOpacity(qreal level)
-@@ -2322,7 +2311,6 @@ void QWindowsWindow::setCustomMargins(const QMargins &newCustomMargins)
+@@ -2336,7 +2325,6 @@ void QWindowsWindow::setCustomMargins(const QMargins &newCustomMargins)
const QPoint topLeft = currentFrameGeometry.topLeft();
QRect newFrame = currentFrameGeometry.marginsRemoved(oldCustomMargins) + m_data.customMargins;
newFrame.moveTo(topLeft);
@@ -247,7 +247,7 @@ index b38d7c2..11ba9c1 100644
<< currentFrameGeometry << "->" << newFrame;
SetWindowPos(m_data.hwnd, 0, newFrame.x(), newFrame.y(), newFrame.width(), newFrame.height(), SWP_NOZORDER | SWP_FRAMECHANGED);
diff --git a/src/plugins/platforms/windows/qwindowswindow.h b/src/plugins/platforms/windows/qwindowswindow.h
-index 6fffa1e..0e150a8 100644
+index 6fffa1e6e9e..0e150a835e1 100644
--- a/src/plugins/platforms/windows/qwindowswindow.h
+++ b/src/plugins/platforms/windows/qwindowswindow.h
@@ -119,7 +119,6 @@ public:
@@ -267,5 +267,5 @@ index 6fffa1e..0e150a8 100644
void setOpacity(qreal level) Q_DECL_OVERRIDE;
void setMask(const QRegion ®ion) Q_DECL_OVERRIDE;
--
-2.9.0.windows.1
+2.52.0.windows.1
=====================================
contrib/src/qt/0001-qDecodeDataUrl-fix-precondition-violation-in-call-to.patch
=====================================
@@ -0,0 +1,82 @@
+From 84790959cbc50d36c9eec5dfd7b24ea572aa9809 Mon Sep 17 00:00:00 2001
+From: Marc Mutz <marc.mutz at qt.io>
+Date: Fri, 25 Apr 2025 13:58:25 +0200
+Subject: [PATCH 1/7] qDecodeDataUrl(): fix precondition violation in call to
+ QByteArrayView::at()
+
+It is a precondition violation to call QByteArrayView::at() with
+size() as argument. The code used that, though, as an implicit
+end-of-string check, assuming == ' ' and == '=' would both fail for
+null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
+need not be null-terminated, so this could read even past size().
+
+To fix, use higher-level API (startsWith()), consuming parsed tokens
+along the way.
+
+Add a test that would crash in debug mode before the fix.
+
+Amends the start of the public history.
+
+Conflict resolution for 6.5:
+* Since the `data` variable is a QByteArray, use QBAV(data, size)
+ c-tor to construct `copy`;
+* Use sliced() instead of slice(), because the latter is only
+ available from 6.8.
+
+Conflict resolution for 5.15:
+* Use QLatin1String instead of QByteArrayView, because the latter
+ is not available in Qt 5.15. The `data` byte array might have
+ non-Latin1 characters, but that should not really matter for
+ this algorithm.
+* Use startsWith(QLatin1String) overload, because there's no
+ overload taking a char, and going via QChar will result in
+ comparing to QStringView, which should be a more expensive code
+ path.
+* Use mid(1) insteal of slice(1) or sliced(1), because both of
+ the latter do not exist in Qt 5.15.
+
+[ChangeLog][QtCore] Fixed a bug in the handling of data: URLs that
+could lead to a crash if Qt was built with assertions enabled. This
+affects QNetworkManager and links in QTextDocument.
+
+Pick-to: 5.15
+Change-Id: I4331c88051dfbb0a18fe7da4f50858c707785d09
+Reviewed-by: Thiago Macieira <thiago.macieira at intel.com>
+Reviewed-by: Ahmad Samir <a.samirh78 at gmail.com>
+Reviewed-by: Ivan Solovev <ivan.solovev at qt.io>
+(cherry picked from commit 4d839093b480d30eef8a89c0f864ee3f340adaa1)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot at qt-project.org>
+(cherry picked from commit 21cd27b3b9973f43df152a1dd9dadbbf905c6a73)
+(cherry picked from commit e56bf8d2953d760dfce1817be5f4782aa6fa9958)
+Reviewed-by: Edward Welbourne <edward.welbourne at qt.io>
+(cherry picked from commit c2a90cfcd65c257e1ddd4a6ba5d11046ab5236c3)
+
+Change-Id: I9cf807c3cb399c694f323e24143f40531d5a98e7
+edit: QLatin1String::startsWith() doesn't exist in Qt 5.6, use QByteArray instead.
+---
+ src/corelib/io/qdataurl.cpp | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/corelib/io/qdataurl.cpp b/src/corelib/io/qdataurl.cpp
+index 09f570be5a7..b1cb2ca2cee 100644
+--- a/src/corelib/io/qdataurl.cpp
++++ b/src/corelib/io/qdataurl.cpp
+@@ -70,10 +70,11 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const QUrl &uri, QString &mimeType, QByteArray
+ }
+
+ if (data.toLower().startsWith("charset")) {
+- int i = 7; // strlen("charset")
+- while (data.at(i) == ' ')
+- ++i;
+- if (data.at(i) == '=')
++ int prefixSize = 7; // strlen("charset")
++ QByteArray copy(data.constData() + prefixSize, data.size() - prefixSize);
++ while (copy.startsWith(QByteArray(" ")))
++ copy = copy.mid(1);
++ if (copy.startsWith(QByteArray("=")))
+ data.prepend("text/plain;");
+ }
+
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0002-QFileSystemEngine-Win-Use-GetTempPath2-when-availabl.patch
=====================================
@@ -0,0 +1,66 @@
+From d34b9f76e2766f0865536adc8fa94c8592ed667b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?M=C3=A5rten=20Nordheim?= <marten.nordheim at qt.io>
+Date: Mon, 17 Mar 2025 14:22:11 +0100
+Subject: [PATCH 2/7] QFileSystemEngine/Win: Use GetTempPath2 when available
+
+Because the documentation for GetTempPath nows says apps should call
+GetTempPath2.[0]
+
+Starting with Windows 11[1], and recently Windows 10[2],
+GetTempPath2 was added. The difference being that elevated
+processes are returned a different directory. Usually
+'C:\Windows\SystemTemp'.
+
+Currently temporary files of an elevated process may be placed in a
+world write-able location. GetTempPath2, by default, but can be
+overridden, places it in a directory that's only accessible by SYSTEM
+and administrators.
+
+[0] https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppathw#remarks
+[1] https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppath2w
+(Minimum supported client - Windows 11 Build 22000)
+[2] https://blogs.windows.com/windows-insider/2025/03/13/releasing-windows-10-build-19045-5674-to-the-release-preview-channel/
+(This update enables system processes to store temporary files ...)
+
+[ChangeLog][QtCore][Important Behavior Changes] On
+Windows, generating temporary directories for processes with elevated
+privileges may now return a different path with a stricter
+set of permissions. Please consult Microsoft's documentation from when
+they made the same change for the .NET framework:
+https://support.microsoft.com/en-us/topic/gettemppath-changes-in-windows-february-cumulative-update-preview-4cc631fb-9d97-4118-ab6d-f643cd0a7259
+
+Change-Id: I5caf11151fb2f711bbc5599231f140598b3c9d03
+Reviewed-by: Marc Mutz <marc.mutz at qt.io>
+(cherry picked from commit 69633bcb58e681bac5bff3744e5a2352788dc36c)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot at qt-project.org>
+(cherry picked from commit 6a684a53b371ec483b27bf243af24819be63f85f)
+(cherry picked from commit bbeccc0c22e520f46f0b33e281fa5ac85ac9c727)
+(cherry picked from commit 59d7eb9bbb4f13cccbd9323fd995a8c108b56e60)
+---
+ src/corelib/io/qfilesystemengine_win.cpp | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/corelib/io/qfilesystemengine_win.cpp b/src/corelib/io/qfilesystemengine_win.cpp
+index cf5092fec1f..07fbbc35c2d 100644
+--- a/src/corelib/io/qfilesystemengine_win.cpp
++++ b/src/corelib/io/qfilesystemengine_win.cpp
+@@ -1299,7 +1299,15 @@ QString QFileSystemEngine::tempPath()
+ QString ret;
+ #ifndef Q_OS_WINRT
+ wchar_t tempPath[MAX_PATH];
+- const DWORD len = GetTempPath(MAX_PATH, tempPath);
++ using GetTempPathPrototype = DWORD (WINAPI *)(DWORD, LPWSTR);
++ // We try to resolve GetTempPath2 and use that, otherwise fall back to GetTempPath:
++ static GetTempPathPrototype getTempPathW = []() {
++ const HMODULE kernel32 = GetModuleHandleW(L"kernel32.dll");
++ if (auto *func = QFunctionPointer(GetProcAddress(kernel32, "GetTempPath2W")))
++ return GetTempPathPrototype(func);
++ return GetTempPath;
++ }();
++ const DWORD len = getTempPathW(MAX_PATH, tempPath);
+ #ifdef Q_OS_WINCE
+ if (len)
+ ret = QString::fromWCharArray(tempPath, len);
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi_56.patch → contrib/src/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi.patch
=====================================
@@ -1,7 +1,7 @@
-From 8f39b5247c4f7766553131688f5d5b7193327336 Mon Sep 17 00:00:00 2001
+From 503a612ee020024c87d4f5a8307ad3d85be59c32 Mon Sep 17 00:00:00 2001
From: Friedemann Kleint <Friedemann.Kleint at qt.io>
Date: Mon, 7 Nov 2016 14:22:37 +0100
-Subject: [PATCH 2/2] Windows QPA: Use new EnableNonClientDpiScaling() for
+Subject: [PATCH 02/31] Windows QPA: Use new EnableNonClientDpiScaling() for
Windows decoration
Use newly introduced EnableNonClientDpiScaling() function to fix
@@ -12,13 +12,13 @@ Task-number: QTBUG-53255
Change-Id: Ic6e2f2a92f790259107d2a0837b96177cf3adb5f
Reviewed-by: Tim Jenssen <tim.jenssen at qt.io>
---
- src/plugins/platforms/windows/qtwindowsglobal.h | 3 ++
- src/plugins/platforms/windows/qwindowscontext.cpp | 35 ++++++++++++++++++++++-
- src/plugins/platforms/windows/qwindowscontext.h | 7 +++++
+ .../platforms/windows/qtwindowsglobal.h | 3 ++
+ .../platforms/windows/qwindowscontext.cpp | 35 ++++++++++++++++++-
+ .../platforms/windows/qwindowscontext.h | 7 ++++
3 files changed, 44 insertions(+), 1 deletion(-)
diff --git a/src/plugins/platforms/windows/qtwindowsglobal.h b/src/plugins/platforms/windows/qtwindowsglobal.h
-index 63c083d..e7e010d 100644
+index 63c083d2331..e7e010dee6b 100644
--- a/src/plugins/platforms/windows/qtwindowsglobal.h
+++ b/src/plugins/platforms/windows/qtwindowsglobal.h
@@ -87,6 +87,7 @@ enum WindowsEventType // Simplify event types
@@ -39,7 +39,7 @@ index 63c083d..e7e010d 100644
return QtWindows::CalculateSize;
#ifndef Q_OS_WINCE
diff --git a/src/plugins/platforms/windows/qwindowscontext.cpp b/src/plugins/platforms/windows/qwindowscontext.cpp
-index 9058993..ab0b3da 100644
+index 90589934469..ab0b3da0b83 100644
--- a/src/plugins/platforms/windows/qwindowscontext.cpp
+++ b/src/plugins/platforms/windows/qwindowscontext.cpp
@@ -140,6 +140,28 @@ static inline QWindowsSessionManager *platformSessionManager() {
@@ -106,7 +106,7 @@ index 9058993..ab0b3da 100644
return QWindowsGeometryHint::handleCalculateSize(d->m_creationContext->customMargins, msg, result);
case QtWindows::GeometryChangingEvent:
diff --git a/src/plugins/platforms/windows/qwindowscontext.h b/src/plugins/platforms/windows/qwindowscontext.h
-index dcac77c..156ede5 100644
+index dcac77c2ff3..156ede5d08d 100644
--- a/src/plugins/platforms/windows/qwindowscontext.h
+++ b/src/plugins/platforms/windows/qwindowscontext.h
@@ -96,6 +96,9 @@ struct QWindowsUser32DLL
@@ -131,5 +131,5 @@ index dcac77c..156ede5 100644
struct QWindowsShell32DLL
--
-2.9.0.windows.1
+2.52.0.windows.1
=====================================
contrib/src/qt/0003-QXmlStreamReader-change-fastScanName-to-take-a-Value.patch
=====================================
@@ -0,0 +1,118 @@
+From 466a167eeeef163ba251ce9c5793d8bc4edd0a95 Mon Sep 17 00:00:00 2001
+From: Ahmad Samir <a.samirh78 at gmail.com>
+Date: Wed, 12 Apr 2023 13:10:26 +0200
+Subject: [PATCH 3/7] QXmlStreamReader: change fastScanName() to take a Value*
+
+For easier debugging, e.g. to print out value.len and value.prefix.
+
+Manual conflict resolutions:
+ - qsizetype -> int
+ - qxmlstream.g generated code lands in qxmlstream_p.h, not in
+ qxmlstreamparser_p.h.
+
+Change-Id: Ib0eed38772f899502962f578775d34ea2744fdde
+Reviewed-by: Marc Mutz <marc.mutz at qt.io>
+(cherry picked from commit 1a423ce4372d18a779f3c0d746d5283d9a425839)
+Reviewed-by: Volker Hilsheimer <volker.hilsheimer at qt.io>
+Reviewed-by: Qt CI Bot <qt_ci_bot at qt-project.org>
+---
+ src/corelib/xml/qxmlstream.cpp | 16 ++++++++--------
+ src/corelib/xml/qxmlstream.g | 5 +++--
+ src/corelib/xml/qxmlstream_p.h | 5 +++--
+ 3 files changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/src/corelib/xml/qxmlstream.cpp b/src/corelib/xml/qxmlstream.cpp
+index 6ad06eaed6a..af2885fc609 100644
+--- a/src/corelib/xml/qxmlstream.cpp
++++ b/src/corelib/xml/qxmlstream.cpp
+@@ -1283,7 +1283,7 @@ inline int QXmlStreamReaderPrivate::fastScanContentCharList()
+ return n;
+ }
+
+-inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
++inline int QXmlStreamReaderPrivate::fastScanName(Value *val)
+ {
+ int n = 0;
+ uint c;
+@@ -1315,16 +1315,16 @@ inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
+ case '+':
+ case '*':
+ putChar(c);
+- if (prefix && *prefix == n+1) {
+- *prefix = 0;
++ if (val && val->prefix == n + 1) {
++ val->prefix = 0;
+ putChar(':');
+ --n;
+ }
+ return n;
+ case ':':
+- if (prefix) {
+- if (*prefix == 0) {
+- *prefix = n+2;
++ if (val) {
++ if (val->prefix == 0) {
++ val->prefix = n + 2;
+ } else { // only one colon allowed according to the namespace spec.
+ putChar(c);
+ return n;
+@@ -1340,8 +1340,8 @@ inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
+ }
+ }
+
+- if (prefix)
+- *prefix = 0;
++ if (val)
++ val->prefix = 0;
+ int pos = textBuffer.size() - n;
+ putString(textBuffer, pos);
+ textBuffer.resize(pos);
+diff --git a/src/corelib/xml/qxmlstream.g b/src/corelib/xml/qxmlstream.g
+index d6a06d1d7f6..5b9c2ba86ed 100644
+--- a/src/corelib/xml/qxmlstream.g
++++ b/src/corelib/xml/qxmlstream.g
+@@ -484,7 +484,7 @@ public:
+ int fastScanLiteralContent();
+ int fastScanSpace();
+ int fastScanContentCharList();
+- int fastScanName(int *prefix = 0);
++ int fastScanName(Value *val = 0);
+ inline int fastScanNMTOKEN();
+
+
+@@ -1776,7 +1776,8 @@ space_opt ::= space;
+ qname ::= LETTER;
+ /.
+ case $rule_number: {
+- sym(1).len += fastScanName(&sym(1).prefix);
++ Value &val = sym(1);
++ val.len += fastScanName(&val);
+ if (atEnd) {
+ resume($rule_number);
+ return false;
+diff --git a/src/corelib/xml/qxmlstream_p.h b/src/corelib/xml/qxmlstream_p.h
+index d22a697e5db..33c150706a8 100644
+--- a/src/corelib/xml/qxmlstream_p.h
++++ b/src/corelib/xml/qxmlstream_p.h
+@@ -979,7 +979,7 @@ public:
+ int fastScanLiteralContent();
+ int fastScanSpace();
+ int fastScanContentCharList();
+- int fastScanName(int *prefix = 0);
++ int fastScanName(Value *val = 0);
+ inline int fastScanNMTOKEN();
+
+
+@@ -1910,7 +1910,8 @@ bool QXmlStreamReaderPrivate::parse()
+ break;
+
+ case 262: {
+- sym(1).len += fastScanName(&sym(1).prefix);
++ Value &val = sym(1);
++ val.len += fastScanName(&val);
+ if (atEnd) {
+ resume(262);
+ return false;
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0004-QXmlStreamReader-make-fastScanName-indicate-parsing-.patch
=====================================
@@ -0,0 +1,241 @@
+From 1df95e38a82a3a22f0c89e4068ff0ff6c8cb1823 Mon Sep 17 00:00:00 2001
+From: Marc Mutz <marc.mutz at qt.io>
+Date: Wed, 28 Jun 2023 07:32:27 +0200
+Subject: [PATCH 4/7] QXmlStreamReader: make fastScanName() indicate parsing
+ status to callers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes a crash while parsing an XML file with garbage data, the file
+starts with '<' then garbage data:
+- The loop in the parse() keeps iterating until it hits "case 262:",
+ which calls fastScanName()
+- fastScanName() iterates over the text buffer scanning for the
+ attribute name (e.g. "xml:lang"), until it finds ':'
+- Consider a Value val, fastScanName() is called on it, it would set
+ val.prefix to a number > val.len, then it would hit the 4096 condition
+ and return (returned 0, now it returns the equivalent of
+ std::null_opt), which means that val.len doesn't get modified, making
+ it smaller than val.prefix
+- The code would try constructing an XmlStringRef with negative length,
+ which would hit an assert in one of QStringView's constructors
+
+Add an assert to the XmlStringRef constructor.
+
+Add unittest based on the file from the bug report.
+
+Later on I will replace FastScanNameResult with std::optional<qsizetype>
+(std::optional is C++17, which isn't required by Qt 5.15, and we want to
+backport this fix).
+
+Credit to OSS-Fuzz.
+
+Manual conflict resolutions:
+ - qsizetype → int
+ - Dropped (unneeded) _ba UDLs, which don't exist in Qt 5.
+ - qmlstream.g generated code goes to qxmlstream_p.h, not
+ qxmlstreamparser_p.h
+ - XmlStringRef doesn't exist in Qt 5, and adding the assert to public
+ QStringRef would be too much for a strict LTS branch
+ - Qt 5 needs explicit Q_DECLARE_METATYPE for enums.
+
+Fixes: QTBUG-109781
+Fixes: QTBUG-114829
+Change-Id: I455a5eeb47870c2ac9ffd0cbcdcd99c1ae2dd374
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen at qt.io>
+(cherry picked from commit 6326bec46a618c72feba4a2bb994c4d475050aed)
+Reviewed-by: Qt CI Bot <qt_ci_bot at qt-project.org>
+Reviewed-by: Volker Hilsheimer <volker.hilsheimer at qt.io>
+---
+ src/corelib/xml/qxmlstream.cpp | 26 +++++++++++++++++++++-----
+ src/corelib/xml/qxmlstream.g | 24 +++++++++++++++++++++---
+ src/corelib/xml/qxmlstream_p.h | 24 +++++++++++++++++++++---
+ 3 files changed, 63 insertions(+), 11 deletions(-)
+
+diff --git a/src/corelib/xml/qxmlstream.cpp b/src/corelib/xml/qxmlstream.cpp
+index af2885fc609..add953c2ad9 100644
+--- a/src/corelib/xml/qxmlstream.cpp
++++ b/src/corelib/xml/qxmlstream.cpp
+@@ -1283,11 +1283,19 @@ inline int QXmlStreamReaderPrivate::fastScanContentCharList()
+ return n;
+ }
+
+-inline int QXmlStreamReaderPrivate::fastScanName(Value *val)
++// Fast scan an XML attribute name (e.g. "xml:lang").
++inline QXmlStreamReaderPrivate::FastScanNameResult
++QXmlStreamReaderPrivate::fastScanName(Value *val)
+ {
+ int n = 0;
+ uint c;
+ while ((c = getChar()) != StreamEOF) {
++ if (n >= 4096) {
++ // This is too long to be a sensible name, and
++ // can exhaust memory, or the range of decltype(*prefix)
++ raiseNamePrefixTooLongError();
++ return {};
++ }
+ switch (c) {
+ case '\n':
+ case ' ':
+@@ -1320,18 +1328,18 @@ inline int QXmlStreamReaderPrivate::fastScanName(Value *val)
+ putChar(':');
+ --n;
+ }
+- return n;
++ return FastScanNameResult(n);
+ case ':':
+ if (val) {
+ if (val->prefix == 0) {
+ val->prefix = n + 2;
+ } else { // only one colon allowed according to the namespace spec.
+ putChar(c);
+- return n;
++ return FastScanNameResult(n);
+ }
+ } else {
+ putChar(c);
+- return n;
++ return FastScanNameResult(n);
+ }
+ // fall through
+ default:
+@@ -1345,7 +1353,7 @@ inline int QXmlStreamReaderPrivate::fastScanName(Value *val)
+ int pos = textBuffer.size() - n;
+ putString(textBuffer, pos);
+ textBuffer.resize(pos);
+- return 0;
++ return FastScanNameResult(0);
+ }
+
+ enum NameChar { NameBeginning, NameNotBeginning, NotName };
+@@ -1852,6 +1860,14 @@ void QXmlStreamReaderPrivate::raiseWellFormedError(const QString &message)
+ raiseError(QXmlStreamReader::NotWellFormedError, message);
+ }
+
++void QXmlStreamReaderPrivate::raiseNamePrefixTooLongError()
++{
++ // TODO: add a ImplementationLimitsExceededError and use it instead
++ raiseError(QXmlStreamReader::NotWellFormedError,
++ QXmlStream::tr("Length of XML attribute name exceeds implemnetation limits (4KiB "
++ "characters)."));
++}
++
+ void QXmlStreamReaderPrivate::parseError()
+ {
+
+diff --git a/src/corelib/xml/qxmlstream.g b/src/corelib/xml/qxmlstream.g
+index 5b9c2ba86ed..c0f25e63465 100644
+--- a/src/corelib/xml/qxmlstream.g
++++ b/src/corelib/xml/qxmlstream.g
+@@ -484,7 +484,16 @@ public:
+ int fastScanLiteralContent();
+ int fastScanSpace();
+ int fastScanContentCharList();
+- int fastScanName(Value *val = 0);
++
++ struct FastScanNameResult {
++ FastScanNameResult() : ok(false) {}
++ explicit FastScanNameResult(int len) : addToLen(len), ok(true) { }
++ operator bool() { return ok; }
++ int operator*() { Q_ASSERT(ok); return addToLen; }
++ int addToLen;
++ bool ok;
++ };
++ FastScanNameResult fastScanName(Value *val = 0);
+ inline int fastScanNMTOKEN();
+
+
+@@ -493,6 +502,7 @@ public:
+
+ void raiseError(QXmlStreamReader::Error error, const QString& message = QString());
+ void raiseWellFormedError(const QString &message);
++ void raiseNamePrefixTooLongError();
+
+ QXmlStreamEntityResolver *entityResolver;
+
+@@ -1777,7 +1787,11 @@ qname ::= LETTER;
+ /.
+ case $rule_number: {
+ Value &val = sym(1);
+- val.len += fastScanName(&val);
++ if (auto res = fastScanName(&val))
++ val.len += *res;
++ else
++ return false;
++
+ if (atEnd) {
+ resume($rule_number);
+ return false;
+@@ -1788,7 +1802,11 @@ qname ::= LETTER;
+ name ::= LETTER;
+ /.
+ case $rule_number:
+- sym(1).len += fastScanName();
++ if (auto res = fastScanName())
++ sym(1).len += *res;
++ else
++ return false;
++
+ if (atEnd) {
+ resume($rule_number);
+ return false;
+diff --git a/src/corelib/xml/qxmlstream_p.h b/src/corelib/xml/qxmlstream_p.h
+index 33c150706a8..ddd24e74472 100644
+--- a/src/corelib/xml/qxmlstream_p.h
++++ b/src/corelib/xml/qxmlstream_p.h
+@@ -979,7 +979,16 @@ public:
+ int fastScanLiteralContent();
+ int fastScanSpace();
+ int fastScanContentCharList();
+- int fastScanName(Value *val = 0);
++
++ struct FastScanNameResult {
++ FastScanNameResult() : ok(false) {}
++ explicit FastScanNameResult(int len) : addToLen(len), ok(true) { }
++ operator bool() { return ok; }
++ int operator*() { Q_ASSERT(ok); return addToLen; }
++ int addToLen;
++ bool ok;
++ };
++ FastScanNameResult fastScanName(Value *val = 0);
+ inline int fastScanNMTOKEN();
+
+
+@@ -988,6 +997,7 @@ public:
+
+ void raiseError(QXmlStreamReader::Error error, const QString& message = QString());
+ void raiseWellFormedError(const QString &message);
++ void raiseNamePrefixTooLongError();
+
+ QXmlStreamEntityResolver *entityResolver;
+
+@@ -1911,7 +1921,11 @@ bool QXmlStreamReaderPrivate::parse()
+
+ case 262: {
+ Value &val = sym(1);
+- val.len += fastScanName(&val);
++ if (auto res = fastScanName(&val))
++ val.len += *res;
++ else
++ return false;
++
+ if (atEnd) {
+ resume(262);
+ return false;
+@@ -1919,7 +1933,11 @@ bool QXmlStreamReaderPrivate::parse()
+ } break;
+
+ case 263:
+- sym(1).len += fastScanName();
++ if (auto res = fastScanName())
++ sym(1).len += *res;
++ else
++ return false;
++
+ if (atEnd) {
+ resume(263);
+ return false;
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0005-Fix-specific-overflow-in-qtextlayout.patch
=====================================
@@ -0,0 +1,102 @@
+From deaddcaac1d3966119b0569a4a7a4d1d43db0eb6 Mon Sep 17 00:00:00 2001
+From: Allan Sandfeld Jensen <allan.jensen at qt.io>
+Date: Fri, 5 May 2023 09:51:32 +0200
+Subject: [PATCH 5/7] Fix specific overflow in qtextlayout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Adds qAddOverflow and qMulOverflow definitions to QFixed
+
+edit: Use __builtin_add_overflow() directly as add_overflow() doesn't support
+signed values in Qt 5.6.
+
+Fixes: QTBUG-113337
+Change-Id: I13579306defceaccdc0fbb1ec0e9b77c6f8d1af9
+Reviewed-by: Eirik Aavitsland <eirik.aavitsland at qt.io>
+Reviewed-by: Thiago Macieira <thiago.macieira at intel.com>
+(cherry picked from commit 7b7a01c266b507636eab51a36328c7c72d82d93c)
+Reviewed-by: Michael Brüning <michael.bruning at qt.io>
+Reviewed-by: Qt CI Bot <qt_ci_bot at qt-project.org>
+---
+ src/gui/painting/qfixed_p.h | 16 ++++++++++++++++
+ src/gui/text/qtextlayout.cpp | 9 ++++++---
+ src/plugins/platforms/windows/windows.pri | 2 +-
+ 3 files changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/src/gui/painting/qfixed_p.h b/src/gui/painting/qfixed_p.h
+index c29dacae3da..5d70fe0b618 100644
+--- a/src/gui/painting/qfixed_p.h
++++ b/src/gui/painting/qfixed_p.h
+@@ -45,10 +45,18 @@
+ // We mean it.
+ //
+
++// clang-format off
++
+ #include "QtCore/qdebug.h"
+ #include "QtCore/qpoint.h"
++#if defined(Q_OS_WIN)
++#include <qt_windows.h> // to suppress min, max macros.
++#endif
++#include <QtCore/private/qnumeric_p.h>
+ #include "QtCore/qsize.h"
+
++// clang-format on
++
+ QT_BEGIN_NAMESPACE
+
+ struct QFixed {
+@@ -175,6 +183,14 @@ Q_DECL_CONSTEXPR inline bool operator<(int i, const QFixed &f) { return i * 64 <
+ Q_DECL_CONSTEXPR inline bool operator>(const QFixed &f, int i) { return f.value() > i * 64; }
+ Q_DECL_CONSTEXPR inline bool operator>(int i, const QFixed &f) { return i * 64 > f.value(); }
+
++inline bool qAddOverflow(QFixed v1, QFixed v2, QFixed *r)
++{
++ int val;
++ bool result = __builtin_add_overflow(v1.value(), v2.value(), &val);
++ r->setValue(val);
++ return result;
++}
++
+ #ifndef QT_NO_DEBUG_STREAM
+ inline QDebug &operator<<(QDebug &dbg, const QFixed &f)
+ { return dbg << f.toReal(); }
+diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp
+index ac2895aeb30..8d0b78f4655 100644
+--- a/src/gui/text/qtextlayout.cpp
++++ b/src/gui/text/qtextlayout.cpp
+@@ -2034,11 +2034,14 @@ found:
+ eng->maxWidth = qMax(eng->maxWidth, line.textWidth);
+ } else {
+ eng->minWidth = qMax(eng->minWidth, lbh.minw);
+- eng->maxWidth += line.textWidth;
++ if (qAddOverflow(eng->maxWidth, line.textWidth, &eng->maxWidth))
++ eng->maxWidth = QFIXED_MAX;
+ }
+
+- if (line.textWidth > 0 && item < eng->layoutData->items.size())
+- eng->maxWidth += lbh.spaceData.textWidth;
++ if (line.textWidth > 0 && item < eng->layoutData->items.size()) {
++ if (qAddOverflow(eng->maxWidth, lbh.spaceData.textWidth, &eng->maxWidth))
++ eng->maxWidth = QFIXED_MAX;
++ }
+ if (eng->option.flags() & QTextOption::IncludeTrailingSpaces)
+ line.textWidth += lbh.spaceData.textWidth;
+ if (lbh.spaceData.length) {
+diff --git a/src/plugins/platforms/windows/windows.pri b/src/plugins/platforms/windows/windows.pri
+index aee69273389..5681ca7d736 100644
+--- a/src/plugins/platforms/windows/windows.pri
++++ b/src/plugins/platforms/windows/windows.pri
+@@ -10,7 +10,7 @@ mingw: LIBS *= -luuid
+ !wince: LIBS *= -ladvapi32
+ wince: DEFINES *= QT_LIBINFIX=L"\"\\\"$${QT_LIBINFIX}\\\"\""
+
+-DEFINES *= QT_NO_CAST_FROM_ASCII
++DEFINES *= QT_NO_CAST_FROM_ASCII NOMINMAX
+
+ contains(QT_CONFIG, directwrite) {
+ SOURCES += $$PWD/qwindowsfontenginedirectwrite.cpp
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0006-ODBC-SQL-driver-deal-with-different-sizes-of-SQLTCHA.patch
=====================================
@@ -0,0 +1,87 @@
+From 67abc7e21b351f07c186988ff93476db0a600349 Mon Sep 17 00:00:00 2001
+From: Marc Mutz <marc.mutz at qt.io>
+Date: Tue, 24 Jan 2023 14:29:27 +0100
+Subject: [PATCH 6/7] ODBC SQL driver: deal with different sizes of SQLTCHAR
+ correctly
+
+Neither the UTF-32, nor the UTF-8 recoding of a UTF-16 string is
+necessarily of the same length as the input. The UTF-32 version may
+be shorter, if surrogate pairs were encountered. The UTF-8 version
+will be longer whenever the string contains non-US-ASCII characters.
+
+Split toSQLTCHAR() into three functions, templated on sizeof(SQLTCHAR),
+and use QVLA's range-append instead of manual memcpy()s.
+
+This patch specifically doesn't use constexpr-if, as that's not
+available until C++17, which Qt 5 doesn't require.
+
+Change-Id: I0bfcb66eb321598908ef00ac34c888fdbccf9316
+Reviewed-by: Christian Ehrlicher <ch.ehrlicher at gmx.de>
+Reviewed-by: Thiago Macieira <thiago.macieira at intel.com>
+(cherry picked from commit 66767eea46bea0f19f8ae5ad6ebc641d86867701)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot at qt-project.org>
+---
+ src/sql/drivers/odbc/qsql_odbc.cpp | 44 ++++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/src/sql/drivers/odbc/qsql_odbc.cpp b/src/sql/drivers/odbc/qsql_odbc.cpp
+index 8a3919267f2..2f4a35f12ef 100644
+--- a/src/sql/drivers/odbc/qsql_odbc.cpp
++++ b/src/sql/drivers/odbc/qsql_odbc.cpp
+@@ -83,23 +83,39 @@ inline static QString fromSQLTCHAR(const QVarLengthArray<SQLTCHAR>& input, int s
+ return result;
+ }
+
++template <size_t SizeOfChar = sizeof(SQLTCHAR)>
++void toSQLTCHARImpl(QVarLengthArray<SQLTCHAR> &result, const QString &input); // primary template undefined
++
++template <typename Container>
++void do_append(QVarLengthArray<SQLTCHAR> &result, const Container &c)
++{
++ result.append(reinterpret_cast<const SQLTCHAR *>(c.data()), c.size());
++}
++
++template <>
++void toSQLTCHARImpl<1>(QVarLengthArray<SQLTCHAR> &result, const QString &input)
++{
++ const auto u8 = input.toUtf8();
++ do_append(result, u8);
++}
++
++template <>
++void toSQLTCHARImpl<2>(QVarLengthArray<SQLTCHAR> &result, const QString &input)
++{
++ do_append(result, input);
++}
++
++template <>
++void toSQLTCHARImpl<4>(QVarLengthArray<SQLTCHAR> &result, const QString &input)
++{
++ const auto u32 = input.toUcs4();
++ do_append(result, u32);
++}
++
+ inline static QVarLengthArray<SQLTCHAR> toSQLTCHAR(const QString &input)
+ {
+ QVarLengthArray<SQLTCHAR> result;
+- result.resize(input.size());
+- switch(sizeof(SQLTCHAR)) {
+- case 1:
+- memcpy(result.data(), input.toUtf8().data(), input.size());
+- break;
+- case 2:
+- memcpy(result.data(), input.unicode(), input.size() * 2);
+- break;
+- case 4:
+- memcpy(result.data(), input.toUcs4().data(), input.size() * 4);
+- break;
+- default:
+- qCritical("sizeof(SQLTCHAR) is %d. Don't know how to handle this.", int(sizeof(SQLTCHAR)));
+- }
++ toSQLTCHARImpl(result, input);
+ result.append(0); // make sure it's null terminated, doesn't matter if it already is, it does if it isn't.
+ return result;
+ }
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0007-Fix-crash-when-reading-corrupt-font-data.patch
=====================================
@@ -0,0 +1,140 @@
+From 0dc898e11825d7e5d8ad49be41235bb2675b6fda Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4_qt at ycbcr.xyz>
+Date: Wed, 8 Jul 2026 07:23:56 +0200
+Subject: [PATCH 7/7] Fix crash when reading corrupt font data When loading the
+ font data, we had some unprotected reads. To harden this, we check everything
+ against the length of the font data before reading.
+
+[ChangeLog][QtGui][Windows] Fixed a possible crash that could happen
+when loading corrupted font data.
+
+Fixes: QTBUG-116773
+Pick-to: 5.15 6.2 6.5 6.6 6.6.0
+Change-Id: I156df3b8833c9ed785fcc690821a7a74d9a51126
+Reviewed-by: Lars Knoll <lars at knoll.priv.no>
+Reviewed-by: Thiago Macieira <thiago.macieira at intel.com>
+Reviewed-by: Qt CI Bot <qt_ci_bot at qt-project.org>
+---
+ .../windows/qwindowsfontdatabase.cpp | 67 ++++++++++++++-----
+ 1 file changed, 51 insertions(+), 16 deletions(-)
+
+diff --git a/src/plugins/platforms/windows/qwindowsfontdatabase.cpp b/src/plugins/platforms/windows/qwindowsfontdatabase.cpp
+index 4be215ec8af..2442d647b1f 100644
+--- a/src/plugins/platforms/windows/qwindowsfontdatabase.cpp
++++ b/src/plugins/platforms/windows/qwindowsfontdatabase.cpp
+@@ -1295,36 +1295,70 @@ QT_WARNING_POP
+ return fontEngine;
+ }
+
+-static QList<quint32> getTrueTypeFontOffsets(const uchar *fontData)
++static QList<quint32> getTrueTypeFontOffsets(const uchar *fontData, const uchar *fileEndSentinel)
+ {
+ QList<quint32> offsets;
+- const quint32 headerTag = *reinterpret_cast<const quint32 *>(fontData);
++ if (fileEndSentinel - fontData < 12) {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
++ return offsets;
++ }
++
++ const quint32 headerTag = qFromUnaligned<quint32>(fontData);
+ if (headerTag != MAKE_TAG('t', 't', 'c', 'f')) {
+ if (headerTag != MAKE_TAG(0, 1, 0, 0)
+ && headerTag != MAKE_TAG('O', 'T', 'T', 'O')
+ && headerTag != MAKE_TAG('t', 'r', 'u', 'e')
+- && headerTag != MAKE_TAG('t', 'y', 'p', '1'))
++ && headerTag != MAKE_TAG('t', 'y', 'p', '1')) {
+ return offsets;
++ }
+ offsets << 0;
+ return offsets;
+ }
++
++ const quint32 maximumNumFonts = 0xffff;
+ const quint32 numFonts = qFromBigEndian<quint32>(fontData + 8);
+- for (uint i = 0; i < numFonts; ++i) {
+- offsets << qFromBigEndian<quint32>(fontData + 12 + i * 4);
++ if (numFonts > maximumNumFonts) {
++ qCWarning(lcQpaFonts) << "Font collection of" << numFonts << "fonts is too large. Aborting.";
++ return offsets;
++ }
++
++ if (quintptr(fileEndSentinel - fontData) > 12 + (numFonts - 1) * 4) {
++ for (quint32 i = 0; i < numFonts; ++i)
++ offsets << qFromBigEndian<quint32>(fontData + 12 + i * 4);
++ } else {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
+ }
++
+ return offsets;
+ }
+
+-static void getFontTable(const uchar *fileBegin, const uchar *data, quint32 tag, const uchar **table, quint32 *length)
++static void getFontTable(const uchar *fileBegin, const uchar *fileEndSentinel, const uchar *data, quint32 tag, const uchar **table, quint32 *length)
+ {
+- const quint16 numTables = qFromBigEndian<quint16>(data + 4);
+- for (uint i = 0; i < numTables; ++i) {
+- const quint32 offset = 12 + 16 * i;
+- if (*reinterpret_cast<const quint32 *>(data + offset) == tag) {
+- *table = fileBegin + qFromBigEndian<quint32>(data + offset + 8);
+- *length = qFromBigEndian<quint32>(data + offset + 12);
+- return;
++ if (fileEndSentinel - data >= 6) {
++ const quint16 numTables = qFromBigEndian<quint16>(data + 4);
++ if (fileEndSentinel - data >= 28 + 16 * (numTables - 1)) {
++ for (quint32 i = 0; i < numTables; ++i) {
++ const quint32 offset = 12 + 16 * i;
++ if (qFromUnaligned<quint32>(data + offset) == tag) {
++ const quint32 tableOffset = qFromBigEndian<quint32>(data + offset + 8);
++ if (quintptr(fileEndSentinel - fileBegin) <= tableOffset) {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
++ break;
++ }
++ *table = fileBegin + tableOffset;
++ *length = qFromBigEndian<quint32>(data + offset + 12);
++ if (quintptr(fileEndSentinel - *table) < *length) {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
++ break;
++ }
++ return;
++ }
++ }
++ } else {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
+ }
++ } else {
++ qCWarning(lcQpaFonts) << "Corrupted font data detected";
+ }
+ *table = 0;
+ *length = 0;
+@@ -1336,8 +1370,9 @@ static void getFamiliesAndSignatures(const QByteArray &fontData,
+ QVector<FONTSIGNATURE> *signatures)
+ {
+ const uchar *data = reinterpret_cast<const uchar *>(fontData.constData());
++ const uchar *dataEndSentinel = data + fontData.size();
+
+- QList<quint32> offsets = getTrueTypeFontOffsets(data);
++ QList<quint32> offsets = getTrueTypeFontOffsets(data, dataEndSentinel);
+ if (offsets.isEmpty())
+ return;
+
+@@ -1345,7 +1380,7 @@ static void getFamiliesAndSignatures(const QByteArray &fontData,
+ const uchar *font = data + offsets.at(i);
+ const uchar *table;
+ quint32 length;
+- getFontTable(data, font, MAKE_TAG('n', 'a', 'm', 'e'), &table, &length);
++ getFontTable(data, dataEndSentinel, font, MAKE_TAG('n', 'a', 'm', 'e'), &table, &length);
+ if (!table)
+ continue;
+ QString name = getEnglishName(table, length);
+@@ -1356,7 +1391,7 @@ static void getFamiliesAndSignatures(const QByteArray &fontData,
+
+ if (signatures) {
+ FONTSIGNATURE signature;
+- getFontTable(data, font, MAKE_TAG('O', 'S', '/', '2'), &table, &length);
++ getFontTable(data, dataEndSentinel, font, MAKE_TAG('O', 'S', '/', '2'), &table, &length);
+ if (table && length >= 86) {
+ // Offsets taken from OS/2 table in the TrueType spec
+ signature.fsUsb[0] = qFromBigEndian<quint32>(table + 42);
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qt/0023-moc-get-the-system-defines-from-the-compiler-itself.patch
=====================================
@@ -1,7 +1,7 @@
-From 89074d0a7e4a038edef8aa0d05609ac33e83d32b Mon Sep 17 00:00:00 2001
+From eafc9dab7d4bb6a7e62438139d220cd1283b9ee8 Mon Sep 17 00:00:00 2001
From: Thiago Macieira <thiago.macieira at intel.com>
Date: Fri, 21 Aug 2015 17:08:19 -0700
-Subject: [PATCH 23/23] moc: get the system #defines from the compiler itself
+Subject: [PATCH 23/31] moc: get the system #defines from the compiler itself
In order for moc to properly parse #ifdefs and family, we've had
QMAKE_COMPILER_DEFINES as a list of pre-defined macros from the
@@ -27,8 +27,6 @@ Backport-Of: 36d524e6a3b64a8c35805c1b868d6d67ccae765c (v5.8.0)
src/tools/moc/main.cpp | 17 ++++++-
src/tools/moc/preprocessor.cpp | 58 ++++++++++++----------
src/tools/moc/preprocessor.h | 1 +
- tests/auto/tools/moc/subdir/extradefines.h | 1 +
- tests/auto/tools/moc/tst_moc.cpp | 42 ++++++++++++++++
7 files changed, 155 insertions(+), 30 deletions(-)
create mode 100644 tests/auto/tools/moc/subdir/extradefines.h
@@ -287,73 +285,6 @@ index 9c81f86f9c4..d876caf7297 100644
Symbols preprocessed(const QByteArray &filename, QFile *device);
void parseDefineArguments(Macro *m);
-diff --git a/tests/auto/tools/moc/subdir/extradefines.h b/tests/auto/tools/moc/subdir/extradefines.h
-new file mode 100644
-index 00000000000..e7888ce80de
---- /dev/null
-+++ b/tests/auto/tools/moc/subdir/extradefines.h
-@@ -0,0 +1 @@
-+#define FOO 1
-diff --git a/tests/auto/tools/moc/tst_moc.cpp b/tests/auto/tools/moc/tst_moc.cpp
-index d00a86a9e5a..e2c87e923a4 100644
---- a/tests/auto/tools/moc/tst_moc.cpp
-+++ b/tests/auto/tools/moc/tst_moc.cpp
-@@ -587,6 +587,8 @@ private slots:
- void frameworkSearchPath();
- void cstyleEnums();
- void defineMacroViaCmdline();
-+ void defineMacroViaForcedInclude();
-+ void defineMacroViaForcedIncludeRelative();
- void specifyMetaTagsFromCmdline();
- void invokable();
- void singleFunctionKeywordSignalAndSlot();
-@@ -1264,6 +1266,46 @@ void tst_Moc::defineMacroViaCmdline()
- #endif
- }
-
-+void tst_Moc::defineMacroViaForcedInclude()
-+{
-+#if defined(Q_OS_LINUX) && defined(Q_CC_GNU) && !defined(QT_NO_PROCESS)
-+ QProcess proc;
-+
-+ QStringList args;
-+ args << "--include" << m_sourceDirectory + QLatin1String("/subdir/extradefines.h");
-+ args << m_sourceDirectory + QStringLiteral("/macro-on-cmdline.h");
-+
-+ proc.start(m_moc, args);
-+ QVERIFY(proc.waitForFinished());
-+ QCOMPARE(proc.exitCode(), 0);
-+ QCOMPARE(proc.readAllStandardError(), QByteArray());
-+ QByteArray mocOut = proc.readAllStandardOutput();
-+ QVERIFY(!mocOut.isEmpty());
-+#else
-+ QSKIP("Only tested on linux/gcc");
-+#endif
-+}
-+
-+void tst_Moc::defineMacroViaForcedIncludeRelative()
-+{
-+#if defined(Q_OS_LINUX) && defined(Q_CC_GNU) && !defined(QT_NO_PROCESS)
-+ QProcess proc;
-+
-+ QStringList args;
-+ args << "--include" << QStringLiteral("extradefines.h") << "-I" + m_sourceDirectory + "/subdir";
-+ args << m_sourceDirectory + QStringLiteral("/macro-on-cmdline.h");
-+
-+ proc.start(m_moc, args);
-+ QVERIFY(proc.waitForFinished());
-+ QCOMPARE(proc.exitCode(), 0);
-+ QCOMPARE(proc.readAllStandardError(), QByteArray());
-+ QByteArray mocOut = proc.readAllStandardOutput();
-+ QVERIFY(!mocOut.isEmpty());
-+#else
-+ QSKIP("Only tested on linux/gcc");
-+#endif
-+}
-+
- // tst_Moc::specifyMetaTagsFromCmdline()
- // plugin_metadata.h contains a plugin which we register here. Since we're not building this
- // application as a plugin, we need top copy some of the initializer code found in qplugin.h:
--
-2.43.0
+2.52.0.windows.1
=====================================
contrib/src/qt/rules.mak
=====================================
@@ -14,16 +14,18 @@ ifeq ($(call need_pkg,"Qt5Core Qt5Gui Qt5Widgets"),)
PKGS_FOUND += qt
endif
+DEPS_qt = zlib $(DEPS_zlib)
+
$(TARBALLS)/qt-$(QT_VERSION).tar.xz:
$(call download_pkg,$(QT_URL),qt)
.sum-qt: qt-$(QT_VERSION).tar.xz
+qt: UNPACK_DIR=qtbase-opensource-src-$(QT_VERSION)
qt: qt-$(QT_VERSION).tar.xz .sum-qt
$(UNPACK)
- mv qtbase-opensource-src-$(QT_VERSION) qt-$(QT_VERSION)
- $(APPLY) $(SRC)/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames_56.patch
- $(APPLY) $(SRC)/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi_56.patch
+ $(APPLY) $(SRC)/qt/0001-Windows-QPA-Reimplement-calculation-of-window-frames.patch
+ $(APPLY) $(SRC)/qt/0002-Windows-QPA-Use-new-EnableNonClientDpiScaling-for-Wi.patch
$(APPLY) $(SRC)/qt/0003-QPA-prefer-lower-value-when-rounding-fractional-scaling.patch
$(APPLY) $(SRC)/qt/0004-qmake-don-t-limit-command-line-length-when-not-actua.patch
$(APPLY) $(SRC)/qt/0005-harfbuzz-Fix-building-for-win64-with-clang.patch
@@ -46,6 +48,13 @@ qt: qt-$(QT_VERSION).tar.xz .sum-qt
$(APPLY) $(SRC)/qt/0022-Don-t-error-out-on-preprocessor-concatenation-of-two.patch
$(APPLY) $(SRC)/qt/0023-moc-get-the-system-defines-from-the-compiler-itself.patch
$(APPLY) $(SRC)/qt/systray-no-sound.patch
+ $(APPLY) $(SRC)/qt/0001-qDecodeDataUrl-fix-precondition-violation-in-call-to.patch
+ $(APPLY) $(SRC)/qt/0002-QFileSystemEngine-Win-Use-GetTempPath2-when-availabl.patch
+ $(APPLY) $(SRC)/qt/0003-QXmlStreamReader-change-fastScanName-to-take-a-Value.patch
+ $(APPLY) $(SRC)/qt/0004-QXmlStreamReader-make-fastScanName-indicate-parsing-.patch
+ $(APPLY) $(SRC)/qt/0005-Fix-specific-overflow-in-qtextlayout.patch
+ $(APPLY) $(SRC)/qt/0006-ODBC-SQL-driver-deal-with-different-sizes-of-SQLTCHA.patch
+ $(APPLY) $(SRC)/qt/0007-Fix-crash-when-reading-corrupt-font-data.patch
# fix forcing the WINVER/_WIN32_WINNT version without NTDDI_VERSION
sed -i.orig -e "s/DEFINES += WINVER/DEFINES += NTDDI_VERSION=0x06000000 WINVER/" "$(UNPACK_DIR)/src/network/kernel/kernel.pri"
# TOUCHINPUT is properly defined in mingw since v4
@@ -64,10 +73,10 @@ endif
QT_PLATFORM := -xplatform $(QT_SPEC) -device-option CROSS_COMPILE=$(HOST)-
endif
-QT_CONFIG := -static -opensource -confirm-license -no-pkg-config \
+QT_CONFIG := -static -opensource -confirm-license -no-pkg-config -system-zlib \
-no-sql-sqlite -no-gif -qt-libjpeg -no-openssl -no-opengl -no-dbus \
-no-qml-debug -no-audio-backend -no-sql-odbc -no-pch \
- -no-compile-examples -nomake examples
+ -no-compile-examples -nomake examples -I $(PREFIX)/include
ifdef HAVE_WIN32
QT_CONFIG += -no-xcb
endif
=====================================
contrib/src/qt/systray-no-sound.patch
=====================================
@@ -1,6 +1,20 @@
---- qt/src/widgets/util/qsystemtrayicon_win.cpp.old
-+++ qt/src/widgets/util/qsystemtrayicon_win.cpp
-@@ -258,6 +258,10 @@ bool QSystemTrayIconSys::showMessage(con
+From ee4ae8b0134b1c2eb6433fe15c380695f9da7a38 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Hugo=20Beauz=C3=A9e-Luyssen?= <hugo at beauzee.fr>
+Date: Fri, 21 Jul 2017 17:34:48 +0200
+Subject: [PATCH] Disable systray notification sounds
+
+Fix #18530
+
+Change-Id: I97c25deb360ea4cd9d95ed464d154eece3333925
+---
+ src/widgets/util/qsystemtrayicon_win.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/widgets/util/qsystemtrayicon_win.cpp b/src/widgets/util/qsystemtrayicon_win.cpp
+index 221d040599b..dc2b00ef862 100644
+--- a/src/widgets/util/qsystemtrayicon_win.cpp
++++ b/src/widgets/util/qsystemtrayicon_win.cpp
+@@ -258,6 +258,10 @@ bool QSystemTrayIconSys::showMessage(const QString &title, const QString &messag
}
if (QSysInfo::windowsVersion() >= QSysInfo::WV_VISTA)
tnd.dwInfoFlags |= NIIF_LARGE_ICON;
@@ -11,3 +25,6 @@
tnd.cbSize = notifyIconSize;
tnd.hWnd = m_hwnd;
tnd.uTimeout = uSecs;
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qtsvg/0001-QSvgFont-Initialize-used-member-remove-unused.patch
=====================================
@@ -0,0 +1,59 @@
+From 5dc3b4e15152590141d05d4cf72fe099ecaf244a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Robert=20L=C3=B6hning?= <robert.loehning at qt.io>
+Date: Mon, 24 Apr 2023 15:27:17 +0200
+Subject: [PATCH] QSvgFont: Initialize used member, remove unused
+
+Credit to OSS-Fuzz
+
+[ChangeLog][QtSvg] Fixed undefined behavior from using uninitialized
+variable.
+
+Coverity-Id: 22618
+Change-Id: Id52277bb0e2845f4d342e187dbb8093e9276b70c
+Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt at qt.io>
+(cherry picked from commit ff22c3ccf8ccf813fdcfda23f7740ba73ba5ce0a)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot at qt-project.org>
+---
+ src/svg/qsvgfont_p.h | 5 ++---
+ src/svg/qsvghandler.cpp | 2 +-
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/src/svg/qsvgfont_p.h b/src/svg/qsvgfont_p.h
+index 681330ae..034a0ebd 100644
+--- a/src/svg/qsvgfont_p.h
++++ b/src/svg/qsvgfont_p.h
+@@ -68,6 +68,7 @@ public:
+ class Q_SVG_PRIVATE_EXPORT QSvgFont : public QSvgRefCounted
+ {
+ public:
++ static constexpr qreal DEFAULT_UNITS_PER_EM = 1000;
+ QSvgFont(qreal horizAdvX);
+
+ void setFamilyName(const QString &name);
+@@ -80,9 +81,7 @@ public:
+ void draw(QPainter *p, const QPointF &point, const QString &str, qreal pixelSize, Qt::Alignment alignment) const;
+ public:
+ QString m_familyName;
+- qreal m_unitsPerEm;
+- qreal m_ascent;
+- qreal m_descent;
++ qreal m_unitsPerEm = DEFAULT_UNITS_PER_EM;
+ qreal m_horizAdvX;
+ QHash<QChar, QSvgGlyph> m_glyphs;
+ };
+diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
+index d373a99d..7a7c13b3 100644
+--- a/src/svg/qsvghandler.cpp
++++ b/src/svg/qsvghandler.cpp
+@@ -2568,7 +2568,7 @@ static bool parseFontFaceNode(QSvgStyleProperty *parent,
+
+ qreal unitsPerEm = toDouble(unitsPerEmStr);
+ if (!unitsPerEm)
+- unitsPerEm = 1000;
++ unitsPerEm = QSvgFont::DEFAULT_UNITS_PER_EM;
+
+ if (!name.isEmpty())
+ font->setFamilyName(name);
+--
+2.52.0.windows.1
+
=====================================
contrib/src/qtsvg/rules.mak
=====================================
@@ -18,10 +18,13 @@ $(TARBALLS)/qtsvg-$(QTSVG_VERSION).tar.xz:
.sum-qtsvg: qtsvg-$(QTSVG_VERSION).tar.xz
+qtsvg: UNPACK_DIR=qtsvg-opensource-src-$(QTSVG_VERSION)
qtsvg: qtsvg-$(QTSVG_VERSION).tar.xz .sum-qtsvg
$(UNPACK)
- mv qtsvg-opensource-src-$(QTSVG_VERSION) qtsvg-$(QTSVG_VERSION)
$(APPLY) $(SRC)/qtsvg/0001-Force-the-usage-of-QtZlib-header.patch
+ $(APPLY) $(SRC)/qtsvg/0001-QSvgFont-Initialize-used-member-remove-unused.patch
+ # use up to date system zlib
+ sed -i -e 's,<QtZlib/,<,' $(UNPACK_DIR)/src/svg/qsvgtinydocument.cpp
$(MOVE)
.qtsvg: qtsvg
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/0d219619c6c6aaf77719bbd5e5e0850223f59f5a...a5b4002c4c33ecf0196aa573a6aef096b29d7cde
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/0d219619c6c6aaf77719bbd5e5e0850223f59f5a...a5b4002c4c33ecf0196aa573a6aef096b29d7cde
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list