[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch 'dev'.
Changed from ee5274d166e7180e9bfe0e0ff862a39f68f07df6 to 399aec74c5caaf238996090a97ada70ca237faa5
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 24f8e51238720d4211bc739829dc63bc453d921c by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: harden nine-patch style parsing against malformed data

The nine-patch drawable reader trusts the division and colour
arrays that ExtractStyle produces from the device theme. On
malformed or empty chunk data it read past the arrays and could
divide by zero:

- draw() read xDivs[0]/yDivs[0] with no empty check
- the stretchy-pixel pair loops read xDivs[i+1] with odd count
- the draw loop indexed colors[] with no bound
- calculateStretch() divided by the remaining stretchy pixels

Guard each by bailing to a plain stretched draw on empty
divisions, stop the pair loops one short, bound the colour
index, and guard the zero denominator.

Fixes: QTBUG-148431
Pick-to: 6.12 6.11 6.8
Change-Id: I52125b94196180b3695801ac9334a51e9e57cfb7
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/24f8e51238720d4211bc739829dc63bc453d921c

Git commit d9994441dd6d2bb8d8adf1ff2be47910370fb30f by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: bound array reads in ExtractStyle nine-patch export

getJsonChunkInfo() read the div and colour counts from the native
chunk header and copied that many ints without checking the array
length, so a short or malformed chunk threw
ArrayIndexOutOfBounds. Clamp getJsonArray() to the array length
and require a header of at least three ints.

Fixes: QTBUG-148432
Pick-to: 6.12 6.11 6.8
Change-Id: Ic9d172ccb875d3ab8a944c5d4f7af623a83ca511
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/d9994441dd6d2bb8d8adf1ff2be47910370fb30f

Git commit b19b57339bd20a79ca96459cd9cbd42617f771e6 by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: fix off-by-one in content file engine iterator

AndroidContentFileEngineIterator::currentFileName() and
AndroidContentFileEngineIterator::currentFilePath() guarded
with m_index > m_files.size(), so at m_index == size() they
called QList::at(size()), one past the end. Use >= instead.

Fixes: QTBUG-148430
Pick-to: 6.12 6.11 6.8
Change-Id: I392a8508dd2b51cd9a6b1ea226ac20d4bf0475c3
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/b19b57339bd20a79ca96459cd9cbd42617f771e6

Git commit 90449da456026abc9d6392470e732fc03696bac3 by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: read content cursor BLOB via QJniArray

The BLOB column reader used raw GetArrayLength and
GetByteArrayElements with no null check on the array and no
exception-safe release, so a null or oversized blob from a
content provider could crash or leak the pinned array.

Read it with callMethod<QByteArray>, which bounds-checks and
manages the reference.

Fixes: QTBUG-148429
Pick-to: 6.12 6.11
Change-Id: I542657c82c81427198142ada1e9cd7ebe08f02c1
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/90449da456026abc9d6392470e732fc03696bac3

Git commit b11af1ce32e3d55b49c4106d2722f4f3b04bd5b3 by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: don't log IME text content

The input-method debug category logged various forms
of plain text, which includes password-field content when
the category is enabled. Log only the lengths and positions,
never the text.

Fixes: QTBUG-148433
Pick-to: 6.12 6.11 6.8
Change-Id: I326872faf256889211c2eda16316c25b1bda33ce
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/b11af1ce32e3d55b49c4106d2722f4f3b04bd5b3

Git commit 6eb0fa5735ca192986007f19d8eddf7e0e4fc012 by Assam Boudjelthia on 27/07/2026 at 14:47..
Android: gate applicationArguments extra behind debuggable

The base QtLoader appended the applicationArguments intent
extra to the app argv unconditionally. QtActivity is exported,
so another app could launch it with that extra and inject Qt
command-line arguments in a release build. Honour it only when
the app is debuggable, matching the extraappparams handling,
and check the key is present.

Fixes: QTBUG-148439
Pick-to: 6.12 6.11 6.8
Change-Id: I20cf24f332dd9933490a842c572f77edc03c8dea
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/6eb0fa5735ca192986007f19d8eddf7e0e4fc012

Git commit a0e9c43ae87d41ee8425e810fca6a1f126806e79 by Assam Boudjelthia on 27/07/2026 at 14:47..
JNI: return empty QString for a null jstring

toQString() only asserted the string was non-null, then called
GetStringLength on it, so a null jstring crashed in release
builds.

Return an empty QString instead.

Fixes: QTBUG-148445
Pick-to: 6.12 6.11 6.8
Change-Id: Ib876e06734029f24f8ce9582c41d7ab7d594aff6
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/a0e9c43ae87d41ee8425e810fca6a1f126806e79

Git commit 7f6daac1ebc1a837e19adf799a4b367ec0166de7 by Assam Boudjelthia on 27/07/2026 at 14:47..
JNI: clear pending exceptions in QJniArray element access

QJniArray::at() and setValue() called the array element get/set
JNI functions without checking for a pending exception, so an
out-of-range index left an exception set that would corrupt the
next JNI call.

Check and clear after the get and set paths.

Fixes: QTBUG-148446
Pick-to: 6.12 6.11 6.8
Change-Id: Ib982dda48d353e6037cfa2ddc504a053711c8c26
Reviewed-by: Soheil Armin <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/7f6daac1ebc1a837e19adf799a4b367ec0166de7

Git commit 9641eb315ea7009432853704a0bfc584c0ed9b9c by Assam Boudjelthia on 27/07/2026 at 14:47..
Android fix warning about using class for static fields

This fixes:

 warning: [static] static variable should be qualified by type name,
Context, instead of by an expression.

Change-Id: I4b5c8fba355044dde60fabc09640a0698b87993d
Reviewed-by: Ville Voutilainen <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/9641eb315ea7009432853704a0bfc584c0ed9b9c

Git commit 1dc332a10a70fc8d5ad1c58d0f69e982fcad05d4 by Laszlo Agocs on 27/07/2026 at 16:25..
QtOpenGL: make the gradient color table fill more bounded

The issue likely cannot happen in practice since QGradient rejects > 1.0
stop positions. Correct the legacy OpenGL paint engine nonetheless so
that generating a table with size == 1024 (paletteSize()) and an output
buffer of [1024] does not try to write at index 1024 when the first stop
is > 1.0. Code analysis / AI tools tend do flag this potential memory
safety issue.

Pick-to: 6.12 6.11 6.8
Change-Id: If386b84388d790d12bcf22281cf844cbccd0b7cd
Reviewed-by: Eirik Aavitsland <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/1dc332a10a70fc8d5ad1c58d0f69e982fcad05d4

Git commit 901104d0e9727adfbde4b3cca51c202af1768030 by Laszlo Agocs on 27/07/2026 at 16:25..
QtOpenGL: use qsizetype to avoid theoretical overflow

floatSizeInBytes that is passed to malloc and memcpy is calculated as
vertexCount * 8, do not use int for this, in order to satisfy code
analysis tools. Code analysis / AI tools tend do flag this potential
memory safety issue.

Pick-to: 6.12 6.11 6.8
Change-Id: If6a8dbf8879e087e6b7d9b2aed59bc5b50a92c24
Reviewed-by: Eirik Aavitsland <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/901104d0e9727adfbde4b3cca51c202af1768030

Git commit 399aec74c5caaf238996090a97ada70ca237faa5 by Laszlo Agocs on 27/07/2026 at 16:25..
QtOpenGL: cap max glyph run count

The index buffer is GLushort. Have an appropriate check for avoiding out
of bounds index values. Code analysis / AI tools tend do flag this
potential memory safety issue.

Pick-to: 6.12 6.11 6.8
Change-Id: Ic67358660f1a7fd742de0c3a17f25989bf25537b
Reviewed-by: Eirik Aavitsland <[email protected]>
https://invent.kde.org/qt/qt/qtbase/-/commit/399aec74c5caaf238996090a97ada70ca237faa5