[qt/qt/qtinterfaceframework-taglib]: Summary of bulk changes made

Git repository change summary for qt/qt/qtinterfaceframework-taglib
Pushed by mirror-service into branch 'upstream/master'.
Changed from 54ae7d8ac45755e286a5c574280f48d5bef93aef to 5530420d088fa25f72d58349c6cc118b8f22d9bf
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 3aa04e3be44b243e17663f77d63d7018df5d8f29 by GitHub (on behalf of Acts1631) on 01/08/2026 at 04:12..
Fix Shorten AIFF chunk offset wrap (#1381)

A crafted embedded AIFF chunk size could wrap the parser offset and
make it repeatedly process the same chunk, causing a denial of service.

Validate AIFF chunk headers and padded sizes against the remaining
verbatim-header data, and advance every parsed chunk to its checked end.
https://invent.kde.org/qt/qt/qtinterfaceframework-taglib/-/commit/3aa04e3be44b243e17663f77d63d7018df5d8f29

Git commit 18572e90a6a4f72d21faa3bac4a7b467bd4e6c83 by GitHub (on behalf of Acts1631) on 01/08/2026 at 04:18..
Limit ID3 compressed-frame expansion (#1382)

A crafted compressed ID3v2 frame can declare an excessive output size
and cause zlib to allocate memory based on attacker-controlled data.

Bound decompression by an absolute 64 MiB limit and a 64:1 expansion
ratio, while retaining normal ID3v2.3 length handling.
https://invent.kde.org/qt/qt/qtinterfaceframework-taglib/-/commit/18572e90a6a4f72d21faa3bac4a7b467bd4e6c83

Git commit e8f1e058d6af7e996aaa7a0f5805f5e5ee64c008 by GitHub (on behalf of Urs Fleisch) on 01/08/2026 at 04:19..
Use Requires.private for zlib with pkg-config (#1380)

Express dependency on zlib using Requires.private in pkg-config .pc
file instead of adding -lz to the libs.

This will cause the following changes when using TagLib with
pkg-config:
- When using a dynamic library, -lz will no longer be present in
  in linker command, but being linked transitively.
- When using a static library, pkg-config must be used with the
  --static command line argument, then libs will still contain
  -lz, which is needed when linking statically.
- The flags needed for zlib will be provided by pkg-config,
  so if -lz is not appropriate (e.g. with MSVC), correct
  linker flags will be provided.
https://invent.kde.org/qt/qt/qtinterfaceframework-taglib/-/commit/e8f1e058d6af7e996aaa7a0f5805f5e5ee64c008

Git commit a100d0b2ec40b082539f601da028cf4285ca0ec4 by GitHub (on behalf of MSOB7Y) on 01/08/2026 at 05:32..
MP4: Allow extracting covr with wrong flags (#1383)

If the covr has invalid flags, detect the image format from the magic bytes
and return the image anyways even if the type is unknown.
https://invent.kde.org/qt/qt/qtinterfaceframework-taglib/-/commit/a100d0b2ec40b082539f601da028cf4285ca0ec4

Git commit 5530420d088fa25f72d58349c6cc118b8f22d9bf by GitHub (on behalf of Thomas Bergwinkl) on 01/08/2026 at 05:53..
Fix ID3v2 frame data length check for per-frame unsynchronised ID3v2.4 frames (#1385)

Frame::fieldData() (taglib/mpeg/id3v2/id3v2frame.cpp) discarded any
ID3v2.4 frame whose declared size (from the header) no longer matched
its actual buffer size after per-frame unsynchronisation was decoded by
FrameFactory::prepareFrameHeader(), silently emptying frames like
TIT2/TPE1/TALB. Clamp the declared length to what's actually available
instead of discarding the frame, only bailing out if the frame's data
offset itself doesn't fit.

Adds testUnsynchDecodeID3v24Frame() to tests/test_id3v2.cpp, covering a
frame with its own per-frame Unsynchronisation flag (as opposed to the
tag-wide flag already covered by testUnsynchDecode()), using new fixture
tests/data/unsynch24.id3.
https://invent.kde.org/qt/qt/qtinterfaceframework-taglib/-/commit/5530420d088fa25f72d58349c6cc118b8f22d9bf