[qt/qt/qt5compat]: Summary of bulk changes made

Git repository change summary for qt/qt/qt5compat
Pushed by mirror-service into branch 'dev'.
Changed from a2d9a68abbc0795439db3612bb7ed23b7eadfb17 to 055a45a2f6c31bf82bdcafb8107823e22de048ad
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit c0a495894d83a3c48055bd1e544f93147fc6ade1 by Marc Mutz (on behalf of Ivan Solovev) on 18/08/2026 at 07:36..
QBinaryJson: prevent OOB read in fromBinaryData()

The fromBinaryData() function computes the document bound in
size_t, but then truncates it to uint. As a result, when
provided a malformed binary json with root.size in the range of
[0xFFFFFFF8, 0xFFFFFFFF], the total size overflows to the values
between 0 and 7, and the size check incorrectly passes.
When combined with a malicious tableOffset, this results in an
out-of-bounds read in the range of up to 4 GiB past the end of
the allocated buffer - depending on the memory layout it can
lead to either a crash or a read of some potentially sensitive
data.

Do the calculations in uint and use qAddOverflow() to detect
overflows. Since the underlying data structure uses uint to
store the size of the allocated data, we can simply return
early if we detect an overflow.

The newly-added test creates a larger buffer and copies a correct
binary json blob there. Then it injects the malformed size of the
payload and a new offset of the data table, together with the new
table. Then the test uses this large buffer to demonstrate an
out-of-bounds read on a modified blob. If the data was not backed
by a large buffer, it would have been an out-of-bounds read.

The fromRawData() method is not affected (assuming that the passed
size is correct), because it uses the input size parameter
directly, without analyzing the internal structure of the binary
json blob.

Pick-to: 6.12 6.11 6.8 6.5
Fixes: QTBUG-149036
Change-Id: I1a81deebb86cd7251ebeef9eea789b692f9d94b9
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Marc Mutz <[email protected]>
https://invent.kde.org/qt/qt/qt5compat/-/commit/c0a495894d83a3c48055bd1e544f93147fc6ade1

Git commit 721ed576391211ca53ecdaaecf6dd41df7bc962e by Ivan Solovev on 18/08/2026 at 07:36..
QBinaryJson::fromBinaryData(): do the comparison in size_t

In Qt 6, the QBA can actually store more than UINT_MAX bytes, so
casting to uint can truncate. Use size_t instead.

Amends the port of Qt container size_type form int to qsizetype
(Qt 6.0).

Task-number: QTBUG-149036
Pick-to: 6.12 6.11 6.8 6.5
Change-Id: Ia63cd6576233e74d9cf5e8def9d3e05065a63831
Reviewed-by: Marc Mutz <[email protected]>
https://invent.kde.org/qt/qt/qt5compat/-/commit/721ed576391211ca53ecdaaecf6dd41df7bc962e

Git commit 395fe22c2ee87749b1a757340fe3ed80ddfd0b50 by Ivan Solovev on 18/08/2026 at 13:46..
QRegExp: add Security Considerations section

Since the class is kept for compatibility reasons only, add the
new section at the top of the docs, even before the introduction
section.

Task-number: QTBUG-144883
Pick-to: 6.12 6.11 6.8
Change-Id: Ia4f2f4cd273b5373b9e0e46d3dd646fe857a971f
Reviewed-by: Edward Welbourne <[email protected]>
https://invent.kde.org/qt/qt/qt5compat/-/commit/395fe22c2ee87749b1a757340fe3ed80ddfd0b50

Git commit 055a45a2f6c31bf82bdcafb8107823e22de048ad by Ivan Solovev on 18/08/2026 at 13:46..
QRegExp docs: fix a link to the porting section

Add a missing \l command and a trailing dot in the end of the sentence.

Pick-to: 6.12 6.11 6.8
Change-Id: I1241c3390cfca563a0de1f6d6b60327130c244bd
Reviewed-by: Edward Welbourne <[email protected]>
https://invent.kde.org/qt/qt/qt5compat/-/commit/055a45a2f6c31bf82bdcafb8107823e22de048ad