[qt/qt/qt5compat]: Summary of bulk changes made

Git repository change summary for qt/qt/qt5compat
Pushed by mirror-service into branch '6.11'.
Changed from c17379eb1ce0907b5f016f41d5b00e90d4c33cf1 to 40e5393a3a56db4990adeaeb43079571585d567a
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit d0cd01d60dcf9e2422dc720ed8321a195867afe6 by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 18/08/2026 at 15:57..
QBinaryJson: prevent OOB read in fromBinaryData()

The fromBinaryData() function computes the document bound in
size_t, but then truncates it to uint. As a result, when
provided a malformed binary json with root.size in the range of
[0xFFFFFFF8, 0xFFFFFFFF], the total size overflows to the values
between 0 and 7, and the size check incorrectly passes.
When combined with a malicious tableOffset, this results in an
out-of-bounds read in the range of up to 4 GiB past the end of
the allocated buffer - depending on the memory layout it can
lead to either a crash or a read of some potentially sensitive
data.

Do the calculations in uint and use qAddOverflow() to detect
overflows. Since the underlying data structure uses uint to
store the size of the allocated data, we can simply return
early if we detect an overflow.

The newly-added test creates a larger buffer and copies a correct
binary json blob there. Then it injects the malformed size of the
payload and a new offset of the data table, together with the new
table. Then the test uses this large buffer to demonstrate an
out-of-bounds read on a modified blob. If the data was not backed
by a large buffer, it would have been an out-of-bounds read.

The fromRawData() method is not affected (assuming that the passed
size is correct), because it uses the input size parameter
directly, without analyzing the internal structure of the binary
json blob.

Pick-to: 6.8 6.5
Fixes: QTBUG-149036
Change-Id: I1a81deebb86cd7251ebeef9eea789b692f9d94b9
Reviewed-by: Thiago Macieira <[email protected]>
Reviewed-by: Marc Mutz <[email protected]>
(cherry picked from commit c0a495894d83a3c48055bd1e544f93147fc6ade1)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 173cc93ec160719dfb0268971ba16e4e8f46dc57)
https://invent.kde.org/qt/qt/qt5compat/-/commit/d0cd01d60dcf9e2422dc720ed8321a195867afe6

Git commit 0f5e02ea9c133eee4616fa35e953fe5496c2dabc by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 18/08/2026 at 15:57..
QRegExp: add Security Considerations section

Since the class is kept for compatibility reasons only, add the
new section at the top of the docs, even before the introduction
section.

Task-number: QTBUG-144883
Pick-to: 6.8
Change-Id: Ia4f2f4cd273b5373b9e0e46d3dd646fe857a971f
Reviewed-by: Edward Welbourne <[email protected]>
(cherry picked from commit 395fe22c2ee87749b1a757340fe3ed80ddfd0b50)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 7c393c33b4b85fa2b257b556188c6e791bb19e7d)
https://invent.kde.org/qt/qt/qt5compat/-/commit/0f5e02ea9c133eee4616fa35e953fe5496c2dabc

Git commit 6a61c8544b2d9c6ba1292ab43e81c47565dde6f9 by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 18/08/2026 at 15:57..
QBinaryJson::fromBinaryData(): do the comparison in size_t

In Qt 6, the QBA can actually store more than UINT_MAX bytes, so
casting to uint can truncate. Use size_t instead.

Amends the port of Qt container size_type form int to qsizetype
(Qt 6.0).

Task-number: QTBUG-149036
Pick-to: 6.8 6.5
Change-Id: Ia63cd6576233e74d9cf5e8def9d3e05065a63831
Reviewed-by: Marc Mutz <[email protected]>
(cherry picked from commit 721ed576391211ca53ecdaaecf6dd41df7bc962e)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 897a3421f925cb73409d3138d464b8c0ab30d15d)
https://invent.kde.org/qt/qt/qt5compat/-/commit/6a61c8544b2d9c6ba1292ab43e81c47565dde6f9

Git commit 40e5393a3a56db4990adeaeb43079571585d567a by Qt Cherry-pick Bot (on behalf of Ivan Solovev) on 18/08/2026 at 15:57..
QRegExp docs: fix a link to the porting section

Add a missing \l command and a trailing dot in the end of the sentence.

Pick-to: 6.8
Change-Id: I1241c3390cfca563a0de1f6d6b60327130c244bd
Reviewed-by: Edward Welbourne <[email protected]>
(cherry picked from commit 055a45a2f6c31bf82bdcafb8107823e22de048ad)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit c87878314ffadaa1ab2f60c96e75a4214933aa59)
https://invent.kde.org/qt/qt/qt5compat/-/commit/40e5393a3a56db4990adeaeb43079571585d567a