[qt/qt/qtbase]: Summary of bulk changes made

Git repository change summary for qt/qt/qtbase
Pushed by mirror-service into branch '6.11'.
Changed from 056275224e2648a37a5527ca141f6912646d4645 to 56c5d1ab1809a4731372bbc5f87fe7784b1c5920
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 9f6c78eec158c34c973f3d615d8f1b32efbc7d26 by Qt Cherry-pick Bot (on behalf of Oliver Wolff) on 18/08/2026 at 16:59..
QWindowsOleDataObject::SetData: validate buffer before reading HGLOBAL

GlobalLock() can return nullptr for an invalid handle, and the buffer
from an external OLE source may be smaller than sizeof(DWORD). Validate
the allocation size first and treat a failed lock as a no-op to avoid a
null pointer dereference.

Task-number: QTBUG-148512
Pick-to: 6.8
Change-Id: I90b066b021ffc6d69c2e5067a7951925119226ae
Reviewed-by: Morteza Jamshidi <[email protected]>
Reviewed-by: Wladimir Leuschner <[email protected]>
(cherry picked from commit 804bd720494c2aeed6155b017eeae6ccb0e8adf2)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 977c57315ac5cd1d943163f5900cdd0e6bf42985)
https://invent.kde.org/qt/qt/qtbase/-/commit/9f6c78eec158c34c973f3d615d8f1b32efbc7d26

Git commit 204663beb11ad53cb9061487c0ad7661c63bc6dd by Qt Cherry-pick Bot (on behalf of Thierry Bastian) on 18/08/2026 at 16:59..
Fix build with MSVC2022 17.14.19

When building it errors out with:
C:/gitlab/qt/qtbase/src/gui/text/qcssparser.cpp(121): error C2872: 'Font': ambiguous symbol
C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.44.35207\include\comdef.h(489): note: could be 'Font'

Because comdef.h has a Font class.

Fixes: QTBUG-141755
Fixes: QTBUG-146146
Pick-to: 6.8
Change-Id: I7d86ee8bd367c120cf32d5c8142a2aaebef347cd
Reviewed-by: Marc Mutz <[email protected]>
(cherry picked from commit ba310cbdda05af7ec771e5ed1631d29dd809a334)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 9bdb86354dc5b4fdce6e47abcebeee82f94a534f)
https://invent.kde.org/qt/qt/qtbase/-/commit/204663beb11ad53cb9061487c0ad7661c63bc6dd

Git commit 56c5d1ab1809a4731372bbc5f87fe7784b1c5920 by Qt Cherry-pick Bot (on behalf of Oliver Wolff) on 18/08/2026 at 16:59..
QWindowsOleEnumFmtEtc::copyFormatEtc: fix DVTARGETDEVICE copy

Several bugs in the ptd copy path: the return value of IMalloc::Alloc()
was discarded, leaving dest->ptd as a shallow copy of src->ptd and the
new allocation leaked; and tdSize from external OLE data was used
without checking it is at least sizeof(DVTARGETDEVICE), which could
allow a memcpy into a too-small allocation.

copyFormatEtc() also left dest->ptd aliasing src->ptd whenever it
returned false, since the struct is copied wholesale before the ptd
handling runs. QWindowsOleEnumFmtEtc::Next() ignored that return value,
so on failure it handed a FORMATETC with an aliased ptd to external OLE
clients, which then free()'d the same pointer QWindowsOleEnumFmtEtc
frees again in its destructor, causing a double free/use-after-free.
Null out dest->ptd on every failure path and make Next() check the
return value and abort the enumeration with E_OUTOFMEMORY instead.

Task-number: QTBUG-148512
Pick-to: 6.8
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Change-Id: I6377c1f48ea43f4cc06dec866368e0f9711dd735
Reviewed-by: Wladimir Leuschner <[email protected]>
Reviewed-by: Morteza Jamshidi <[email protected]>
(cherry picked from commit 140420ed9246b5f5372cdcf5f756517156fd0d97)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 592efda74ffbcde0896c600f408aa1681a599600)
https://invent.kde.org/qt/qt/qtbase/-/commit/56c5d1ab1809a4731372bbc5f87fe7784b1c5920