Bug#1146113: qt6-base: please update bundled pcre2 (allocation overflow, commit 8156b39)
Gajendra Nath Soren <[email protected]>
| Newsgroups | gmane.linux.debian.devel.qt-kde |
|---|---|
| Message-ID | <CABivTSkwJpLZXhZ=CYQQDOae7GEsKyQtv246uqti6Ozevn4uCw__14511.6466259182$1788041847$gmane$org@mail.gmail.com> |
Package: qt6-base Version: 6.10.2+dfsg-16 Severity: minor Tags: security X-Debbugs-Cc: [email protected] qt6-base vendors a copy of pcre2 at: src/3rdparty/pcre2/src/pcre2_substring.c This copy predates commit 8156b39 (August 9, 2026) which fixes an integer overflow in pcre2_substring.c and pcre2_convert.c. The fix adds an overflow guard: if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1) return PCRE2_ERROR_NOMEMORY; No CVE has been assigned yet. The fix is public at: https://github.com/PCRE2Project/pcre2/commit/8156b39 Please update the bundled pcre2 to the latest upstream version. Found by: Attack of the Clones GSoC 2026 pipeline (salsa.debian.org/rouca/gsoc2026) Gajendra Nath Soren [email protected]