qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()
authorDebian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Tue, 2 Sep 2025 19:04:45 +0000 (21:04 +0200)
committerPatrick Franz <deltaone@debian.org>
Tue, 2 Sep 2025 19:04:45 +0000 (21:04 +0200)
commite027e7a4e49fc422f1b86031b26ee299a89fb8ce
treeab30383c4b53c20e0f4511b356e4befb3c6f8aae
parent3922d0a92ec8abdd978290e9cca1b4e5c4db7b62
qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()

Origin: upstream, https://download.qt.io/official_releases/qt/6.8/CVE-2025-5455-qtbase-6.8.patch
Last-Update: 2025-06-29

It is a precondition violation to call QByteArrayView::at() with
size() as argument. The code used that, though, as an implicit
end-of-string check, assuming == ' ' and == '=' would both fail for
null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
need not be null-terminated, so this could read even past size().

To fix, use higher-level API (startsWith()), consuming parsed tokens
along the way.

Gbp-Pq: Name upstream_cve-2025-5455_fix_data_assertion_error.diff
src/corelib/io/qdataurl.cpp