From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Date: Wed, 29 Jul 2026 08:26:16 +0000 (+0300)
Subject: QTextCodec: avoid read-past-buffer in codecForName()
X-Git-Tag: archive/raspbian/5.15.19+dfsg-4+rpi1^2~10
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=c8314f6b50b262823753f591516455682828363e;p=qtbase-opensource-src.git

QTextCodec: avoid read-past-buffer in codecForName()

Origin: upstream, https://code.qt.io/cgit/qt/qt5compat.git/commit/?id=894079b4932dc878
Last-Update: 2026-07-26

The old code passed a QByteArray to a function taking const char*,
invoking QByteArray::operator const char*() implicitly.

The callee expects the argument to be NUL-terminated, but if the
QByteArray was created fromRawData(), that is not guaranteed.

In newer Qt versions we have nullTerminated(), but this needs to be
picked further back, so use a std::string to do the null-termination.

Gbp-Pq: Name CVE-2026-9499.diff
---

diff --git a/src/corelib/codecs/qtextcodec.cpp b/src/corelib/codecs/qtextcodec.cpp
index 06fd88da9..3a8063f31 100644
--- a/src/corelib/codecs/qtextcodec.cpp
+++ b/src/corelib/codecs/qtextcodec.cpp
@@ -543,6 +543,10 @@ QTextCodec *QTextCodec::codecForName(const QByteArray &name)
     if (name.isEmpty())
         return nullptr;
 
+    // ensure NUL-termination:
+    const std::string name0(name.data(), size_t(name.size()));
+    // (do it outside the critical section, even if we may not need it)
+
     const TextCodecsMutexLocker locker;
 
     QCoreGlobalData *globalData = QCoreGlobalData::instance();
@@ -559,14 +563,14 @@ QTextCodec *QTextCodec::codecForName(const QByteArray &name)
 
     for (TextCodecListConstIt it = globalData->allCodecs.constBegin(), cend = globalData->allCodecs.constEnd(); it != cend; ++it) {
         QTextCodec *cursor = *it;
-        if (qTextCodecNameMatch(cursor->name(), name)) {
+        if (qTextCodecNameMatch(cursor->name().constData(), name0.data())) {
             if (cache)
                 cache->insert(name, cursor);
             return cursor;
         }
         QList<QByteArray> aliases = cursor->aliases();
         for (ByteArrayListConstIt ait = aliases.constBegin(), acend = aliases.constEnd(); ait != acend; ++ait) {
-            if (qTextCodecNameMatch(*ait, name)) {
+            if (qTextCodecNameMatch(ait->constData(), name0.data())) {
                 cache->insert(name, cursor);
                 return cursor;
             }
@@ -575,7 +579,7 @@ QTextCodec *QTextCodec::codecForName(const QByteArray &name)
 
     return nullptr;
 #else
-    return QIcuCodec::codecForNameUnlocked(name);
+    return QIcuCodec::codecForNameUnlocked(name0.data());
 #endif
 }