When we fixed the callers of toSQLTCHAR() to use the result's size()
instead of the input's (which differ, if sizeof(SQLTCHAR) != 2), we
exposed callers to the append(0), which changes the size() of the
result QVLA. Callers that don't rely on NUL-termination (all?) now saw
an additional training NUL.
Fix by not NUL-terminating, and changing the only user of SQL_NTS to
use an explicit length.
Unless "." (or the empty string) is in $PATH, we're not supposed to find
executables in the current directory. This is how the Unix shells behave
and we match their behavior. It's also the behavior Qt had prior to 5.9
(commit 28666d167aa8e602c0bea25ebc4d51b55005db13). On Windows, searching
the current directory is the norm, so we keep that behavior.
This commit does not add an explicit check for an empty return from
QStandardPaths::findExecutable(). Instead, we allow that empty string to
go all the way to execve(2), which will fail with ENOENT. We could catch
it early, before fork(2), but why add code for the error case?
See https://kde.org/info/security/advisory-20220131-1.txt
When multiple globs match, and the result from magic sniffing is
unrelated to any of those globs, globs have priority and one of them
should be picked up.
* Non-maintainer upload by the LTS Team.
* CVE-2024-25580 (Closes: #1064053)
fix buffer overflow due to crafted KTX image file
* CVE-2023-32763 (Closes: #1036702)
fix QTextLayout buffer overflow due to crafted SVG file
* CVE-2022-25255
prevent QProcess from execution of a binary from the current working
directory when not found in the PATH
* CVE-2023-24607 (Closes: #1031872)
fix denial of service via a crafted string when the SQL ODBC driver
plugin is used
* fix regression caused by patch for CVE-2023-24607
* CVE-2023-32762
prevent incorrect parsing of the strict-transport-security (HSTS) header
* CVE-2023-51714 (Closes: #1060694)
fix incorrect HPack integer overflow check.
* CVE-2023-38197 (Closes: #1041105)
fix infinite loop in recursive entity expansion
* CVE-2023-37369 (Closes: #1059302)
fix crash of application in QXmlStreamReader due to crafted XML string
* CVE-2023-34410 (Closes: #1037210)
fix checking during TLS whether root of the chain really is a
configured CA certificate
* CVE-2023-33285 (Closes: #1036848)
fix buffer overflow in QDnsLookup
projects / qtbase-opensource-src.git / log