rich text: limit size of text object
authorDebian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Thu, 18 Jun 2026 11:20:38 +0000 (14:20 +0300)
committerDmitry Shachnev <mitya57@debian.org>
Thu, 18 Jun 2026 11:20:38 +0000 (14:20 +0300)
commit4da44a9fe7ba43e0c699d3b284ce60f09c19a579
treea0dfb01e421ec405b7a5ab9f347d137354c63b4d
parenteea6b11fb2ac1507e898ab3b94a81aba019828a6
rich text: limit size of text object

Origin: upstream, https://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=144ce34e846b3f73
 Backported to 5.15 by Dmitry Shachnev: validate allocation manually
 instead of using QImageIOHandler::allocateImage().
Last-Update: 2025-12-11

When we draw a text object, we need to store this in RAM
since the QTextObjectInterface is QPainter-based. This
could lead to over-allocation if the text object size
was set to be very large. We use the existing image IO
infrastructure for making sure allocations are within
reasonable (and configurable) limits.

Gbp-Pq: Name CVE-2025-12385-part2.patch
src/quick/items/qquicktextnodeengine.cpp
tests/auto/quick/qquicktext/tst_qquicktext.cpp