qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()
authorDebian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Tue, 5 May 2026 13:51:20 +0000 (16:51 +0300)
committerDmitry Shachnev <mitya57@debian.org>
Tue, 5 May 2026 13:51:20 +0000 (16:51 +0300)
commita7ee9d678345f41aa3b4eaba3320f57e7a445042
treecc146a28c2cb7cfa58c27fb0a9dd6d7af05f018e
parent54be1f43499eef98350d1c9811929f370216d9f6
qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()

Origin: upstream, https://download.qt.io/official_releases/qt/5.15/CVE-2025-5455-qtbase-5.15.patch
Last-Update: 2025-06-29

It is a precondition violation to call QByteArrayView::at() with
size() as argument. The code used that, though, as an implicit
end-of-string check, assuming == ' ' and == '=' would both fail for
null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
need not be null-terminated, so this could read even past size().

To fix, use higher-level API (startsWith()), consuming parsed tokens
along the way.

Gbp-Pq: Name CVE-2025-5455.diff
src/corelib/io/qdataurl.cpp