QDomNode: fix unbounded nesting depth on destruction and clear()
Origin: upstream, https://code.qt.io/cgit/qt/qtbase.git/commit/?id=
647b221ca885739a
Last-Update: 2026-09-21
In both ~QDomNodePrivate() and QDomNodePrivate::clear(), the code
simply walked the list of chldren (->first, ->next), and deleted each
one in turn. This recurses into ~QDomNodePrivate() and uses stack
space proportional to the height of the tree. Since the latter is
user-controlled, this is a an easy DoS, so fix the implementation to
use iteration instead of recursion.
Note that it suffices to fix ~QDomNodePrivate(), as clear() only
recurses via the dtor, too.
Gbp-Pq: Name CVE-2026-19248.diff