File 0001-qDecodeDataUrl-fix-precondition-violation-in-call-to.patch of Package libqt5-qtbase.40462

From c5b9db065ca5682b0bee339197c847da8b2710c1 Mon Sep 17 00:00:00 2001
From: Marc Mutz <marc.mutz@qt.io>
Date: Fri, 25 Apr 2025 13:58:25 +0200
Subject: [PATCH] qDecodeDataUrl(): fix precondition violation in call to
 QByteArrayView::at()

It is a precondition violation to call QByteArrayView::at() with
size() as argument. The code used that, though, as an implicit
end-of-string check, assuming == ' ' and == '=' would both fail for
null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
need not be null-terminated, so this could read even past size().

To fix, use higher-level API (startsWith()), consuming parsed tokens
along the way.

Add a test that would crash in debug mode before the fix.

Amends the start of the public history.

[ChangeLog][QtCore] Fixed a bug in the handling of data: URLs that
could lead to a crash if Qt was built with assertions enabled. This
affects QNetworkManager and links in QTextDocument.

Pick-to: 6.9 6.8 6.5 6.5.9 6.2 5.15
Change-Id: I4331c88051dfbb0a18fe7da4f50858c707785d09
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Ahmad Samir <a.samirh78@gmail.com>
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
(cherry picked from commit 4d839093b480d30eef8a89c0f864ee3f340adaa1)
(but really taken from upstream CVE-2025-5455-qtbase-5.15.patch)
---
 src/corelib/io/qdataurl.cpp | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/corelib/io/qdataurl.cpp b/src/corelib/io/qdataurl.cpp
index 9cb1b9abd0a..707bc358b98 100644
--- a/src/corelib/io/qdataurl.cpp
+++ b/src/corelib/io/qdataurl.cpp
@@ -76,10 +76,11 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const QUrl &uri, QString &mimeType, QByteArray
         }
 
         if (data.toLower().startsWith("charset")) {
-            int i = 7;      // strlen("charset")
-            while (data.at(i) == ' ')
-                ++i;
-            if (data.at(i) == '=')
+            int prefixSize = 7; // strlen("charset")
+            QLatin1String copy(data.constData() + prefixSize, data.size() - prefixSize);
+            while (copy.startsWith(QLatin1String(" ")))
+                copy = copy.mid(1);
+            if (copy.startsWith(QLatin1String("=")))
                 data.prepend("text/plain;");
         }
 
-- 
GitLab