diff --git a/fix-build-error-of-libxkbcommon-1.6.0.patch b/fix-build-error-of-libxkbcommon-1.6.0.patch deleted file mode 100644 index b2d6ffe467418e7326cf9722854bc4f5fa388755..0000000000000000000000000000000000000000 --- a/fix-build-error-of-libxkbcommon-1.6.0.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 00b748a08fd27277e4bd8f86b431a1e71423d7ff Mon Sep 17 00:00:00 2001 -From: peijiankang -Date: Mon, 29 Jan 2024 11:04:27 +0800 -Subject: [PATCH] fix build error of libxkbcommon 1.6.0 - ---- - src/gui/platform/unix/qxkbcommon.cpp | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/gui/platform/unix/qxkbcommon.cpp b/src/gui/platform/unix/qxkbcommon.cpp -index fc014b38..0de9e98f 100644 ---- a/src/gui/platform/unix/qxkbcommon.cpp -+++ b/src/gui/platform/unix/qxkbcommon.cpp -@@ -239,10 +239,14 @@ static constexpr const auto KeyTbl = qMakeArray( - Xkb2Qt, - Xkb2Qt, - Xkb2Qt, -+/* The following four XKB_KEY_dead keys got removed in libxkbcommon 1.6.0 -+ The define check is kind of version check here. */ -+#ifdef XKB_KEY_dead_lowline - Xkb2Qt, - Xkb2Qt, - Xkb2Qt, - Xkb2Qt, -+#endif - - // Special keys from X.org - This include multimedia keys, - // wireless/bluetooth/uwb keys, special launcher keys, etc. --- -2.41.0 - diff --git a/qt6-qtbase.spec b/qt6-qtbase.spec index 61dc1872d4279f76341d449f660e52ebe8ec52a9..545501d85cfe7917955ad0815b045f46653c2017 100644 --- a/qt6-qtbase.spec +++ b/qt6-qtbase.spec @@ -26,13 +26,13 @@ BuildRequires: pkgconfig(libsystemd) Name: qt6-qtbase Summary: Qt6 - QtBase components -Version: 6.5.2 -Release: 14 +Version: 6.5.7 +Release: 1 License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0 -Url: http://qt-project.org/ +Url: https://www.qt.io -Source0: https://download.qt.io/official_releases/qt/%{short_version}/%{version}/submodules/%{qt_module}-everywhere-src-%{version}.tar.xz +Source0: https://download.qt.io/official_releases/qt/%{short_version}/%{version}/src/submodules/%{qt_module}-everywhere-opensource-src-%{version}.tar.xz # https://bugzilla.redhat.com/show_bug.cgi?id=1227295 Source1: qtlogging.ini @@ -80,20 +80,12 @@ Patch90: qtbase-gcc11.patch # fix riscv test Patch100: fix-riscv-configure-tests.patch -Patch102: fix-build-error-of-libxkbcommon-1.6.0.patch Patch103: qt6-qtbase-add-sw64-support.patch #fix CVE -Patch6001:qtbase6.5.2-CVE-2023-38197.patch -Patch6003:qtbase6.5.1-CVE-2023-43114.patch -Patch6004:qtbase6.5.2-CVE-2023-51714.patch -Patch6005:qtbase6.5.2-CVE-2024-33861.patch -Patch6006:qtbase6.5.2-CVE-2024-39936.patch -Patch6007:qtbase6.5.2-CVE-2023-45935.patch -Patch6008:qtbase6.5.2-CVE-2024-25580.patch -Patch6009:qtbase6.5.2-CVE-2025-30348.patch -Patch6010:CVE-2025-5455-qtbase-6.5.patch -Patch6011:CVE-2025-6338-qtbase-6.5.patch +Patch6001:qtbase6.5.2-CVE-2025-30348.patch +Patch6002:CVE-2025-5455-qtbase-6.5.patch +Patch6003:CVE-2025-6338-qtbase-6.5.patch # Do not check any files in %%{_qt6_plugindir}/platformthemes/ for requires. # Those themes are there for platform integration. If the required libraries are # not there, the platform to integrate with isn't either. Then Qt will just @@ -176,6 +168,7 @@ BuildRequires: time BuildRequires: xorg-x11-server-Xvfb %endif +Requires: qt6-filesystem Requires: %{name}-common = %{version}-%{release} ## Sql drivers @@ -399,7 +392,7 @@ translationdir=%{_qt6_translationdir} Name: Qt6 Description: Qt6 Configuration -Version: 6.5.2 +Version: %{version} EOF # rpm macros @@ -810,6 +803,9 @@ make check -k ||: %changelog +* Sat Dec 13 2025 Funda Wang - 6.5.7-1 +- update to 6.5.7 + * Mon Oct 13 2025 zhangfeilong - 6.5.2-14 - fix build error for sw64 diff --git a/qtbase-everywhere-src-6.5.2.tar.xz b/qtbase-everywhere-opensource-src-6.5.7.tar.xz similarity index 32% rename from qtbase-everywhere-src-6.5.2.tar.xz rename to qtbase-everywhere-opensource-src-6.5.7.tar.xz index 02172bef5c24b7ba9b3552ff772b4dd0c0843ca9..3eb1e55f4d121295b8e57c0c3446e382e68783f7 100644 --- a/qtbase-everywhere-src-6.5.2.tar.xz +++ b/qtbase-everywhere-opensource-src-6.5.7.tar.xz @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:3db4c729b4d80a9d8fda8dd77128406353baff4755ca619177eda4cddae71269 -size 48410716 +oid sha256:1226f966d849ead15a6be1a87566cc3f8a2913e8dc08f01a0302359db4611168 +size 47347480 diff --git a/qtbase6.5.1-CVE-2023-43114.patch b/qtbase6.5.1-CVE-2023-43114.patch deleted file mode 100644 index f5cbe016c120ba989cb506cab090e1b7dc347f82..0000000000000000000000000000000000000000 --- a/qtbase6.5.1-CVE-2023-43114.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 8d7c452d55d55d6d60f3f0112a704968945fdab8 Mon Sep 17 00:00:00 2001 -From: hua_yadong -Date: Thu, 23 Nov 2023 17:55:06 +0800 -Subject: [PATCH] qtbase6.5.1-CVE-2023-43114 - ---- - src/gui/text/windows/qwindowsfontdatabase.cpp | 67 ++++++++++++++----- - 1 file changed, 51 insertions(+), 16 deletions(-) - -diff --git a/src/gui/text/windows/qwindowsfontdatabase.cpp b/src/gui/text/windows/qwindowsfontdatabase.cpp -index 2de53be6..3f27466d 100644 ---- a/src/gui/text/windows/qwindowsfontdatabase.cpp -+++ b/src/gui/text/windows/qwindowsfontdatabase.cpp -@@ -868,36 +868,70 @@ QT_WARNING_POP - return fontEngine; - } - --static QList getTrueTypeFontOffsets(const uchar *fontData) -+static QList getTrueTypeFontOffsets(const uchar *fontData, const uchar *fileEndSentinel) - { - QList offsets; -- const quint32 headerTag = *reinterpret_cast(fontData); -+ if (fileEndSentinel - fontData < 12) { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; -+ return offsets; -+ } -+ -+ const quint32 headerTag = qFromUnaligned(fontData); - if (headerTag != MAKE_TAG('t', 't', 'c', 'f')) { - if (headerTag != MAKE_TAG(0, 1, 0, 0) - && headerTag != MAKE_TAG('O', 'T', 'T', 'O') - && headerTag != MAKE_TAG('t', 'r', 'u', 'e') -- && headerTag != MAKE_TAG('t', 'y', 'p', '1')) -+ && headerTag != MAKE_TAG('t', 'y', 'p', '1')) { - return offsets; -+ } - offsets << 0; - return offsets; - } -+ -+ const quint32 maximumNumFonts = 0xffff; - const quint32 numFonts = qFromBigEndian(fontData + 8); -- for (uint i = 0; i < numFonts; ++i) { -- offsets << qFromBigEndian(fontData + 12 + i * 4); -+ if (numFonts > maximumNumFonts) { -+ qCWarning(lcQpaFonts) << "Font collection of" << numFonts << "fonts is too large. Aborting."; -+ return offsets; -+ } -+ -+ if (quintptr(fileEndSentinel - fontData) > 12 + (numFonts - 1) * 4) { -+ for (quint32 i = 0; i < numFonts; ++i) -+ offsets << qFromBigEndian(fontData + 12 + i * 4); -+ } else { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; - } -+ - return offsets; - } - --static void getFontTable(const uchar *fileBegin, const uchar *data, quint32 tag, const uchar **table, quint32 *length) -+static void getFontTable(const uchar *fileBegin, const uchar *fileEndSentinel, const uchar *data, quint32 tag, const uchar **table, quint32 *length) - { -- const quint16 numTables = qFromBigEndian(data + 4); -- for (uint i = 0; i < numTables; ++i) { -- const quint32 offset = 12 + 16 * i; -- if (*reinterpret_cast(data + offset) == tag) { -- *table = fileBegin + qFromBigEndian(data + offset + 8); -- *length = qFromBigEndian(data + offset + 12); -- return; -+ if (fileEndSentinel - data >= 6) { -+ const quint16 numTables = qFromBigEndian(data + 4); -+ if (fileEndSentinel - data >= 28 + 16 * (numTables - 1)) { -+ for (quint32 i = 0; i < numTables; ++i) { -+ const quint32 offset = 12 + 16 * i; -+ if (qFromUnaligned(data + offset) == tag) { -+ const quint32 tableOffset = qFromBigEndian(data + offset + 8); -+ if (quintptr(fileEndSentinel - fileBegin) <= tableOffset) { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; -+ break; -+ } -+ *table = fileBegin + tableOffset; -+ *length = qFromBigEndian(data + offset + 12); -+ if (quintptr(fileEndSentinel - *table) < *length) { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; -+ break; -+ } -+ return; -+ } -+ } -+ } else { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; - } -+ } else { -+ qCWarning(lcQpaFonts) << "Corrupted font data detected"; - } - *table = 0; - *length = 0; -@@ -910,8 +944,9 @@ static void getFamiliesAndSignatures(const QByteArray &fontData, - QList *values) - { - const uchar *data = reinterpret_cast(fontData.constData()); -+ const uchar *dataEndSentinel = data + fontData.size(); - -- QList offsets = getTrueTypeFontOffsets(data); -+ QList offsets = getTrueTypeFontOffsets(data, dataEndSentinel); - if (offsets.isEmpty()) - return; - -@@ -919,7 +954,7 @@ static void getFamiliesAndSignatures(const QByteArray &fontData, - const uchar *font = data + offsets.at(i); - const uchar *table; - quint32 length; -- getFontTable(data, font, MAKE_TAG('n', 'a', 'm', 'e'), &table, &length); -+ getFontTable(data, dataEndSentinel, font, MAKE_TAG('n', 'a', 'm', 'e'), &table, &length); - if (!table) - continue; - QFontNames names = qt_getCanonicalFontNames(table, length); -@@ -929,7 +964,7 @@ static void getFamiliesAndSignatures(const QByteArray &fontData, - families->append(std::move(names)); - - if (values || signatures) -- getFontTable(data, font, MAKE_TAG('O', 'S', '/', '2'), &table, &length); -+ getFontTable(data, dataEndSentinel, font, MAKE_TAG('O', 'S', '/', '2'), &table, &length); - - if (values) { - QFontValues fontValues; --- -2.41.0 - diff --git a/qtbase6.5.2-CVE-2023-38197.patch b/qtbase6.5.2-CVE-2023-38197.patch deleted file mode 100644 index e213cf269c476c2d5fc9c40d034b704ef4242958..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2023-38197.patch +++ /dev/null @@ -1,371 +0,0 @@ -From 49a4cf8133eb8d76115fb7827bd76764e1b30d12 Mon Sep 17 00:00:00 2001 -From: peijiankang -Date: Wed, 29 Nov 2023 20:51:35 +0800 -Subject: [PATCH] CVE-2023-38197 - ---- - src/corelib/serialization/qxmlstream.cpp | 144 +++++++++++++++++- - src/corelib/serialization/qxmlstream_p.h | 11 ++ - .../qxmlstream/tokenError/dtdInBody.xml | 21 +++ - .../qxmlstream/tokenError/multipleDtd.xml | 21 +++ - .../qxmlstream/tokenError/wellFormed.xml | 16 ++ - .../qxmlstream/tst_qxmlstream.cpp | 38 +++++ - 6 files changed, 243 insertions(+), 8 deletions(-) - create mode 100644 tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml - create mode 100644 tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml - create mode 100644 tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml - -diff --git a/src/corelib/serialization/qxmlstream.cpp b/src/corelib/serialization/qxmlstream.cpp -index 3175517a..7dcf80c3 100644 ---- a/src/corelib/serialization/qxmlstream.cpp -+++ b/src/corelib/serialization/qxmlstream.cpp -@@ -185,7 +185,7 @@ WRAP(indexOf, QLatin1StringView) - addData() or by waiting for it to arrive on the device(). - - \value UnexpectedElementError The parser encountered an element -- that was different to those it expected. -+ or token that was different to those it expected. - - */ - -@@ -322,13 +322,34 @@ QXmlStreamEntityResolver *QXmlStreamReader::entityResolver() const - - QXmlStreamReader is a well-formed XML 1.0 parser that does \e not - include external parsed entities. As long as no error occurs, the -- application code can thus be assured that the data provided by the -- stream reader satisfies the W3C's criteria for well-formed XML. For -- example, you can be certain that all tags are indeed nested and -- closed properly, that references to internal entities have been -- replaced with the correct replacement text, and that attributes have -- been normalized or added according to the internal subset of the -- DTD. -+ application code can thus be assured, that -+ \list -+ \li the data provided by the stream reader satisfies the W3C's -+ criteria for well-formed XML, -+ \li tokens are provided in a valid order. -+ \endlist -+ -+ Unless QXmlStreamReader raises an error, it guarantees the following: -+ \list -+ \li All tags are nested and closed properly. -+ \li References to internal entities have been replaced with the -+ correct replacement text. -+ \li Attributes have been normalized or added according to the -+ internal subset of the \l DTD. -+ \li Tokens of type \l StartDocument happen before all others, -+ aside from comments and processing instructions. -+ \li At most one DOCTYPE element (a token of type \l DTD) is present. -+ \li If present, the DOCTYPE appears before all other elements, -+ aside from StartDocument, comments and processing instructions. -+ \endlist -+ -+ In particular, once any token of type \l StartElement, \l EndElement, -+ \l Characters, \l EntityReference or \l EndDocument is seen, no -+ tokens of type StartDocument or DTD will be seen. If one is present in -+ the input stream, out of order, an error is raised. -+ -+ \note The token types \l Comment and \l ProcessingInstruction may appear -+ anywhere in the stream. - - If an error occurs while parsing, atEnd() and hasError() return - true, and error() returns the error that occurred. The functions -@@ -659,6 +680,7 @@ QXmlStreamReader::TokenType QXmlStreamReader::readNext() - d->token = -1; - return readNext(); - } -+ d->checkToken(); - return d->type; - } - -@@ -743,6 +765,11 @@ static constexpr auto QXmlStreamReader_tokenTypeString = qOffsetStringArray( - "ProcessingInstruction" - ); - -+static constexpr auto QXmlStreamReader_XmlContextString = qOffsetStringArray( -+ "Prolog", -+ "Body" -+); -+ - /*! - \property QXmlStreamReader::namespaceProcessing - \brief the namespace-processing flag of the stream reader. -@@ -777,6 +804,15 @@ QString QXmlStreamReader::tokenString() const - return QLatin1StringView(QXmlStreamReader_tokenTypeString.at(d->type)); - } - -+/*! -+ \internal -+ \return \param loc (Prolog/Body) as a string. -+ */ -+static constexpr QLatin1StringView contextString(QXmlStreamReaderPrivate::XmlContext ctxt) -+{ -+ return QLatin1StringView(QXmlStreamReader_XmlContextString.at(static_cast(ctxt))); -+} -+ - #endif // QT_NO_XMLSTREAMREADER - - QXmlStreamPrivateTagStack::QXmlStreamPrivateTagStack() -@@ -864,6 +900,8 @@ void QXmlStreamReaderPrivate::init() - - type = QXmlStreamReader::NoToken; - error = QXmlStreamReader::NoError; -+ currentContext = XmlContext::Prolog; -+ foundDTD = false; - } - - /* -@@ -3838,6 +3876,96 @@ void QXmlStreamWriter::writeCurrentToken(const QXmlStreamReader &reader) - break; - } - } -+static constexpr bool isTokenAllowedInContext(QXmlStreamReader::TokenType type, -+ QXmlStreamReaderPrivate::XmlContext loc) -+{ -+ switch (type) { -+ case QXmlStreamReader::StartDocument: -+ case QXmlStreamReader::DTD: -+ return loc == QXmlStreamReaderPrivate::XmlContext::Prolog; -+ -+ case QXmlStreamReader::StartElement: -+ case QXmlStreamReader::EndElement: -+ case QXmlStreamReader::Characters: -+ case QXmlStreamReader::EntityReference: -+ case QXmlStreamReader::EndDocument: -+ return loc == QXmlStreamReaderPrivate::XmlContext::Body; -+ -+ case QXmlStreamReader::Comment: -+ case QXmlStreamReader::ProcessingInstruction: -+ return true; -+ -+ case QXmlStreamReader::NoToken: -+ case QXmlStreamReader::Invalid: -+ return false; -+ } -+ -+ // GCC 8.x does not treat __builtin_unreachable() as constexpr -+#if !defined(Q_CC_GNU_ONLY) || (Q_CC_GNU >= 900) -+ Q_UNREACHABLE_RETURN(false); -+#else -+ return false; -+#endif -+} -+ -+/*! -+ \internal -+ \brief QXmlStreamReader::isValidToken -+ \return \c true if \param type is a valid token type. -+ \return \c false if \param type is an unexpected token, -+ which indicates a non-well-formed or invalid XML stream. -+ */ -+bool QXmlStreamReaderPrivate::isValidToken(QXmlStreamReader::TokenType type) -+{ -+ // Don't change currentContext, if Invalid or NoToken occur in the prolog -+ if (type == QXmlStreamReader::Invalid || type == QXmlStreamReader::NoToken) -+ return false; -+ -+ // If a token type gets rejected in the body, there is no recovery -+ const bool result = isTokenAllowedInContext(type, currentContext); -+ if (result || currentContext == XmlContext::Body) -+ return result; -+ -+ // First non-Prolog token observed => switch context to body and check again. -+ currentContext = XmlContext::Body; -+ return isTokenAllowedInContext(type, currentContext); -+} -+ -+/*! -+ \internal -+ Checks token type and raises an error, if it is invalid -+ in the current context (prolog/body). -+ */ -+void QXmlStreamReaderPrivate::checkToken() -+{ -+ Q_Q(QXmlStreamReader); -+ -+ // The token type must be consumed, to keep track if the body has been reached. -+ const XmlContext context = currentContext; -+ const bool ok = isValidToken(type); -+ -+ // Do nothing if an error has been raised already (going along with an unexpected token) -+ if (error != QXmlStreamReader::Error::NoError) -+ return; -+ -+ if (!ok) { -+ raiseError(QXmlStreamReader::UnexpectedElementError, -+ QObject::tr("Unexpected token type %1 in %2.") -+ .arg(q->tokenString(), contextString(context))); -+ return; -+ } -+ -+ if (type != QXmlStreamReader::DTD) -+ return; -+ -+ // Raise error on multiple DTD tokens -+ if (foundDTD) { -+ raiseError(QXmlStreamReader::UnexpectedElementError, -+ QObject::tr("Found second DTD token in %1.").arg(contextString(context))); -+ } else { -+ foundDTD = true; -+ } -+} - - /*! - \fn bool QXmlStreamAttributes::hasAttribute(QAnyStringView qualifiedName) const -diff --git a/src/corelib/serialization/qxmlstream_p.h b/src/corelib/serialization/qxmlstream_p.h -index 7c46d187..f805cedb 100644 ---- a/src/corelib/serialization/qxmlstream_p.h -+++ b/src/corelib/serialization/qxmlstream_p.h -@@ -296,6 +296,17 @@ public: - QStringDecoder decoder; - bool atEnd; - -+ enum class XmlContext -+ { -+ Prolog, -+ Body, -+ }; -+ -+ XmlContext currentContext = XmlContext::Prolog; -+ bool foundDTD = false; -+ bool isValidToken(QXmlStreamReader::TokenType type); -+ void checkToken(); -+ - /*! - \sa setType() - */ -diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml -new file mode 100644 -index 00000000..68ef2962 ---- /dev/null -+++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml -@@ -0,0 +1,21 @@ -+ -+ -+ -+ -+ -+ -+ -+ -+]> -+ -+ -+ tst_QXmlStream -+ -+ -+ -+ -+ ]> -+ -+ -diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml -new file mode 100644 -index 00000000..1dbe75c4 ---- /dev/null -+++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml -@@ -0,0 +1,21 @@ -+ -+ -+ -+ -+ -+ -+ -+ -+]> -+ -+ -+ -+]> -+ -+ -+ tst_QXmlStream -+ -+ -+ -diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml -new file mode 100644 -index 00000000..9dfbc0f9 ---- /dev/null -+++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml -@@ -0,0 +1,16 @@ -+ -+ -+ -+ -+ -+ -+ -+ -+]> -+ -+ -+ tst_QXmlStream -+ -+ -+ -diff --git a/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp b/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp -index b7f603c7..839d9edc 100644 ---- a/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp -+++ b/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp -@@ -590,6 +590,8 @@ private slots: - - void entityExpansionLimit() const; - -+ void tokenErrorHandling_data() const; -+ void tokenErrorHandling() const; - private: - static QByteArray readFile(const QString &filename); - -@@ -1818,6 +1820,42 @@ void tst_QXmlStream::roundTrip() const - QCOMPARE(out, in); - } - -+void tst_QXmlStream::tokenErrorHandling_data() const -+{ -+ QTest::addColumn("fileName"); -+ QTest::addColumn("expectedError"); -+ QTest::addColumn("errorKeyWord"); -+ -+ constexpr auto invalid = QXmlStreamReader::Error::UnexpectedElementError; -+ constexpr auto valid = QXmlStreamReader::Error::NoError; -+ QTest::newRow("DtdInBody") << "dtdInBody.xml" << invalid << "DTD"; -+ QTest::newRow("multipleDTD") << "multipleDtd.xml" << invalid << "second DTD"; -+ QTest::newRow("wellFormed") << "wellFormed.xml" << valid << ""; -+} -+ -+void tst_QXmlStream::tokenErrorHandling() const -+{ -+ QFETCH(const QString, fileName); -+ QFETCH(const QXmlStreamReader::Error, expectedError); -+ QFETCH(const QString, errorKeyWord); -+ -+ const QDir dir(QFINDTESTDATA("tokenError")); -+ QFile file(dir.absoluteFilePath(fileName)); -+ -+ // Cross-compiling: File will be on host only -+ if (!file.exists()) -+ QSKIP("Testfile not found."); -+ -+ file.open(QIODevice::ReadOnly); -+ QXmlStreamReader reader(&file); -+ while (!reader.atEnd()) -+ reader.readNext(); -+ -+ QCOMPARE(reader.error(), expectedError); -+ if (expectedError != QXmlStreamReader::Error::NoError) -+ QVERIFY(reader.errorString().contains(errorKeyWord)); -+} -+ - void tst_QXmlStream::test_fastScanName_data() const - { - QTest::addColumn("data"); --- -2.41.0 - diff --git a/qtbase6.5.2-CVE-2023-45935.patch b/qtbase6.5.2-CVE-2023-45935.patch deleted file mode 100644 index 7e620cc609e52f2f621ad6ccb8430cff6f52fd1d..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2023-45935.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 552e3b9b78c136aebedf0a591af04661f0dedbbf Mon Sep 17 00:00:00 2001 -From: Liang Qi -Date: Mon, 31 Jul 2023 05:35:11 +0200 -Subject: xcb: guard a pointer before usage - -in QXcbAtom::initializeAllAtoms(). - -See also the example in -https://manpages.debian.org/testing/libxcb-doc/xcb_intern_atom_reply.3.en.html - -Fixes: QTBUG-115599 -Pick-to: 6.6 6.5 6.2 -Change-Id: I6590fe1aa11deec7fef7ce6d8f5c49a71d636648 -Reviewed-by: Axel Spoerl ---- - src/plugins/platforms/xcb/qxcbatom.cpp | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/plugins/platforms/xcb/qxcbatom.cpp b/src/plugins/platforms/xcb/qxcbatom.cpp -index 09b1fe8a9d..a456c19490 100644 ---- a/src/plugins/platforms/xcb/qxcbatom.cpp -+++ b/src/plugins/platforms/xcb/qxcbatom.cpp -@@ -230,8 +230,10 @@ void QXcbAtom::initializeAllAtoms(xcb_connection_t *connection) { - - for (i = 0; i < QXcbAtom::NAtoms; ++i) { - xcb_intern_atom_reply_t *reply = xcb_intern_atom_reply(connection, cookies[i], nullptr); -- m_allAtoms[i] = reply->atom; -- free(reply); -+ if (reply) { -+ m_allAtoms[i] = reply->atom; -+ free(reply); -+ } - } - } - --- -cgit v1.2.3 - diff --git a/qtbase6.5.2-CVE-2023-51714.patch b/qtbase6.5.2-CVE-2023-51714.patch deleted file mode 100644 index 0efee5ecf31e142886d2931ab6837f58d4923c38..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2023-51714.patch +++ /dev/null @@ -1,29 +0,0 @@ -From c1d9a2e1eb0bf78cc33b558a2f78ca49fcb3cb1d Mon Sep 17 00:00:00 2001 -From: peijiankang -Date: Wed, 31 Jan 2024 11:31:35 +0800 -Subject: [PATCH] qtbase-6.5.2-CVE-2023-51714 - ---- - src/network/access/http2/hpacktable.cpp | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/network/access/http2/hpacktable.cpp b/src/network/access/http2/hpacktable.cpp -index 74a09a20..2c728b37 100644 ---- a/src/network/access/http2/hpacktable.cpp -+++ b/src/network/access/http2/hpacktable.cpp -@@ -26,8 +26,10 @@ HeaderSize entry_size(QByteArrayView name, QByteArrayView value) - // for counting the number of references to the name and value would have - // 32 octets of overhead." - -- const unsigned sum = unsigned(name.size() + value.size()); -- if (std::numeric_limits::max() - 32 < sum) -+ size_t sum; -+ if (qAddOverflow(size_t(name.size()), size_t(value.size()), &sum)) -+ return HeaderSize(); -+ if (sum > (std::numeric_limits::max() - 32)) - return HeaderSize(); - return HeaderSize(true, quint32(sum + 32)); - } --- -2.41.0 - diff --git a/qtbase6.5.2-CVE-2024-25580.patch b/qtbase6.5.2-CVE-2024-25580.patch deleted file mode 100644 index 13238afc2a3e231343c538b7cd269e2aba451fc3..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2024-25580.patch +++ /dev/null @@ -1,325 +0,0 @@ -diff --git a/src/gui/util/qktxhandler.cpp b/src/gui/util/qktxhandler.cpp -index ee5e879516..d52d6a8a3c 100644 ---- a/src/gui/util/qktxhandler.cpp -+++ b/src/gui/util/qktxhandler.cpp -@@ -41,7 +41,7 @@ struct KTXHeader { - quint32 bytesOfKeyValueData; - }; - --static const quint32 qktxh_headerSize = sizeof(KTXHeader); -+static constexpr quint32 qktxh_headerSize = sizeof(KTXHeader); - - // Currently unused, declared for future reference - struct KTXKeyValuePairItem { -@@ -71,11 +71,24 @@ struct KTXMipmapLevel { - */ - }; - --// Returns the nearest multiple of 'rounding' greater than or equal to 'value' --constexpr quint32 withPadding(quint32 value, quint32 rounding) -+// Returns the nearest multiple of 4 greater than or equal to 'value' -+static const std::optional nearestMultipleOf4(quint32 value) - { -- Q_ASSERT(rounding > 1); -- return value + (rounding - 1) - ((value + (rounding - 1)) % rounding); -+ constexpr quint32 rounding = 4; -+ quint32 result = 0; -+ if (qAddOverflow(value, rounding - 1, &result)) -+ return std::nullopt; -+ result &= ~(rounding - 1); -+ return result; -+} -+ -+// Returns a view with prechecked bounds -+static QByteArrayView safeView(QByteArrayView view, quint32 start, quint32 length) -+{ -+ quint32 end = 0; -+ if (qAddOverflow(start, length, &end) || end > quint32(view.length())) -+ return {}; -+ return view.sliced(start, length); - } - - QKtxHandler::~QKtxHandler() = default; -@@ -83,8 +96,7 @@ QKtxHandler::~QKtxHandler() = default; - bool QKtxHandler::canRead(const QByteArray &suffix, const QByteArray &block) - { - Q_UNUSED(suffix); -- -- return (qstrncmp(block.constData(), ktxIdentifier, KTX_IDENTIFIER_LENGTH) == 0); -+ return block.startsWith(ktxIdentifier); - } - - QTextureFileData QKtxHandler::read() -@@ -93,55 +105,122 @@ QTextureFileData QKtxHandler::read() - return QTextureFileData(); - - const QByteArray buf = device()->readAll(); -- const quint32 dataSize = quint32(buf.size()); -- if (dataSize < qktxh_headerSize || !canRead(QByteArray(), buf)) { -- qCDebug(lcQtGuiTextureIO, "Invalid KTX file %s", logName().constData()); -+ if (buf.size() > std::numeric_limits::max()) { -+ qWarning(lcQtGuiTextureIO, "Too big KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ if (!canRead(QByteArray(), buf)) { -+ qWarning(lcQtGuiTextureIO, "Invalid KTX file %s", logName().constData()); - return QTextureFileData(); - } - -- const KTXHeader *header = reinterpret_cast(buf.data()); -- if (!checkHeader(*header)) { -- qCDebug(lcQtGuiTextureIO, "Unsupported KTX file format in %s", logName().constData()); -+ if (buf.size() < qsizetype(qktxh_headerSize)) { -+ qWarning(lcQtGuiTextureIO, "Invalid KTX header size in %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ KTXHeader header; -+ memcpy(&header, buf.data(), qktxh_headerSize); -+ if (!checkHeader(header)) { -+ qWarning(lcQtGuiTextureIO, "Unsupported KTX file format in %s", logName().constData()); - return QTextureFileData(); - } - - QTextureFileData texData; - texData.setData(buf); - -- texData.setSize(QSize(decode(header->pixelWidth), decode(header->pixelHeight))); -- texData.setGLFormat(decode(header->glFormat)); -- texData.setGLInternalFormat(decode(header->glInternalFormat)); -- texData.setGLBaseInternalFormat(decode(header->glBaseInternalFormat)); -+ texData.setSize(QSize(decode(header.pixelWidth), decode(header.pixelHeight))); -+ texData.setGLFormat(decode(header.glFormat)); -+ texData.setGLInternalFormat(decode(header.glInternalFormat)); -+ texData.setGLBaseInternalFormat(decode(header.glBaseInternalFormat)); - -- texData.setNumLevels(decode(header->numberOfMipmapLevels)); -- texData.setNumFaces(decode(header->numberOfFaces)); -+ texData.setNumLevels(decode(header.numberOfMipmapLevels)); -+ texData.setNumFaces(decode(header.numberOfFaces)); -+ -+ const quint32 bytesOfKeyValueData = decode(header.bytesOfKeyValueData); -+ quint32 headerKeyValueSize; -+ if (qAddOverflow(qktxh_headerSize, bytesOfKeyValueData, &headerKeyValueSize)) { -+ qWarning(lcQtGuiTextureIO, "Overflow in size of key value data in header of KTX file %s", -+ logName().constData()); -+ return QTextureFileData(); -+ } - -- const quint32 bytesOfKeyValueData = decode(header->bytesOfKeyValueData); -- if (qktxh_headerSize + bytesOfKeyValueData < quint64(buf.size())) // oob check -- texData.setKeyValueMetadata(decodeKeyValues( -- QByteArrayView(buf.data() + qktxh_headerSize, bytesOfKeyValueData))); -- quint32 offset = qktxh_headerSize + bytesOfKeyValueData; -+ if (headerKeyValueSize >= quint32(buf.size())) { -+ qWarning(lcQtGuiTextureIO, "OOB request in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ // File contains key/values -+ if (bytesOfKeyValueData > 0) { -+ auto keyValueDataView = safeView(buf, qktxh_headerSize, bytesOfKeyValueData); -+ if (keyValueDataView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "Invalid view in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ auto keyValues = decodeKeyValues(keyValueDataView); -+ if (!keyValues) { -+ qWarning(lcQtGuiTextureIO, "Could not parse key values in KTX file %s", -+ logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ texData.setKeyValueMetadata(*keyValues); -+ } -+ -+ // Technically, any number of levels is allowed but if the value is bigger than -+ // what is possible in KTX V2 (and what makes sense) we return an error. -+ // maxLevels = log2(max(width, height, depth)) -+ const int maxLevels = (sizeof(quint32) * 8) -+ - qCountLeadingZeroBits(std::max( -+ { header.pixelWidth, header.pixelHeight, header.pixelDepth })); -+ -+ if (texData.numLevels() > maxLevels) { -+ qWarning(lcQtGuiTextureIO, "Too many levels in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } - -- constexpr int MAX_ITERATIONS = 32; // cap iterations in case of corrupt data -+ if (texData.numFaces() != 1 && texData.numFaces() != 6) { -+ qWarning(lcQtGuiTextureIO, "Invalid number of faces in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } - -- for (int level = 0; level < qMin(texData.numLevels(), MAX_ITERATIONS); level++) { -- if (offset + sizeof(quint32) > dataSize) // Corrupt file; avoid oob read -- break; -+ quint32 offset = headerKeyValueSize; -+ for (int level = 0; level < texData.numLevels(); level++) { -+ const auto imageSizeView = safeView(buf, offset, sizeof(quint32)); -+ if (imageSizeView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "OOB request in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } - -- const quint32 imageSize = decode(qFromUnaligned(buf.data() + offset)); -- offset += sizeof(quint32); -+ const quint32 imageSize = decode(qFromUnaligned(imageSizeView.data())); -+ offset += sizeof(quint32); // overflow checked indirectly above - -- for (int face = 0; face < qMin(texData.numFaces(), MAX_ITERATIONS); face++) { -+ for (int face = 0; face < texData.numFaces(); face++) { - texData.setDataOffset(offset, level, face); - texData.setDataLength(imageSize, level, face); - - // Add image data and padding to offset -- offset += withPadding(imageSize, 4); -+ const auto padded = nearestMultipleOf4(imageSize); -+ if (!padded) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ quint32 offsetNext; -+ if (qAddOverflow(offset, *padded, &offsetNext)) { -+ qWarning(lcQtGuiTextureIO, "OOB request in KTX file %s", logName().constData()); -+ return QTextureFileData(); -+ } -+ -+ offset = offsetNext; - } - } - - if (!texData.isValid()) { -- qCDebug(lcQtGuiTextureIO, "Invalid values in header of KTX file %s", logName().constData()); -+ qWarning(lcQtGuiTextureIO, "Invalid values in header of KTX file %s", -+ logName().constData()); - return QTextureFileData(); - } - -@@ -187,33 +266,83 @@ bool QKtxHandler::checkHeader(const KTXHeader &header) - return is2D && (isCubeMap || isCompressedImage); - } - --QMap QKtxHandler::decodeKeyValues(QByteArrayView view) const -+std::optional> QKtxHandler::decodeKeyValues(QByteArrayView view) const - { - QMap output; - quint32 offset = 0; -- while (offset < view.size() + sizeof(quint32)) { -+ while (offset < quint32(view.size())) { -+ const auto keyAndValueByteSizeView = safeView(view, offset, sizeof(quint32)); -+ if (keyAndValueByteSizeView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "Invalid view in KTX key-value"); -+ return std::nullopt; -+ } -+ - const quint32 keyAndValueByteSize = -- decode(qFromUnaligned(view.constData() + offset)); -- offset += sizeof(quint32); -+ decode(qFromUnaligned(keyAndValueByteSizeView.data())); - -- if (offset + keyAndValueByteSize > quint64(view.size())) -- break; // oob read -+ quint32 offsetKeyAndValueStart; -+ if (qAddOverflow(offset, quint32(sizeof(quint32)), &offsetKeyAndValueStart)) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ quint32 offsetKeyAndValueEnd; -+ if (qAddOverflow(offsetKeyAndValueStart, keyAndValueByteSize, &offsetKeyAndValueEnd)) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ const auto keyValueView = safeView(view, offsetKeyAndValueStart, keyAndValueByteSize); -+ if (keyValueView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "Invalid view in KTX key-value"); -+ return std::nullopt; -+ } - - // 'key' is a UTF-8 string ending with a null terminator, 'value' is the rest. - // To separate the key and value we convert the complete data to utf-8 and find the first - // null terminator from the left, here we split the data into two. -- const auto str = QString::fromUtf8(view.constData() + offset, keyAndValueByteSize); -- const int idx = str.indexOf('\0'_L1); -- if (idx == -1) -- continue; -- -- const QByteArray key = str.left(idx).toUtf8(); -- const size_t keySize = key.size() + 1; // Actual data size -- const QByteArray value = QByteArray::fromRawData(view.constData() + offset + keySize, -- keyAndValueByteSize - keySize); -- -- offset = withPadding(offset + keyAndValueByteSize, 4); -- output.insert(key, value); -+ -+ const int idx = keyValueView.indexOf('\0'); -+ if (idx == -1) { -+ qWarning(lcQtGuiTextureIO, "Invalid key in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ const QByteArrayView keyView = safeView(view, offsetKeyAndValueStart, idx); -+ if (keyView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ const quint32 keySize = idx + 1; // Actual data size -+ -+ quint32 offsetValueStart; -+ if (qAddOverflow(offsetKeyAndValueStart, keySize, &offsetValueStart)) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ quint32 valueSize; -+ if (qSubOverflow(keyAndValueByteSize, keySize, &valueSize)) { -+ qWarning(lcQtGuiTextureIO, "Underflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ const QByteArrayView valueView = safeView(view, offsetValueStart, valueSize); -+ if (valueView.isEmpty()) { -+ qWarning(lcQtGuiTextureIO, "Invalid view in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ output.insert(keyView.toByteArray(), valueView.toByteArray()); -+ -+ const auto offsetNext = nearestMultipleOf4(offsetKeyAndValueEnd); -+ if (!offsetNext) { -+ qWarning(lcQtGuiTextureIO, "Overflow in KTX key-value"); -+ return std::nullopt; -+ } -+ -+ offset = *offsetNext; - } - - return output; -diff --git a/src/gui/util/qktxhandler_p.h b/src/gui/util/qktxhandler_p.h -index 0fd2487393..1142aa8dc0 100644 ---- a/src/gui/util/qktxhandler_p.h -+++ b/src/gui/util/qktxhandler_p.h -@@ -17,6 +17,8 @@ - - #include "qtexturefilehandler_p.h" - -+#include -+ - QT_BEGIN_NAMESPACE - - struct KTXHeader; -@@ -33,7 +35,7 @@ public: - - private: - bool checkHeader(const KTXHeader &header); -- QMap decodeKeyValues(QByteArrayView view) const; -+ std::optional> decodeKeyValues(QByteArrayView view) const; - quint32 decode(quint32 val) const; - - bool inverseEndian = false; diff --git a/qtbase6.5.2-CVE-2024-33861.patch b/qtbase6.5.2-CVE-2024-33861.patch deleted file mode 100644 index b70ba76481456793586d97c73118ff19baf652c4..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2024-33861.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/src/corelib/text/qstringconverter.cpp b/src/corelib/text/qstringconverter.cpp -index 6ca65ba6ad8..043b8f54151 100644 ---- a/src/corelib/text/qstringconverter.cpp -+++ b/src/corelib/text/qstringconverter.cpp -@@ -1966,7 +1966,7 @@ struct QStringConverterICU : QStringConverter - const void *context; - ucnv_getToUCallBack(icu_conv, &action, &context); - if (context != state) -- ucnv_setToUCallBack(icu_conv, action, &state, nullptr, nullptr, &err); -+ ucnv_setToUCallBack(icu_conv, action, state, nullptr, nullptr, &err); - - ucnv_toUnicode(icu_conv, &target, targetLimit, &source, sourceLimit, nullptr, flush, &err); - // We did reserve enough space: -@@ -1999,7 +1999,7 @@ struct QStringConverterICU : QStringConverter - const void *context; - ucnv_getFromUCallBack(icu_conv, &action, &context); - if (context != state) -- ucnv_setFromUCallBack(icu_conv, action, &state, nullptr, nullptr, &err); -+ ucnv_setFromUCallBack(icu_conv, action, state, nullptr, nullptr, &err); - - ucnv_fromUnicode(icu_conv, &target, targetLimit, &source, sourceLimit, nullptr, flush, &err); - // We did reserve enough space: diff --git a/qtbase6.5.2-CVE-2024-39936.patch b/qtbase6.5.2-CVE-2024-39936.patch deleted file mode 100644 index 8dcf842f13ca5b2ea664778aa6aa9cead0a4f0f6..0000000000000000000000000000000000000000 --- a/qtbase6.5.2-CVE-2024-39936.patch +++ /dev/null @@ -1,138 +0,0 @@ -diff --git a/src/network/access/qhttp2protocolhandler.cpp b/src/network/access/qhttp2protocolhandler.cpp -index ec100708600..80819105201 100644 ---- a/src/network/access/qhttp2protocolhandler.cpp -+++ b/src/network/access/qhttp2protocolhandler.cpp -@@ -339,12 +339,12 @@ bool QHttp2ProtocolHandler::sendRequest() - } - } - -- if (!prefaceSent && !sendClientPreface()) -- return false; -- - if (!requests.size()) - return true; - -+ if (!prefaceSent && !sendClientPreface()) -+ return false; -+ - m_channel->state = QHttpNetworkConnectionChannel::WritingState; - // Check what was promised/pushed, maybe we do not have to send a request - // and have a response already? -diff --git a/src/network/access/qhttpnetworkconnectionchannel.cpp b/src/network/access/qhttpnetworkconnectionchannel.cpp -index b9e1ae403cd..3cbe1b16f9e 100644 ---- a/src/network/access/qhttpnetworkconnectionchannel.cpp -+++ b/src/network/access/qhttpnetworkconnectionchannel.cpp -@@ -209,6 +209,10 @@ - bool QHttpNetworkConnectionChannel::sendRequest() - { - Q_ASSERT(protocolHandler); -+ if (waitingForPotentialAbort) { -+ needInvokeSendRequest = true; -+ return false; // this return value is unused -+ } - return protocolHandler->sendRequest(); - } - -@@ -221,21 +225,28 @@ - void QHttpNetworkConnectionChannel::sendRequestDelayed() - { - QMetaObject::invokeMethod(this, [this] { -- Q_ASSERT(protocolHandler); - if (reply) -- protocolHandler->sendRequest(); -+ sendRequest(); - }, Qt::ConnectionType::QueuedConnection); - } - - void QHttpNetworkConnectionChannel::_q_receiveReply() - { - Q_ASSERT(protocolHandler); -+ if (waitingForPotentialAbort) { -+ needInvokeReceiveReply = true; -+ return; -+ } - protocolHandler->_q_receiveReply(); - } - - void QHttpNetworkConnectionChannel::_q_readyRead() - { - Q_ASSERT(protocolHandler); -+ if (waitingForPotentialAbort) { -+ needInvokeReadyRead = true; -+ return; -+ } - protocolHandler->_q_readyRead(); - } - -@@ -1232,7 +1243,18 @@ - // Similar to HTTP/1.1 counterpart below: - const auto &h2Pairs = h2RequestsToSend.values(); // (request, reply) - const auto &pair = h2Pairs.first(); -+ waitingForPotentialAbort = true; - emit pair.second->encrypted(); -+ -+ // We don't send or handle any received data until any effects from -+ // emitting encrypted() have been processed. This is necessary -+ // because the user may have called abort(). We may also abort the -+ // whole connection if the request has been aborted and there is -+ // no more requests to send. -+ QMetaObject::invokeMethod(this, -+ &QHttpNetworkConnectionChannel::checkAndResumeCommunication, -+ Qt::QueuedConnection); -+ - // In case our peer has sent us its settings (window size, max concurrent streams etc.) - // let's give _q_receiveReply a chance to read them first ('invokeMethod', QueuedConnection). - QMetaObject::invokeMethod(connection, "_q_startNextRequest", Qt::QueuedConnection); -@@ -1250,6 +1272,28 @@ - } - } - -+ -+void QHttpNetworkConnectionChannel::checkAndResumeCommunication() -+{ -+ Q_ASSERT(connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2 -+ || connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2Direct); -+ -+ // Because HTTP/2 requires that we send a SETTINGS frame as the first thing we do, and respond -+ // to a SETTINGS frame with an ACK, we need to delay any handling until we can ensure that any -+ // effects from emitting encrypted() have been processed. -+ // This function is called after encrypted() was emitted, so check for changes. -+ -+ if (!reply && h2RequestsToSend.isEmpty()) -+ abort(); -+ waitingForPotentialAbort = false; -+ if (needInvokeReadyRead) -+ _q_readyRead(); -+ if (needInvokeReceiveReply) -+ _q_receiveReply(); -+ if (needInvokeSendRequest) -+ sendRequest(); -+} -+ - void QHttpNetworkConnectionChannel::requeueHttp2Requests() - { - QList h2Pairs = h2RequestsToSend.values(); -diff --git a/src/network/access/qhttpnetworkconnectionchannel_p.h b/src/network/access/qhttpnetworkconnectionchannel_p.h -index e38e56df160..76d5baef2e3 100644 ---- a/src/network/access/qhttpnetworkconnectionchannel_p.h -+++ b/src/network/access/qhttpnetworkconnectionchannel_p.h -@@ -73,6 +73,10 @@ public: - QAbstractSocket *socket; - bool ssl; - bool isInitialized; -+ bool waitingForPotentialAbort = false; -+ bool needInvokeReceiveReply = false; -+ bool needInvokeReadyRead = false; -+ bool needInvokeSendRequest = false; - ChannelState state; - QHttpNetworkRequest request; // current request, only used for HTTP - QHttpNetworkReply *reply; // current reply for this request, only used for HTTP -@@ -145,6 +149,8 @@ public: - void closeAndResendCurrentRequest(); - void resendCurrentRequest(); - -+ void checkAndResumeCommunication(); -+ - bool isSocketBusy() const; - bool isSocketWriting() const; - bool isSocketWaiting() const;