aboutsummaryrefslogtreecommitdiff
path: root/vcpkg/ports/qt5-base/patches/CVE-2025-30348-qtbase-5.15.diff
blob: bbc001a77d408c2982bee33e8b4e5e7be9b8c9f2 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
From 16918c1df3e709df2a97281e3825d94c84edb668 Mon Sep 17 00:00:00 2001
From: Christian Ehrlicher <ch.ehrlicher@gmx.de>
Date: Tue, 06 Aug 2024 22:39:44 +0200
Subject: [PATCH] XML/QDom: speedup encodeText()

The code copied the whole string, then replaced parts inline, at
the cost of relocating everything beyond, at each replacement.
Instead, copy character by character (in chunks where possible)
and append replacements as we skip what they replace.

Manual conflict resolution for 6.5:
- This is a manual cherry-pick. The original change was only
  picked to 6.8, but the quadratic behavior is present in Qt 5, too.
- Changed Task-number to Fixes: because this is the real fix;
  the QString change, 315210de916d060c044c01e53ff249d676122b1b,
  was unrelated to the original QTBUG-127549.

Manual conflcit resolution for 5.15:
- Kept/re-added QTextCodec::canEncode() check
- Ported from Qt 6 to 5, to wit:
  - qsizetype -> int
  - QStringView::first/sliced(n) -> left/mid(n)
    (these functions are clearly called in-range, so the widened
    contract of the Qt 5 functions doesn't matter)
- Ported from C++17- and C++14-isms to C++11:
  - replaced polymorphic lambda with a normal one (this requires
    rewriting the !canEncode() branch to use QByteArray/QLatin1String
    instead of QString)
- As a drive-by, corrected the indentation of the case labels to
  horizontally align existing code (and follow Qt style)

Fixes: QTBUG-127549
Change-Id: I368482859ed0c4127f1eec2919183711b5488ada
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
(cherry picked from commit 2ce08e3671b8d18b0284447e5908ce15e6e8f80f)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 225e235cf966a44af23dbe9aaaa2fd20ab6430ee)
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit 905a5bd421efff6a1d90b6140500d134d32ca745)
---

diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp
index 872221c..bf70477 100644
--- a/src/xml/dom/qdom.cpp
+++ b/src/xml/dom/qdom.cpp
@@ -3676,59 +3676,67 @@
     const QTextCodec *const codec = s.codec();
     Q_ASSERT(codec);
 #endif
-    QString retval(str);
-    int len = retval.length();
-    int i = 0;
+    QString retval;
+    int start = 0;
+    auto appendToOutput = [&](int cur, QLatin1String replacement)
+    {
+        if (start < cur) {
+            retval.reserve(str.size() + replacement.size());
+            retval.append(QStringView(str).left(cur).mid(start));
+        }
+        // Skip over str[cur], replaced by replacement
+        start = cur + 1;
+        retval.append(replacement);
+    };
 
-    while (i < len) {
-        const QChar ati(retval.at(i));
-
-        if (ati == QLatin1Char('<')) {
-            retval.replace(i, 1, QLatin1String("&lt;"));
-            len += 3;
-            i += 4;
-        } else if (encodeQuotes && (ati == QLatin1Char('"'))) {
-            retval.replace(i, 1, QLatin1String("&quot;"));
-            len += 5;
-            i += 6;
-        } else if (ati == QLatin1Char('&')) {
-            retval.replace(i, 1, QLatin1String("&amp;"));
-            len += 4;
-            i += 5;
-        } else if (ati == QLatin1Char('>') && i >= 2 && retval[i - 1] == QLatin1Char(']') && retval[i - 2] == QLatin1Char(']')) {
-            retval.replace(i, 1, QLatin1String("&gt;"));
-            len += 3;
-            i += 4;
-        } else if (performAVN &&
-                   (ati == QChar(0xA) ||
-                    ati == QChar(0xD) ||
-                    ati == QChar(0x9))) {
-            const QString replacement(QLatin1String("&#x") + QString::number(ati.unicode(), 16) + QLatin1Char(';'));
-            retval.replace(i, 1, replacement);
-            i += replacement.length();
-            len += replacement.length() - 1;
-        } else if (encodeEOLs && ati == QChar(0xD)) {
-            retval.replace(i, 1, QLatin1String("&#xd;")); // Replace a single 0xD with a ref for 0xD
-            len += 4;
-            i += 5;
-        } else {
+    const int len = str.size();
+    for (int cur = 0; cur < len; ++cur) {
+        switch (const char16_t ati = str[cur].unicode()) {
+        case u'<':
+            appendToOutput(cur, QLatin1String("&lt;"));
+            break;
+        case u'"':
+            if (encodeQuotes)
+                appendToOutput(cur, QLatin1String("&quot;"));
+            break;
+        case u'&':
+            appendToOutput(cur, QLatin1String("&amp;"));
+            break;
+        case u'>':
+            if (cur >= 2 && str[cur - 1] == u']' && str[cur - 2] == u']')
+                appendToOutput(cur, QLatin1String("&gt;"));
+            break;
+        case u'\r':
+            if (performAVN || encodeEOLs)
+                appendToOutput(cur, QLatin1String("&#xd;"));    // \r == 0x0d
+            break;
+        case u'\n':
+            if (performAVN)
+                appendToOutput(cur, QLatin1String("&#xa;"));    // \n == 0x0a
+            break;
+        case u'\t':
+            if (performAVN)
+                appendToOutput(cur, QLatin1String("&#x9;"));    // \t == 0x09
+            break;
+        default:
 #if QT_CONFIG(textcodec)
             if(codec->canEncode(ati))
-                ++i;
+                ; // continue
             else
 #endif
             {
                 // We have to use a character reference to get it through.
-                const ushort codepoint(ati.unicode());
-                const QString replacement(QLatin1String("&#x") + QString::number(codepoint, 16) + QLatin1Char(';'));
-                retval.replace(i, 1, replacement);
-                i += replacement.length();
-                len += replacement.length() - 1;
+                const QByteArray replacement = "&#x" + QByteArray::number(uint{ati}, 16) + ';';
+                appendToOutput(cur, QLatin1String{replacement});
             }
+            break;
         }
     }
-
-    return retval;
+    if (start > 0) {
+        retval.append(QStringView(str).left(len).mid(start));
+        return retval;
+    }
+    return str;
 }
 
 void QDomAttrPrivate::save(QTextStream& s, int, int) const