Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package qt6-base for openSUSE:Factory checked in at 2026-11-01 22:21:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/qt6-base (Old) and /work/SRC/openSUSE:Factory/.qt6-base.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-base" Sun Nov 1 22:21:05 2026 rev:88 rq:1393864 version:6.12.0 Changes: -------- --- /work/SRC/openSUSE:Factory/qt6-base/qt6-base.changes 2026-10-18 19:22:12.000964346 +0200 +++ /work/SRC/openSUSE:Factory/.qt6-base.new.1255/qt6-base.changes 2026-11-01 22:21:10.014400784 +0100 @@ -1,0 +2,6 @@ +Fri Oct 30 10:13:16 UTC 2026 - Christophe Marin <[email protected]> + +- Add upstream fix: + * CVE-2026-105924-qtbase-6.12.diff (CVE-2026-105924) + +------------------------------------------------------------------- New: ---- CVE-2026-105924-qtbase-6.12.diff ----------(New B)---------- New:- Add upstream fix: * CVE-2026-105924-qtbase-6.12.diff (CVE-2026-105924) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qt6-base.spec ++++++ --- /var/tmp/diff_new_pack.hV98yQ/_old 2026-11-01 22:21:11.476461293 +0100 +++ /var/tmp/diff_new_pack.hV98yQ/_new 2026-11-01 22:21:11.478461376 +0100 @@ -41,6 +41,7 @@ # Patches 0-100 are upstream patches # Patch0: build_with_md4c_0_6_0.patch Patch1: 6.12.0_Fix_touchpad_scrolling.patch +Patch2: CVE-2026-105924-qtbase-6.12.diff # Patches 100-200 are openSUSE and/or non-upstream(able) patches # # No need to pollute the library dir with object files, install them in the qt6 subfolder Patch100: 0001-CMake-Install-objects-files-into-ARCHDATADIR.patch ++++++ CVE-2026-105924-qtbase-6.12.diff ++++++ >From a2cd9d2a70575c37153d43e9c5396a9144af1923 Mon Sep 17 00:00:00 2001 From: Thiago Macieira <[email protected]> Date: Wed, 02 Sep 2026 12:04:25 -0300 Subject: [PATCH] JSON/CBOR: fix crash converting an empty URL tag to JSON A CBOR URL (tag 32) wrapping an empty, definite-length text string has no backing ByteData after decoding via QCborValue::fromCbor(), so byteData() returns nullptr. convertExtendedTypeToJson() dereferenced it unconditionally and crashed. Guard against the null pointer. Fixes: QTBUG-149841 Pick-to: 6.8 6.5 5.15 Change-Id: I919b870f7a23d41fdb98fffde1fa84247d5c2d18 Reviewed-by: Ivan Solovev <[email protected]> (cherry picked from commit 9e9988ee57c0210a5ba57435182b094f50b50f28) Reviewed-by: Qt Cherry-pick Bot <[email protected]> --- diff --git a/src/corelib/serialization/qjsoncbor.cpp b/src/corelib/serialization/qjsoncbor.cpp index cbee0a4..fd641a3 100644 --- a/src/corelib/serialization/qjsoncbor.cpp +++ b/src/corelib/serialization/qjsoncbor.cpp @@ -174,15 +174,21 @@ qint64 tag = d->elements.at(0).value; switch (tag) { - case qint64(QCborKnownTags::Url): + case qint64(QCborKnownTags::Url): { #ifdef QT_BOOTSTRAPPED break; #else // use the fully-encoded URL form - if (d->elements.at(1).type == QCborValue::String) - return QUrl::fromEncoded(d->byteData(1)->asByteArrayView()).toString(QUrl::FullyEncoded); + Element e = d->elements.at(1); + const ByteData *bd = d->byteData(e); + if (e.type == QCborValue::String) { + if (!bd) + return QString(); + return QUrl::fromEncoded(bd->asByteArrayView()).toString(QUrl::FullyEncoded); + } Q_FALLTHROUGH(); #endif + } case qint64(QCborKnownTags::DateTimeString): case qint64(QCborKnownTags::ExpectedBase64url): diff --git a/tests/auto/corelib/serialization/qcborvalue_json/tst_qcborvalue_json.cpp b/tests/auto/corelib/serialization/qcborvalue_json/tst_qcborvalue_json.cpp index c7b9b3b..e56622f 100644 --- a/tests/auto/corelib/serialization/qcborvalue_json/tst_qcborvalue_json.cpp +++ b/tests/auto/corelib/serialization/qcborvalue_json/tst_qcborvalue_json.cpp @@ -51,8 +51,13 @@ return QTest::addRow("Double:%g", exp.toDouble()); if (v.type() == QCborValue::ByteArray || v.type() == QCborValue::String) return QTest::addRow("%s:%zd", typeString, size_t(exp.toString().size())); - if (v.type() >= 0x10000) + if (v.type() == QCborValue::Uuid) return QTest::newRow(exp.typeName()); + if (v.type() >= 0x10000) { + // all others are based on string + return QTest::addRow("%s:%zd", exp.typeName(), + size_t(v.taggedValue().toString().size())); + } return QTest::newRow(typeString); }; addRow() << v << exp << json; @@ -75,10 +80,15 @@ add(std::numeric_limits<qint64>::min(), std::numeric_limits<qint64>::min(), std::numeric_limits<qint64>::min()); // converts to string in JSON: + add(QByteArray(), QByteArray(), QString()); add(QByteArray("Hello"), QByteArray("Hello"), "SGVsbG8"); + // Invalid datetimes are not QCborValue::DateTime + //add(QCborValue(QDateTime()), QString(), QString()); add(QCborValue(dt), dt, dt.toString(Qt::ISODateWithMs)); + add(QCborValue(QUrl()), QUrl(), QString()); add(QCborValue(QUrl("http://example.com/{q}";)), QUrl("http://example.com/{q}";), "http://example.com/%7Bq%7D";); // note the encoded form in JSON + add(QCborValue(QRegularExpression()), QRegularExpression(), QString()); add(QCborValue(QRegularExpression(".")), QRegularExpression("."), "."); add(QCborValue(uuid), uuid, uuid.toString(QUuid::WithoutBraces)); @@ -116,6 +126,7 @@ } QCOMPARE(v.toVariant(), variant); + if (variant.isValid()) { QVariant variant2 = QVariant::fromValue(v); QVERIFY(variant2.canConvert(variant.metaType())); @@ -123,6 +134,12 @@ QCOMPARE(variant2, variant); } +#if QT_CONFIG(cborstreamreader) && QT_CONFIG(cborstreamwriter) + // repeat after a round-trip through CBOR encoding, which exercises the + // decoding paths in QCborValue::fromCbor() + QCOMPARE(QCborValue::fromCbor(v.toCbor()).toVariant(), variant); +#endif + // tags get ignored: QCOMPARE(QCborValue(QCborKnownTags::Signature, v).toVariant(), variant); @@ -147,6 +164,12 @@ QCOMPARE(v.toJsonValue(), json); QCOMPARE(QVariant::fromValue(v).toJsonValue(), json); +#if QT_CONFIG(cborstreamreader) && QT_CONFIG(cborstreamwriter) + // repeat after a round-trip through CBOR encoding, which exercises the + // decoding paths in QCborValue::fromCbor() + QCOMPARE(QCborValue::fromCbor(v.toCbor()).toJsonValue(), json); +#endif + // most tags get ignored: QCOMPARE(QCborValue(QCborKnownTags::Signature, v).toJsonValue(), json);
