SAX: port internal implementation to qsizetype


The implementation was using int when referring to QString/QByteArray
sizes and indices. Use qsizetype consistently. These were all
overlooked when moving the code from Qt 5 to Qt5Compat module of
Qt 6.

This patch fixes at least one significant issue: a write past the
end of the buffer in updateValue().

The static updateValue() method computes the new length of the
underlying buffer by doing an addition of two int values without an
overflow check.

As a result, for XML documents with large strings in names, values, or
references, the calculation can overflow to a negative value. This
negative value will be passed to QString::resize(), which will result
in an empty string.

After that, we immediately call memcpy() into that string, passing the
original offset and the size of the new chunk - this will cause a write
past the end of the (empty) buffer.

Note that in practice this is not a problem in Qt 5 and 32-bit builds
of Qt 6, because in that cases QString cannot really contain INT_MAX
QChars (it is limited to INT_MAX *bytes*). So, we'll get a memory
allocation error faster than an int overflow and write past the end
of the buffer.

Get rid of storing the string size in a separate variable, and use
QString::size() in the updateValue() method, which returns the size
as qsizetype. This means that the next resize() call also computes
the new value as qsizetype.

After switching to qsizetype, the code would fail to allocate earlier
than an overflow would happen. This is in line with how all Qt
containers behave.

The unit-test generates a string with over 2 Gi of charactes and
makes sure that they all are properly parsed.
Due to the fact that the parser builds the internal buffers in chunks
of 256 QChars, and also because of the fact that the test actually
allocates at least 4 GiB of memory, we do not run it on CI.

Fixes: QTBUG-149566
Pick-to: 6.12 6.12.0 6.11 6.11.3 6.8 6.5
Change-Id: Id777560920ad0c867ae2aa3d44e96a25deee43a6
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
commit4b72520e50cd04f2c29524f28bf77eefc81956fe
parent381f233dc4426cadefe667dfa0e0b49d64f0cfbe
authorIvan Solovev <ivan.solovev@qt.io>
committerIvan Solovev <ivan.solovev@qt.io>
commit timeThu, 17 Sep 2026 09:03:22 +0000