Harden the mng handler


mygetcanvasline() callback: Ensure that the iLinenr parameter from
libmng is in range. A buggy value could cause an OOB pointer to be
returned to libmng.

readData(): If a read on the input QIODevice should fail, the error
return value (-1) would be cast to unsigned and interpreted as a
successful 4GB read, potentially leading to OOB reading or crash.

myprocessterm(): Clamp a hypothetical >2B loop count to 2B, which is
anyway interpreted as infinite, instead of random negative int value.

writeData(): Not reachable since the handler is read-only, for
completeness only: same pattern as readData() above.

Pick-to: 6.12 6.11 6.8 6.5 5.15
Task-number: QTBUG-148330
Change-Id: I369f87617f294aeb7a303877050eac66105a43cf
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
commit5b090f58ad4d21436673230bc9f397fa3d2ad057
parent05a025e59d589cc0155714452b575998124cc4f2
authorEirik Aavitsland <eirik.aavitsland@qt.io>
committerEirik Aavitsland <eirik.aavitsland@qt.io>
commit timeFri, 24 Jul 2026 11:33:35 +0000