Guard the chunked body-size check against signed overflow


readRequestBodyChunked() checked the body limit with
isBodySizeAllowed(byteAmount() + currentChunkSize). Both are signed
64-bit and currentChunkSize can reach INT64_MAX, so the sum can wrap
negative, pass the limit >= size test, and let the body stream in
unbounded until OOM. The overflow is also undefined behaviour.

Use qAddOverflow() and reject on overflow.

Fixes: QTBUG-150274
Pick-to: 6.12 6.12.0 6.11
Change-Id: Ieb21816aa7f8f5e94d0302513f3a2a7b57d7cfb3
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
commit6ee5cd8a459ee52e8f7dacca7c3d5c6de87d2ec1
parent283ee840051532421dcc5788b4233b23eaec1752
authorMate Barany <mate.barany@qt.io>
committerMate Barany <mate.barany@qt.io>
commit timeMon, 21 Sep 2026 15:06:39 +0000