QTiffHandler: fix UB (integer size mismatch in varargs) in write()


The old code stored a qsizetype through variadic arguments (...) while
the variadic function read it back as a uint32_t.

This is UB at the C/C++ level¹, but apparently ABIs handle this
gracefully, even BE ones, even on the stack (as opposed to in
registers) because (TIL) va_arg arguments always occupy at least a
machine-word-sized slot (think Q5List) and, regardless of endianness,
the 32-bit extraction always reads the LSB32 of such a slot².

Be that as it may, though: I think we should fix the C++ UB, even if
concrete ABIs allow this: Just because the ABI allows it doesn't mean
the compiler's optimizer doesn't find the UB and exploit it.

So explicitly narrow the QByteArray::size() to uint32_t and use
q20::cmp_equal to check whether they differ. If they do, we overflowed
and don't continue. This is not very likely, considering ICC profiles
shouldn't be > 2GiB, but API misuse could cause this, presumably, and
it doesn't cost much.

As a drive-by, remove the unnecessary reinterpret_cast (char* is
allowed to alias void* in va_arg¹) and use data() instead of
constData() (the QByteArray is already const). This helps keep line
lengths in check. Finally, place the opening { following the
multi-line if condition on a line of its own, because the Qt Style
Guide is wrong on this: if it's placed at the end of the last line of
the condition, this whole thing becomes totally unreadable.

References:

¹ C11 7.16.1.1p2 (inherited by C++ via <cstdarg>):
  https://port70.net/~nsz/c/c11/n1570.html#7.16.1.1

² Here are some example ABIs:
- System V AMD64 psABI, Section "The va_arg Macro", Steps 9 and 10.
  https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-1.0.pdf
  (LE only)
- AAPCS64 Appendix 14.4.
  https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst
  (cf. #ifdef BIG_ENDIAN)
- Power: Section "Parameter Save Area" → "each parameter occupies one
  or more doublewords"
  https://openpowerfoundation.org/specifications/64bitelfabi/
  ("Sign or zero extend values shorter than a doubleword...")

Amends d63c1d05e455921b1ea4e351e770316c3494ee63 (5.14), but really the
port of QByteArray::size_type to qsizetype (6.0).

Pick-to: 6.12 6.11 6.8 6.5
Change-Id: Id971d73c1e7b3138139fc83bf5406312319fb5cf
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
commita5925c5053893ddfa9df2affc65048c60850eb24
parentae7c18d1e0bdcfce8abc1347a43c9c74ac5a3d37
authorMarc Mutz <marc.mutz@qt.io>
committerMarc Mutz <marc.mutz@qt.io>
commit timeMon, 20 Jul 2026 22:02:02 +0000