QTextCodec: fix OOB write in ICONV codec


The ICONV codec has a size miscalculation error when encoding continues
with a high surrogate kept in the state after encoding of the previous
chunk. The code was requesting a resize based on the length in UTF-16
code points instead of the length in bytes.
As a result, we were requesting half of the bytes that we actually
needed.
Note that since resize() allocates more than requested, the code could
sometimes execute successfully.

The test specifically adds a large tail to the input, so that memcpy()
clearly triggers an out-of-bounds write. The test was triggering ASAN
before the fix.

Disclaimer: the tests were developed with the help of AI.

Fixes: QTBUG-149214
Pick-to: 6.12 6.11 6.8 6.5 5.15
Change-Id: I8d32b737630efc092d3f99eb45982f30106e29d3
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
commitcf3f5fbc8bae37cd358b8157cff11b329cca02aa
parent5841a625142199bf3c58e6ace6fa2c4a8a2c5254
authorIvan Solovev <ivan.solovev@qt.io>
committerIvan Solovev <ivan.solovev@qt.io>
commit timeTue, 25 Aug 2026 10:27:49 +0000