QBinaryJson: reject a misaligned entry offset in an Object's table


Same omission as for tableOffset in the previous commit, one level
down: the offsets in an Object's table are bounds-checked but not
checked for alignment, so Object::entryAt() hands back a misaligned
Entry*, and every access through it - Entry::isValid(), Entry::key(),
Value::isLatinKey() - is undefined behavior.

No pre-existing file in invalidBinaryData/ can demonstrate this any
more: all 28 that reach the table have tableOffset == 395, so as of
the previous commit they are rejected before an entry offset is ever
read. Add 42.bjson, an AI-generated new 36 byte object with a
tableOffset that is a multiple of 4 and a single table entry at offset
13, which is not. It passes the pre-existing bound (13 + 4 < 24) and
is still rejected afterwards - its key claims a length of 2 where only
1 fits - so invalidBinaryData() keeps passing.

Says ubsan:

  qbinaryjson.cpp:448:24: runtime error: member call on misaligned address 0x7c298f3e0a65 for type 'const struct Entry', which requires 4 byte alignment
  0x7c298f3e0a65: note: pointer points here
   00 00 00 00 00 00 00  00 02 00 00 00 41 00 00  0d 00 00 00 00 be 00 00  00 00 00 00 00 00 00 00  b9
               ^
    #0 0x7fc99d730500 in QBinaryJsonPrivate::Object::isValidHelper(unsigned int, QVarLengthArray<QBinaryJsonPrivate::IsValidFrame, 16ll>&) const qbinaryjson.cpp:448
    #1 0x7fc99d73300b in QBinaryJsonPrivate::ConstData::isValid() const qbinaryjson.cpp:320
    #2 0x7fc99d737cf3 in QBinaryJson::fromRawData(char const*, int, QBinaryJson::DataValidation) qbinaryjson.cpp:82
    #3 0x558ca2cd5535 in tst_QtJson::invalidBinaryData() tst_qtjson.cpp:141

Rejecting an unaligned entry offset cannot reject anything the writer
produces: Base::reserveSpace() stores the pre-increment tableOffset,
which is always a multiple of 4.

Amends qtbase/37a7b035f8feb248d25741b22e22ffb0ec7463d6 (Qt 5.0), which
added the check as "entryOffset + sizeof(Entry) >= tableOffset"; the
local was inlined later. Qt 5.15 has it in qtbase's
src/corelib/serialization/qbinaryjson.cpp.

Pick-to: 6.12 6.11 6.8 6.5 5.15
Task-number: QTBUG-149219
Change-Id: I3b1b4d1d17c2a8e0826ac4b732c631246f81f1f8
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
commite18e0b0ae6b44346cf115fe245e5040fe98ccb00
parentbb066610c32d3e638deb5ab3bf6dc117c8afbe49
authorMarc Mutz <marc.mutz@qt.io>
committerMarc Mutz <marc.mutz@qt.io>
commit timeWed, 2 Sep 2026 06:36:04 +0000