QXmlStreamReader: don't leak DTD material from one doc to the next


As explained in the commit that added the
tst_QXmlStream::clearReallyResetsDtdInformation() test,
QXmlStreamReader leaked DTD information in various ways from an
earlier-parsed document to a following one, if the QXmlStreamReader
instance was re-used.

To fix, clear() all the data in init() (called from clear() and
setDevice()):

- dtdName, dtdPublicId, dtdSystemId (even though these were not
  observable though public API, since the public accessor guards the
  return of these variables with a TokenType == DTD check, which, if
  sucessful, means these variables have already been reset),

- {public,}{entity,notation}Declarations (which leaked when the first
  document never had the accessors called)

This fixes all the XFAILs in clearReallyResetsDtdInformation().

Amends the start of the public history, but not picking back to ESM
branches, since, while this is a security problem, the work-around is
trivial (just don't reuse QXmlStreamReader instances).

Pick-to: 6.12 6.8
Fixes: QTBUG-151675
Change-Id: I5b21111216e17509d1d4c6c8fd636b621b5940d5
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
commitf067a7402a6b58ed474d59342911fa56fb5f7191
parent85df1d22a4b5a64156c154938e1bb5425b71bd85
authorMarc Mutz <marc.mutz@qt.io>
committerMarc Mutz <marc.mutz@qt.io>
commit timeWed, 21 Oct 2026 15:51:11 +0000