From 113b8e5e04a9d7fed9b9cce15dbe794611caefac Mon Sep 17 00:00:00 2001 From: zhanghongyuan Date: Mon, 28 Sep 2026 09:28:21 +0800 Subject: [PATCH] fix: fix crash when fontconfig fallback pattern has no charset QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter() passed the address of an uninitialized FcCharSet* to FcPatternGetCharSet() and then called FcCharSetHasChar() on it without checking the result. A pattern returned by FcFontMatch() is not guaranteed to carry an FC_CHARSET element: fontconfig treats the charset as optional, and caches produced by other fontconfig builds (e.g. a bundled snapshot that indexed .woff/.woff2 files it could not parse as empty patterns) can legally serve charset-less patterns. In that case the uninitialized pointer is dereferenced inside FcCharSetHasChar() and the process crashes with SIGSEGV; builds hardened with -ftrivial-auto-var-init=pattern crash deterministically at 0xfefe... upstream: https://codereview.qt-project.org/c/qt/qtbase/+/750214 log: fix crash when fontconfig fallback pattern has no charset --- debian/changelog | 6 +++++ ...nfig-fallback-pattern-has-no-charset.patch | 26 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 33 insertions(+) create mode 100644 debian/patches/Fix-crash-when-fontconfig-fallback-pattern-has-no-charset.patch diff --git a/debian/changelog b/debian/changelog index 8e6971d8..522a2faf 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +qt6-base (6.8.0+dfsg-0deepin37) unstable; urgency=medium + + * Fix crash when fontconfig fallback pattern has no charset. + + -- zhanghongyuan Mon, 28 Sep 2026 09:27:41 +0800 + qt6-base (6.8.0+dfsg-0deepin36) unstable; urgency=medium * fix: enable fix-ComboBox-Wheelevent.patch in the patch series so diff --git a/debian/patches/Fix-crash-when-fontconfig-fallback-pattern-has-no-charset.patch b/debian/patches/Fix-crash-when-fontconfig-fallback-pattern-has-no-charset.patch new file mode 100644 index 00000000..ea62ccba --- /dev/null +++ b/debian/patches/Fix-crash-when-fontconfig-fallback-pattern-has-no-charset.patch @@ -0,0 +1,26 @@ +Author: zhanghongyuan +Date: Mon, 28 Sep 2026 09:59:10 +0800 +Subject: Fix-crash-when-fontconfig-fallback-pattern-has-no-charset +Upstream: https://codereview.qt-project.org/c/qt/qtbase/+/750214 + +--- + +Index: qt6-base/src/gui/text/unix/qfontenginemultifontconfig.cpp +=================================================================== +--- qt6-base.orig/src/gui/text/unix/qfontenginemultifontconfig.cpp ++++ qt6-base/src/gui/text/unix/qfontenginemultifontconfig.cpp +@@ -25,9 +25,11 @@ bool QFontEngineMultiFontConfig::shouldL + bool charSetHasChar = true; + FcPattern *matchPattern = getMatchPatternForFallback(at - 1); + if (matchPattern != nullptr) { +- FcCharSet *charSet; +- FcPatternGetCharSet(matchPattern, FC_CHARSET, 0, &charSet); +- charSetHasChar = FcCharSetHasChar(charSet, ucs4); ++ FcCharSet *charSet = nullptr; ++ if (FcPatternGetCharSet(matchPattern, FC_CHARSET, 0, &charSet) == FcResultMatch ++ && charSet != nullptr) { ++ charSetHasChar = FcCharSetHasChar(charSet, ucs4); ++ } + } + + return charSetHasChar; diff --git a/debian/patches/series b/debian/patches/series index d97e1aff..4ce9c938 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -59,3 +59,4 @@ CVE-2026-19248_fix-unbounded-nesting-depth-in-QDomNode-dtor.patch CVE-2026-78253_fix-stack-exhaustion-in-readElementText.patch CVE-2026-82292_guard-against-null-nodes-in-QDomBuilder.patch fix-ComboBox-Wheelevent.patch +Fix-crash-when-fontconfig-fallback-pattern-has-no-charset.patch