From 7158c722e14964e8e04b26f1249672b84f5250e0 Mon Sep 17 00:00:00 2001
From: Mate Barany <mate.barany@qt.io>
Date: Tue, 16 Jun 2026 18:31:49 +0200
Subject: [PATCH] QAuthenticator: fix overflow in qNtlmDecodePhase2 bounds checks

The bounds checks for targetName and targetInfo added len and offset
in quint32 arithmetic before comparing against data.size(), which
could wrap on crafted values. Use qAddOverflow to detect the overflow
explicitly before comparing, which is correct on both 32-bit and
64-bit platforms.

Also replace the (unsigned) cast on data.size() in the targetInfo
check with the same pattern used for targetName.

Task-number: QTBUG-147529
Change-Id: Idf8e19d9e394b23addefaa67068111d29dc6e7c6
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
(cherry picked from commit 3843303b9229f269963e44eb949a9c7dba18db39)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit afd5ab1c0536f3426164c3a9bf675985b66af544)
---

diff --git a/src/network/kernel/qauthenticator.cpp b/src/network/kernel/qauthenticator.cpp
index fdc1a3f..051d28d 100644
--- a/src/network/kernel/qauthenticator.cpp
+++ b/src/network/kernel/qauthenticator.cpp
@@ -1475,14 +1475,20 @@
     ds >> ch.targetInfo;
 
     if (ch.targetName.len > 0) {
-        if (qsizetype(ch.targetName.len + ch.targetName.offset) > data.size())
+        qsizetype total;
+        if (qAddOverflow(qsizetype(ch.targetName.offset), qsizetype(ch.targetName.len), &total))
+            return false;
+        if (total > data.size())
             return false;
 
         ch.targetNameStr = qStringFromUcs2Le(data.mid(ch.targetName.offset, ch.targetName.len));
     }
 
     if (ch.targetInfo.len > 0) {
-        if (ch.targetInfo.len + ch.targetInfo.offset > (unsigned)data.size())
+        qsizetype total;
+        if (qAddOverflow(qsizetype(ch.targetInfo.offset), qsizetype(ch.targetInfo.len), &total))
+            return false;
+        if (total > data.size())
             return false;
 
         ch.targetInfoBuff = data.mid(ch.targetInfo.offset, ch.targetInfo.len);