Solar Designer <solar () openwall com>, 2025-04-24 20:32:

==7802==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xf5f00021 at pc 0xf79c113e bp 0xfff496e8 sp 0xfff492c4 READ of size 2 at 0xf5f00021 thread T0

-- Jakub Wilk

A heap buffer overflow vulnerability exists in QTextMarkdownImporter. When parsing the front matter of a Markdown file, the code assumes that more characters (e.g., a newline) will be present in the input after finding the closing marker ---. However, if the input stream ends with the ---- delimiter and lacks a trailing newline, calling QStringView::sliced() will attempt to access characters beyond the end of the string, causing the program to crash.

Causes of the vulnerability:

1. Insufficient boundary checks: The case where the delimiter appears at the end of the input was not handled correctly. 2. Overly permissive marker requirements: Allowing unexpected whitespace or other formatting errors led to issues in the parsing logic.

Affected versions: 6.8.0 to 6.8.3 Unaffected versions: Versions prior to 6.6.0

Fix patch: https://codereview.qt-project.org/c/qt/qtbase/+/635546