From 8560fb92a600a56e77add56eaf9ae3c3e6d9f9fd Mon Sep 17 00:00:00 2001
From: Mate Barany <mate.barany@qt.io>
Date: Tue, 16 Jun 2026 19:02:45 +0200
Subject: [PATCH] QAuthenticator: fix undefined pointer arithmetic in digest parser

parseDigestAuthenticationChallenge advances a pointer past the '='
separator and past the ',' delimiter without checking whether it
has already reached the end of the buffer. When either character is
absent, the pointer is incremented two past the end of the
underlying allocation, which is undefined behaviour even without a
dereference.

Add guards so the pointer is only advanced when it still points
within the buffer.

Task-number: QTBUG-147529
Change-Id: I348798913a2d4694de6e7603c3a519cf19dfdee0
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
(cherry picked from commit 45eb1c2b8549a72ebe982a06ec3629c5cd341c10)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit cc30e714afbeebb3d52190d65fe4bd97334e82cd)
---

diff --git a/src/network/kernel/qauthenticator.cpp b/src/network/kernel/qauthenticator.cpp
index 9210d16..fdc1a3f 100644
--- a/src/network/kernel/qauthenticator.cpp
+++ b/src/network/kernel/qauthenticator.cpp
@@ -697,6 +697,8 @@
         const char *start = d;
         while (d < end && *d != '=')
             ++d;
+        if (d >= end)
+            break;
         QByteArrayView key = QByteArrayView(start, d - start);
         ++d;
         if (d >= end)
@@ -727,7 +729,8 @@
         }
         while (d < end && *d != ',')
             ++d;
-        ++d;
+        if (d < end)
+            ++d;
         options[key.toByteArray()] = std::move(value);
     }