From 20526cb01466105c0e4ed1430ac9722f3dddf60a Mon Sep 17 00:00:00 2001
From: Thiago Macieira <thiago.macieira@intel.com>
Date: Tue, 15 Nov 2016 07:37:16 -0800
Subject: [PATCH 1/7] Make sure all pattern args get cleared when parsing a new
 pattern

The user can call qSetMessagePattern after program start, so we need to
be sure that the parsed argument data is properly cleared.

Task-number: QTBUG-57144
Change-Id: I1978c6b95bd84639a8c4fffd1487429b04725522
Reviewed-by: Kai Koehne <kai.koehne@qt.io>
---
 src/corelib/global/qlogging.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/corelib/global/qlogging.cpp b/src/corelib/global/qlogging.cpp
index 22b75afac8a..e1b8ef4b6d4 100644
--- a/src/corelib/global/qlogging.cpp
+++ b/src/corelib/global/qlogging.cpp
@@ -1039,6 +1039,10 @@ void QMessagePattern::setPattern(const QString &pattern)
         delete [] literals;
     }
     delete [] tokens;
+    timeArgs.clear();
+#ifdef QLOGGING_HAVE_BACKTRACE
+    backtraceArgs.clear();
+#endif
 
     // scanner
     QList<QString> lexemes;

From 1ff2acf20f6b2a0f7d49635bc46a19bc45d55fb1 Mon Sep 17 00:00:00 2001
From: Alexander Volkov <a.volkov@rusbitech.ru>
Date: Thu, 24 Nov 2016 02:02:42 +0300
Subject: [PATCH 2/7] QtGui: Add missing override

Change-Id: Ief5b0863d7649d5a8d421c05766513276c264776
Reviewed-by: hjk <hjk@qt.io>
---
 src/gui/image/qbmphandler_p.h              | 14 +++----
 src/gui/image/qpnghandler_p.h              | 14 +++----
 src/gui/image/qppmhandler_p.h              | 14 +++----
 src/gui/image/qxbmhandler_p.h              | 14 +++----
 src/gui/image/qxpmhandler_p.h              | 14 +++----
 src/gui/opengl/qopenglpaintdevice.h        |  6 +--
 src/gui/painting/qemulationpaintengine_p.h | 48 +++++++++++-----------
 src/gui/painting/qpaintengine_raster_p.h   |  2 +-
 src/gui/painting/qpdfwriter.h              | 12 +++---
 src/gui/painting/qstroker_p.h              |  8 ++--
 10 files changed, 73 insertions(+), 73 deletions(-)

diff --git a/src/gui/image/qbmphandler_p.h b/src/gui/image/qbmphandler_p.h
index c4800e3f97d..ab164d9f831 100644
--- a/src/gui/image/qbmphandler_p.h
+++ b/src/gui/image/qbmphandler_p.h
@@ -93,17 +93,17 @@ public:
     };
 
     explicit QBmpHandler(InternalFormat fmt = BmpFormat);
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
+    bool canRead() const override;
+    bool read(QImage *image) override;
+    bool write(const QImage &image) override;
 
-    QByteArray name() const;
+    QByteArray name() const override;
 
     static bool canRead(QIODevice *device);
 
-    QVariant option(ImageOption option) const;
-    void setOption(ImageOption option, const QVariant &value);
-    bool supportsOption(ImageOption option) const;
+    QVariant option(ImageOption option) const override;
+    void setOption(ImageOption option, const QVariant &value) override;
+    bool supportsOption(ImageOption option) const override;
 
 private:
     bool readHeader();
diff --git a/src/gui/image/qpnghandler_p.h b/src/gui/image/qpnghandler_p.h
index fb5a830baab..00f9fa59212 100644
--- a/src/gui/image/qpnghandler_p.h
+++ b/src/gui/image/qpnghandler_p.h
@@ -64,15 +64,15 @@ public:
     QPngHandler();
     ~QPngHandler();
 
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
+    bool canRead() const override;
+    bool read(QImage *image) override;
+    bool write(const QImage &image) override;
 
-    QByteArray name() const;
+    QByteArray name() const override;
 
-    QVariant option(ImageOption option) const;
-    void setOption(ImageOption option, const QVariant &value);
-    bool supportsOption(ImageOption option) const;
+    QVariant option(ImageOption option) const override;
+    void setOption(ImageOption option, const QVariant &value) override;
+    bool supportsOption(ImageOption option) const override;
 
     static bool canRead(QIODevice *device);
 
diff --git a/src/gui/image/qppmhandler_p.h b/src/gui/image/qppmhandler_p.h
index 1e8ca2b81e6..e790aafdcda 100644
--- a/src/gui/image/qppmhandler_p.h
+++ b/src/gui/image/qppmhandler_p.h
@@ -62,17 +62,17 @@ class QPpmHandler : public QImageIOHandler
 {
 public:
     QPpmHandler();
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
+    bool canRead() const override;
+    bool read(QImage *image) override;
+    bool write(const QImage &image) override;
 
-    QByteArray name() const;
+    QByteArray name() const override;
 
     static bool canRead(QIODevice *device, QByteArray *subType = 0);
 
-    QVariant option(ImageOption option) const;
-    void setOption(ImageOption option, const QVariant &value);
-    bool supportsOption(ImageOption option) const;
+    QVariant option(ImageOption option) const override;
+    void setOption(ImageOption option, const QVariant &value) override;
+    bool supportsOption(ImageOption option) const override;
 
 private:
     bool readHeader();
diff --git a/src/gui/image/qxbmhandler_p.h b/src/gui/image/qxbmhandler_p.h
index 5094a43ef60..8649857255c 100644
--- a/src/gui/image/qxbmhandler_p.h
+++ b/src/gui/image/qxbmhandler_p.h
@@ -61,17 +61,17 @@ class QXbmHandler : public QImageIOHandler
 {
 public:
     QXbmHandler();
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
+    bool canRead() const override;
+    bool read(QImage *image) override;
+    bool write(const QImage &image) override;
 
-    QByteArray name() const;
+    QByteArray name() const override;
 
     static bool canRead(QIODevice *device);
 
-    QVariant option(ImageOption option) const;
-    void setOption(ImageOption option, const QVariant &value);
-    bool supportsOption(ImageOption option) const;
+    QVariant option(ImageOption option) const override;
+    void setOption(ImageOption option, const QVariant &value) override;
+    bool supportsOption(ImageOption option) const override;
 
 private:
     bool readHeader();
diff --git a/src/gui/image/qxpmhandler_p.h b/src/gui/image/qxpmhandler_p.h
index 9a2041be941..a54427e8534 100644
--- a/src/gui/image/qxpmhandler_p.h
+++ b/src/gui/image/qxpmhandler_p.h
@@ -61,17 +61,17 @@ class QXpmHandler : public QImageIOHandler
 {
 public:
     QXpmHandler();
-    bool canRead() const;
-    bool read(QImage *image);
-    bool write(const QImage &image);
+    bool canRead() const override;
+    bool read(QImage *image) override;
+    bool write(const QImage &image) override;
 
     static bool canRead(QIODevice *device);
 
-    QByteArray name() const;
+    QByteArray name() const override;
 
-    QVariant option(ImageOption option) const;
-    void setOption(ImageOption option, const QVariant &value);
-    bool supportsOption(ImageOption option) const;
+    QVariant option(ImageOption option) const override;
+    void setOption(ImageOption option, const QVariant &value) override;
+    bool supportsOption(ImageOption option) const override;
 
 private:
     bool readHeader();
diff --git a/src/gui/opengl/qopenglpaintdevice.h b/src/gui/opengl/qopenglpaintdevice.h
index dffa68c29e6..ce639e647e8 100644
--- a/src/gui/opengl/qopenglpaintdevice.h
+++ b/src/gui/opengl/qopenglpaintdevice.h
@@ -61,8 +61,8 @@ public:
     QOpenGLPaintDevice(int width, int height);
     virtual ~QOpenGLPaintDevice();
 
-    int devType() const { return QInternal::OpenGL; }
-    QPaintEngine *paintEngine() const;
+    int devType() const override { return QInternal::OpenGL; }
+    QPaintEngine *paintEngine() const override;
 
     QOpenGLContext *context() const;
     QSize size() const;
@@ -82,7 +82,7 @@ public:
 
 protected:
     QOpenGLPaintDevice(QOpenGLPaintDevicePrivate &dd);
-    int metric(QPaintDevice::PaintDeviceMetric metric) const;
+    int metric(QPaintDevice::PaintDeviceMetric metric) const override;
 
     Q_DISABLE_COPY(QOpenGLPaintDevice)
     QScopedPointer<QOpenGLPaintDevicePrivate> d_ptr;
diff --git a/src/gui/painting/qemulationpaintengine_p.h b/src/gui/painting/qemulationpaintengine_p.h
index f3cf88af176..df583324790 100644
--- a/src/gui/painting/qemulationpaintengine_p.h
+++ b/src/gui/painting/qemulationpaintengine_p.h
@@ -61,37 +61,37 @@ class QEmulationPaintEngine : public QPaintEngineEx
 public:
     QEmulationPaintEngine(QPaintEngineEx *engine);
 
-    virtual bool begin(QPaintDevice *pdev);
-    virtual bool end();
+    bool begin(QPaintDevice *pdev) override;
+    bool end() override;
 
-    virtual Type type() const;
-    virtual QPainterState *createState(QPainterState *orig) const;
+    Type type() const override;
+    QPainterState *createState(QPainterState *orig) const override;
 
-    virtual void fill(const QVectorPath &path, const QBrush &brush);
-    virtual void stroke(const QVectorPath &path, const QPen &pen);
-    virtual void clip(const QVectorPath &path, Qt::ClipOperation op);
+    void fill(const QVectorPath &path, const QBrush &brush) override;
+    void stroke(const QVectorPath &path, const QPen &pen) override;
+    void clip(const QVectorPath &path, Qt::ClipOperation op) override;
 
-    virtual void drawPixmap(const QRectF &r, const QPixmap &pm, const QRectF &sr);
-    virtual void drawTextItem(const QPointF &p, const QTextItem &textItem);
-    virtual void drawStaticTextItem(QStaticTextItem *item);
-    virtual void drawTiledPixmap(const QRectF &r, const QPixmap &pixmap, const QPointF &s);
-    virtual void drawImage(const QRectF &r, const QImage &pm, const QRectF &sr, Qt::ImageConversionFlags flags);
+    void drawPixmap(const QRectF &r, const QPixmap &pm, const QRectF &sr) override;
+    void drawTextItem(const QPointF &p, const QTextItem &textItem) override;
+    void drawStaticTextItem(QStaticTextItem *item) override;
+    void drawTiledPixmap(const QRectF &r, const QPixmap &pixmap, const QPointF &s) override;
+    void drawImage(const QRectF &r, const QImage &pm, const QRectF &sr, Qt::ImageConversionFlags flags) override;
 
-    virtual void clipEnabledChanged();
-    virtual void penChanged();
-    virtual void brushChanged();
-    virtual void brushOriginChanged();
-    virtual void opacityChanged();
-    virtual void compositionModeChanged();
-    virtual void renderHintsChanged();
-    virtual void transformChanged();
+    void clipEnabledChanged() override;
+    void penChanged() override;
+    void brushChanged() override;
+    void brushOriginChanged() override;
+    void opacityChanged() override;
+    void compositionModeChanged() override;
+    void renderHintsChanged() override;
+    void transformChanged() override;
 
-    virtual void setState(QPainterState *s);
+    void setState(QPainterState *s) override;
 
-    virtual void beginNativePainting();
-    virtual void endNativePainting();
+    void beginNativePainting() override;
+    void endNativePainting() override;
 
-    virtual uint flags() const {return QPaintEngineEx::IsEmulationEngine | QPaintEngineEx::DoNotEmulate;}
+    uint flags() const override { return QPaintEngineEx::IsEmulationEngine | QPaintEngineEx::DoNotEmulate; }
 
     inline QPainterState *state() { return (QPainterState *)QPaintEngine::state; }
     inline const QPainterState *state() const { return (const QPainterState *)QPaintEngine::state; }
diff --git a/src/gui/painting/qpaintengine_raster_p.h b/src/gui/painting/qpaintengine_raster_p.h
index 1afb1195352..2a213fa238f 100644
--- a/src/gui/painting/qpaintengine_raster_p.h
+++ b/src/gui/painting/qpaintengine_raster_p.h
@@ -286,7 +286,7 @@ public:
     void rasterize(QT_FT_Outline *outline, ProcessSpans callback, void *userData, QRasterBuffer *rasterBuffer);
     void updateMatrixData(QSpanData *spanData, const QBrush &brush, const QTransform &brushMatrix);
 
-    void systemStateChanged();
+    void systemStateChanged() override;
 
     void drawImage(const QPointF &pt, const QImage &img, SrcOverBlendFunc func,
                    const QRect &clip, int alpha, const QRect &sr = QRect());
diff --git a/src/gui/painting/qpdfwriter.h b/src/gui/painting/qpdfwriter.h
index cf1da95bf15..c36f3c7a915 100644
--- a/src/gui/painting/qpdfwriter.h
+++ b/src/gui/painting/qpdfwriter.h
@@ -67,7 +67,7 @@ public:
     QString creator() const;
     void setCreator(const QString &creator);
 
-    bool newPage();
+    bool newPage() override;
 
     void setResolution(int resolution);
     int resolution() const;
@@ -83,14 +83,14 @@ public:
     using QPagedPaintDevice::setPageSize;
 #endif
 
-    void setPageSize(PageSize size);
-    void setPageSizeMM(const QSizeF &size);
+    void setPageSize(PageSize size) override;
+    void setPageSizeMM(const QSizeF &size) override;
 
-    void setMargins(const Margins &m);
+    void setMargins(const Margins &m) override;
 
 protected:
-    QPaintEngine *paintEngine() const;
-    int metric(PaintDeviceMetric id) const;
+    QPaintEngine *paintEngine() const override;
+    int metric(PaintDeviceMetric id) const override;
 
 private:
     Q_DISABLE_COPY(QPdfWriter)
diff --git a/src/gui/painting/qstroker_p.h b/src/gui/painting/qstroker_p.h
index e17e68b2379..ac30f5b5e85 100644
--- a/src/gui/painting/qstroker_p.h
+++ b/src/gui/painting/qstroker_p.h
@@ -233,7 +233,7 @@ protected:
     static Qt::PenJoinStyle joinForJoinMode(LineJoinMode mode);
     static LineJoinMode joinModeForJoin(Qt::PenJoinStyle joinStyle);
 
-    virtual void processCurrentSubpath();
+    void processCurrentSubpath() override;
 
     qfixed m_strokeWidth;
     qfixed m_miterLimit;
@@ -264,14 +264,14 @@ public:
     void setDashOffset(qreal offset) { m_dashOffset = offset; }
     qreal dashOffset() const { return m_dashOffset; }
 
-    virtual void begin(void *data);
-    virtual void end();
+    void begin(void *data) override;
+    void end() override;
 
     inline void setStrokeWidth(qreal width) { m_stroke_width = width; }
     inline void setMiterLimit(qreal limit) { m_miter_limit = limit; }
 
 protected:
-    virtual void processCurrentSubpath();
+    void processCurrentSubpath() override;
 
     QStroker *m_stroker;
     QVector<qfixed> m_dashPattern;

From 534c1ce76d499c680b1b5163346064e8b2bc4617 Mon Sep 17 00:00:00 2001
From: Thiago Macieira <thiago.macieira@intel.com>
Date: Wed, 23 Nov 2016 17:38:05 -0800
Subject: [PATCH 3/7] Remove unnecessary warning disabling

Qt 5.7 cannot be compiled in C++03 mode anymore.

Change-Id: Iaeecaffe26af4535b416fffd1489d808edc3c996
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
---
 src/corelib/kernel/qmetatype.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/corelib/kernel/qmetatype.h b/src/corelib/kernel/qmetatype.h
index b68dbacbd3f..4c3435be534 100644
--- a/src/corelib/kernel/qmetatype.h
+++ b/src/corelib/kernel/qmetatype.h
@@ -1390,10 +1390,6 @@ namespace QtPrivate
     };
 
 
-QT_WARNING_PUSH
-// In C++03 mode, clang consider local or unnamed type and throw a warning instead of ignoring them
-QT_WARNING_DISABLE_CLANG("-Wunnamed-type-template-args")
-QT_WARNING_DISABLE_CLANG("-Wlocal-type-template-args")
     template<typename T> char qt_getEnumMetaObject(const T&);
 
     template<typename T>
@@ -1406,7 +1402,6 @@ QT_WARNING_DISABLE_CLANG("-Wlocal-type-template-args")
         enum { Value = sizeof(qt_getEnumMetaObject(declval())) == sizeof(QMetaObject*) };
     };
     template<> struct IsQEnumHelper<void> { enum { Value = false }; };
-QT_WARNING_POP
 
     template<typename T, typename Enable = void>
     struct MetaObjectForType

From a55f36211efe1bb0d6717c8545366120bd6dfd9f Mon Sep 17 00:00:00 2001
From: Thiago Macieira <thiago.macieira@intel.com>
Date: Mon, 21 Nov 2016 15:17:03 -0800
Subject: [PATCH 4/7] Fix the JPEG EXIF reader to deal with some broken/corrupt
 files

We parse the EXIF header in order to get the proper orientation, so
let's be a bit more careful in what we accept. This patch adds better
handling for reading past the end of the stream, plus it limits the
number of IFDs read (to avoid processing too much data) and deals with a
pathological case of the EXIF file format: EXIF (due to its TIFF
origins) permits the offset to the next IFD to be backwards in the file,
which means it could result in a loop or pointing to plain corrupt data.
We disallow any backwards pointers, since it seems that's what other
decoders do (libexif, for example).

Change-Id: Iaeecaffe26af4535b416fffd1489332db92e3888
(cherry picked from 5.6 commit 02150649f95b8f46f826e6e002be3fa0b6d009bc)
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
---
 src/gui/image/qjpeghandler.cpp                |  31 ++++++++++++------
 .../jpeg_exif_invalid_data_back_pointers.jpg  | Bin 0 -> 910 bytes
 .../jpeg_exif_invalid_data_past_end.jpg       | Bin 0 -> 910 bytes
 .../jpeg_exif_invalid_data_too_many_ifds.jpg  | Bin 0 -> 964 bytes
 .../jpeg_exif_invalid_data_too_many_tags.jpg  | Bin 0 -> 910 bytes
 tests/auto/gui/image/qimage/tst_qimage.cpp    |  17 ++++++++--
 6 files changed, 35 insertions(+), 13 deletions(-)
 create mode 100644 tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_back_pointers.jpg
 create mode 100644 tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_past_end.jpg
 create mode 100644 tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_ifds.jpg
 create mode 100644 tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_tags.jpg

diff --git a/src/gui/image/qjpeghandler.cpp b/src/gui/image/qjpeghandler.cpp
index 52e8b39f11c..f3ba303d629 100644
--- a/src/gui/image/qjpeghandler.cpp
+++ b/src/gui/image/qjpeghandler.cpp
@@ -786,6 +786,10 @@ static bool readExifHeader(QDataStream &stream)
  */
 static int getExifOrientation(QByteArray &exifData)
 {
+    // Current EXIF version (2.3) says there can be at most 5 IFDs,
+    // byte we allow for 10 so we're able to deal with future extensions.
+    const int maxIfdCount = 10;
+
     QDataStream stream(&exifData, QIODevice::ReadOnly);
 
     if (!readExifHeader(stream))
@@ -793,7 +797,8 @@ static int getExifOrientation(QByteArray &exifData)
 
     quint16 val;
     quint32 offset;
-    const qint64 headerStart = stream.device()->pos();
+    const qint64 headerStart = 6;   // the EXIF header has a constant size
+    Q_ASSERT(headerStart == stream.device()->pos());
 
     // read byte order marker
     stream >> val;
@@ -804,7 +809,7 @@ static int getExifOrientation(QByteArray &exifData)
     else
         return -1; // unknown byte order
 
-    // read size
+    // confirm byte order
     stream >> val;
     if (val != 0x2a)
         return -1;
@@ -812,18 +817,22 @@ static int getExifOrientation(QByteArray &exifData)
     stream >> offset;
 
     // read IFD
-    while (!stream.atEnd()) {
+    for (int n = 0; n < maxIfdCount; ++n) {
         quint16 numEntries;
 
-        // skip offset bytes to get the next IFD
         const qint64 bytesToSkip = offset - (stream.device()->pos() - headerStart);
-
-        if (stream.skipRawData(bytesToSkip) != bytesToSkip)
+        if (bytesToSkip < 0 || (offset + headerStart >= exifData.size())) {
+            // disallow going backwards, though it's permitted in the spec
             return -1;
+        } else if (bytesToSkip != 0) {
+            // seek to the IFD
+            if (!stream.device()->seek(offset + headerStart))
+                return -1;
+        }
 
         stream >> numEntries;
 
-        for (; numEntries > 0; --numEntries) {
+        for (; numEntries > 0 && stream.status() == QDataStream::Ok; --numEntries) {
             quint16 tag;
             quint16 type;
             quint32 components;
@@ -847,12 +856,14 @@ static int getExifOrientation(QByteArray &exifData)
 
         // read offset to next IFD
         stream >> offset;
+        if (stream.status() != QDataStream::Ok)
+            return -1;
         if (offset == 0) // this is the last IFD
-            break;
+            return 0;   // No Exif orientation was found
     }
 
-    // No Exif orientation was found
-    return 0;
+    // too many IFDs
+    return -1;
 }
 
 static QImageIOHandler::Transformations exif2Qt(int exifOrientation)
diff --git a/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_back_pointers.jpg b/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_back_pointers.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..164d3080a3148b8db93180c2eb98d7339f29d597
GIT binary patch
literal 910
zcmex=<NpH&0WUXCHwH#VMg|aM`2UbW$+aRgje)__Q;UIv0R$i<P!0${?EkkJoIyG$
z0w6;uG61Cc{~-oJ4hAj;E@nnS1|~s9W<kdPM;OGw-T^xuO0Y9<0>vd68JL)XenbLn
zOw25-|8Fty0L7UEm<1RZ7_Uggt^0Z|#p5bFNQ(diGY}#HW)^lvHUXd(4p5M>GU=I3
z4w0Pee>Z(TP`R`q12a$<NdqGj3$r4FfFM`{P|lul-LCbkX0Kb;owu!b^`=wbF3noK
zs#iKob6M}qZ})n?mR--?T7KDAcJ9p?lOJ}Osm}78Ib+h98!3^UFIA@g^0Za?GQS>Z
zkvzyE21XWyO+b$@vNN!<2?_`)f-PeLS;oN1py{9;b;L27@c?T>`V|M3T8@ssG>&I!
zY3XbJyz=vT(xEy_qLTfbQkUjsmBN!x=l;q}nO54BJ}dKbg;wQ-1+1!Cj8W5+7?hM}
zeg=6E7#`qQgNFzx0NEG?grFh9X3rFE-@Pj0PPpaC!e3=ipNp|1{@x$HeTr&~S)ufn
z+oGAzK7WqssIv3EGoy8iLutr;R+Gql?&IO9`MIXo{f)bRWiEZ@TPtF_Q8?ziNoQ|1
zM{k=;THN$~zrO>m7Xw8HDqw`ig}tKa_36y^t-njlT+`REt$)Sk4|EhbX2H4yO89|B
zhzbHD2n9e*07Z^~_kv?PA7;zAq&qm8R_%0jTD2M!+G0RGsG1lVAl8BcS-?)-YsG{@
xbp|HsC$o0EN;ZFa9%PRInid8|1!x!nwG_XSbITT+k#_2-P~Be^{s#H~Hvw*O+c*FK

literal 0
HcmV?d00001

diff --git a/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_past_end.jpg b/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_past_end.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..7e2451e6f9d5078aba50c989583b8647d5d8ca09
GIT binary patch
literal 910
zcmex=<NpH&0WUXCHwH#VMg|aM`2UbW$+aRgje)__Q;VU20R%X}Bv1|rK<xjw8Js~n
zC;}iuC^7(~`TrpXK@J8k1}<hsK?Wv4MrJ|A|3?_az}|s68ceY>a010885x+Efqp~+
zY)s57tp9H@@Bqb`1egUF7#Oce#I5^!F2&<2J4lNF12YgJ0cI9<Mm7PU77kF5u`=nI
zO%9Qq>wh<WK2W)|AOkZ{7)b*o6AQB<gMc7d15nPMaow)<t7flT)}6PlclD-I-!9Es
zy{cC_OLJN8%y0L4zm{Fk-CBOxS9b2r8IvD&nW@h5oH=9CnHwpQoiA0U{_?a{`7*yA
zXpua~A_hhlgiSz?FtRhSvIz<ZDS|Cy0$Iku%Ao0>9d*PpoACf^L;4j5mRgREzBG<!
zX=&+e{=D+@dD5XeOQMqfoKlzOWtGB{Pv`#1Oqo{Nl|C!;a)nmqg$1mtT8vTClo*th
zXMP5G5EvfdSc8WMC;-_Q1%#j>!e-ADZr{Bs;!e2b$--Y{PoImiB>vtXzI}>nj9H=d
zmfND4&pv;S>8P^vzB8kBibHA0eO8mmeD34nsrk94*ZqyVeq}Cw=36UbyHPmiyGdtn
zHb-xpOIqCYeZRj0trr7D2P$BM$A!J3==JH$_N~85%Usjfu&sZ^<qvceIA+1R1WNdU
zMu-XmBM1dRO#nrXfcJu9J0E7txTHHcnpW*}bXv6<6xw1yJ*b)(86ehz0$IRL-fP8#
yLUjfv=_j*xyh=8Ic^+hs0GbvCMg?dX0kssrl5@)zn~`?vsZiZt7XAkL|2F{%FWayH

literal 0
HcmV?d00001

diff --git a/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_ifds.jpg b/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_ifds.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..52c6a93f0891ca4440219b814f33b2c3ccf16c9f
GIT binary patch
literal 964
zcmex=<NpH&0WUXCHwH#VMg|aM`2Ub0!nGnZje)__Q;UIv0R;HKqzIUl0+R}0QVmS%
zfJq}TX#pnfz@!V9^a7J0;{R<1XOKM<0gxdS835A!{}6*92Ll%a7c-+E1Ct;lvmoRD
zBMf5TK!7_J$Y5vS1d2;CGB7a%Lk0=3F)_2S{=db*0~BWxU>0CtV7wv`x9;n?6pyRy
zAT0t6%s_|)m|55v*#v-EI6wi-%A{vDIYe@<|K0TYK;_bc49q}bBn^yAEX;}w0)k)-
zKskHHb-UKDn!RpWciy(%)tgRzyEJR{s$S_V&1JnazuoKoT6R5mYx!kg*||4oOn%s9
zraH@W=8Q>aZlpwZzEqj|%hOin%lvwvMe-nv7#LX)HUT}t$j-pZCMY1J2)2v~WElf1
zgQkOa)Dg#Q#sjPk=~o<BYB@Uk(m0-_rKPX=^UBZXNr&nziAwf!N?n?lRSHi&o%<^@
zWm;)h`mD^$6<U=S7O<*nF-A>OVo*|^`5ELvV0eII4IUz(0Aynn5Q2sXn>|ywefO$}
zJK>fm3xAb8eJ;k5_<Mi&_9?0{W`)vQZi{9<`}{ekqsq?v&WzS64y7UYSxqAIxsQjZ
z=I5GT_c!kPmAUkpZ>@;!M&X$6CY`<69KCHWX>rr{{r(QLUJMi+sDKe37xs#x*QYbv
zxBf0Ib4_2vw*D2DKhRO&m<8(+DB%YhAu0%rAQS*K0Tej`-V2WHe3&iclJ4MWTD8;B
zY1L{_Xo~^$plV`dfLIF(WC1&QuN4yt)ft$ipUm3vD%t$yd5}E<Xj&K;6`)}R)KdIP
W&MjMPM%t;TLUn&x_#5Q^-vj^`!`Vgv

literal 0
HcmV?d00001

diff --git a/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_tags.jpg b/tests/auto/gui/image/qimage/images/jpeg_exif_invalid_data_too_many_tags.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..6a080aada7b589d2ed786dbc4fa6ecf7cfc5495b
GIT binary patch
literal 910
zcmex=<NpH&0WUXCHwH#VMg|aM`2UbW$+aRgje)__Q;UIv0VwhxM1sJ7AOMTpW^e}S
zpa}d28bXl)AkF^|F$i)na4~Q(GYT>=2{JMZGX6ipAO`jh#LW<roq-c5F3HHi#0>N!
z5@2IuW?}t*i-89y&LqGrz`($GMIvt9*K;WzSJ^>Y1Q?is5D74|ursm=0JU&{f{c|(
z&unst<Xr!|>GOfgr3D$7fx<`{7@1g@6&VBs!5V;a_KfRxtzR{J-LmeyZM~~Eo%(iZ
z*6LNg(pj3zdS`yS*ZZ~XdhXWp%f7O6Z_b$fu**z!mgmeFlg`{oiR^r-GWD0It;(1A
z^+1c{K^8GEvLI{%dW4akft5{AKu8g68577d237`52kodMj@gU{SR2x>IIz@mbo8Zh
zJWESUU-RdcpU;yH)maji?B|raG%u?Zo_sp@S7yqz(ysJbnU^cHDlaTxRn=mQnx@2{
zq&)L8$b-P}0LL0UL_h(^#wZ{J4G}hbrf~c2RS|c>El(EyDtr1|j3x2+{_yQnRAbBv
zrMKJ`&3yLxb4*8-o%fv?ty3IIL+-PhMCNlJ4^Pd{HNEa{-1RGS=`-J25!;QzG2cx(
zd$T!u+g#G(rtkax9caB6C^}F9BRnqb6-BR4XSQ$sU0UXvzJ_i6D=vSaqrfo>)+JEF
z4>Uql5Ewxy0BQm#as<2=9NYOYTgD~b!O^s8r=!!V)u7N81L{H5#K-`#78J+=cJf{;
zCKReOFiAg|wc}N?`OEVldj!z5Ffb}W!w9IQ_?4Vnw%ClcQ%{BJ{<82l$p60y05=QW
AHUIzs

literal 0
HcmV?d00001

diff --git a/tests/auto/gui/image/qimage/tst_qimage.cpp b/tests/auto/gui/image/qimage/tst_qimage.cpp
index 85d258de5bf..26772d5655a 100644
--- a/tests/auto/gui/image/qimage/tst_qimage.cpp
+++ b/tests/auto/gui/image/qimage/tst_qimage.cpp
@@ -183,7 +183,8 @@ private slots:
     void exifOrientation();
 
     void exif_QTBUG45865();
-    void exif_invalid_data_QTBUG46870();
+    void exifInvalidData_data();
+    void exifInvalidData();
 
     void cleanupFunctions();
 
@@ -3028,10 +3029,20 @@ void tst_QImage::exif_QTBUG45865()
     QCOMPARE(image.size(), QSize(5, 8));
 }
 
-void tst_QImage::exif_invalid_data_QTBUG46870()
+void tst_QImage::exifInvalidData_data()
+{
+    QTest::addColumn<bool>("$never used");
+    QTest::newRow("QTBUG-46870");
+    QTest::newRow("back_pointers");
+    QTest::newRow("past_end");
+    QTest::newRow("too_many_ifds");
+    QTest::newRow("too_many_tags");
+}
+
+void tst_QImage::exifInvalidData()
 {
     QImage image;
-    QVERIFY(image.load(m_prefix + "jpeg_exif_invalid_data_QTBUG-46870.jpg"));
+    QVERIFY(image.load(m_prefix + "jpeg_exif_invalid_data_" + QTest::currentDataTag() + ".jpg"));
     QVERIFY(!image.isNull());
 }
 

From 4f959b6b3004ecbd0d34b34f613ce9980ba42b55 Mon Sep 17 00:00:00 2001
From: Timur Pocheptsov <timur.pocheptsov@qt.io>
Date: Mon, 28 Nov 2016 16:02:26 +0100
Subject: [PATCH 5/7] ~QHttpNetworkConnectionPrivate - disconnect from socket's
 signals

We have a 'channel' object connected to a socket with Qt::DirectConnection.
QHttpNetworkConnectionPrivate in its dtor (note, it's a private object destroyed
after its 'q' - QHttpNetworkConnection - was destroyed) calls socket->close()
and this can end up in socket setting an error and emitting (for example, in
QSslSocket::transmit). The slot (QHttpNetworkConnectionChannel::_q_error) will
access the now-dead/non-existing connection then. So disconnect the channel
from the socket early, before closing the socket.

Task-number: QTBUG-54167
Change-Id: I3ed4ba4b00650c3a39e5c1f33aa786e47bfbbc57
Reviewed-by: Konstantin Tokarev <annulen@yandex.ru>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
---
 src/network/access/qhttpnetworkconnection.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/network/access/qhttpnetworkconnection.cpp b/src/network/access/qhttpnetworkconnection.cpp
index 7f07403a73a..1b1ecff21ee 100644
--- a/src/network/access/qhttpnetworkconnection.cpp
+++ b/src/network/access/qhttpnetworkconnection.cpp
@@ -116,6 +116,7 @@ QHttpNetworkConnectionPrivate::~QHttpNetworkConnectionPrivate()
 {
     for (int i = 0; i < channelCount; ++i) {
         if (channels[i].socket) {
+            QObject::disconnect(channels[i].socket, Q_NULLPTR, &channels[i], Q_NULLPTR);
             channels[i].socket->close();
             delete channels[i].socket;
         }

From 019c932ca9bf7c274fd8a402c2af200b5b0cbc59 Mon Sep 17 00:00:00 2001
From: Oswald Buddenhagen <oswald.buddenhagen@qt.io>
Date: Fri, 2 Dec 2016 19:53:47 +0100
Subject: [PATCH 6/7] unbreak "aux" template for mingw & msvc, take 3

eliminating everying TARGET-related was a nice try, but in the real
world (e.g., qttranslations), extra compilers are activated by
PRE_TARGETDEPS, which of course doesn't work when TARGET is entirely
gone.
so instead, let it act as a phony target. this is consistent with the
unix generator.

supersedes 0810d48bc in amending af2847260.

Task-number: QTBUG-57423
Change-Id: I3d2ecc4ff42b37ffe5f71f5c20d17c06b31f4da2
Reviewed-by: Jake Petroules <jake.petroules@qt.io>
Reviewed-by: Oliver Wolff <oliver.wolff@qt.io>
---
 qmake/generators/win32/mingw_make.cpp  | 6 +++---
 qmake/generators/win32/msvc_nmake.cpp  | 5 ++---
 qmake/generators/win32/winmakefile.cpp | 3 +++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/qmake/generators/win32/mingw_make.cpp b/qmake/generators/win32/mingw_make.cpp
index e3d76cd76ef..8d5a9a7d0fc 100644
--- a/qmake/generators/win32/mingw_make.cpp
+++ b/qmake/generators/win32/mingw_make.cpp
@@ -308,13 +308,13 @@ void MingwMakefileGenerator::writeBuildRulesPart(QTextStream &t)
 {
     t << "first: all\n";
     t << "all: " << escapeDependencyPath(fileFixify(Option::output.fileName()))
-      << ' ' << depVar("ALL_DEPS");
+      << ' ' << depVar("ALL_DEPS") << " $(DESTDIR_TARGET)\n\n";
+    t << "$(DESTDIR_TARGET): " << depVar("PRE_TARGETDEPS") << " $(OBJECTS) " << depVar("POST_TARGETDEPS");
     if (project->first("TEMPLATE") == "aux") {
         t << "\n\n";
         return;
     }
-    t << " $(DESTDIR_TARGET)\n\n";
-    t << "$(DESTDIR_TARGET): " << depVar("PRE_TARGETDEPS") << " $(OBJECTS) " << depVar("POST_TARGETDEPS");
+
     if(!project->isEmpty("QMAKE_PRE_LINK"))
         t << "\n\t" <<var("QMAKE_PRE_LINK");
     if(project->isActiveConfig("staticlib") && project->first("TEMPLATE") == "lib") {
diff --git a/qmake/generators/win32/msvc_nmake.cpp b/qmake/generators/win32/msvc_nmake.cpp
index c3ac097a981..746746b9f6a 100644
--- a/qmake/generators/win32/msvc_nmake.cpp
+++ b/qmake/generators/win32/msvc_nmake.cpp
@@ -549,13 +549,12 @@ void NmakeMakefileGenerator::writeBuildRulesPart(QTextStream &t)
 
     t << "first: all\n";
     t << "all: " << escapeDependencyPath(fileFixify(Option::output.fileName()))
-      << ' ' << depVar("ALL_DEPS");
+      << ' ' << depVar("ALL_DEPS") << " $(DESTDIR_TARGET)\n\n";
+    t << "$(DESTDIR_TARGET): " << depVar("PRE_TARGETDEPS") << " $(OBJECTS) " << depVar("POST_TARGETDEPS");
     if (templateName == "aux") {
         t << "\n\n";
         return;
     }
-    t << " $(DESTDIR_TARGET)\n\n";
-    t << "$(DESTDIR_TARGET): " << depVar("PRE_TARGETDEPS") << " $(OBJECTS) " << depVar("POST_TARGETDEPS");
 
     if(!project->isEmpty("QMAKE_PRE_LINK"))
         t << "\n\t" <<var("QMAKE_PRE_LINK");
diff --git a/qmake/generators/win32/winmakefile.cpp b/qmake/generators/win32/winmakefile.cpp
index 68f0e4fe545..21f7580c73c 100644
--- a/qmake/generators/win32/winmakefile.cpp
+++ b/qmake/generators/win32/winmakefile.cpp
@@ -165,6 +165,9 @@ Win32MakefileGenerator::findLibraries(bool linkPrl, bool mergeLflags)
 
 void Win32MakefileGenerator::processVars()
 {
+    if (project->first("TEMPLATE").endsWith("aux"))
+        return;
+
     project->values("QMAKE_ORIG_TARGET") = project->values("TARGET");
     if (project->isEmpty("QMAKE_PROJECT_NAME"))
         project->values("QMAKE_PROJECT_NAME") = project->values("QMAKE_ORIG_TARGET");

From b9e800cd996e1401d3157a0cdb9e6ee6b05fd3a5 Mon Sep 17 00:00:00 2001
From: Oswald Buddenhagen <oswald.buddenhagen@qt.io>
Date: Tue, 6 Dec 2016 16:00:14 +0100
Subject: [PATCH 7/7] fix qlalr invocation in silent builds

Change-Id: I8cd5da01dcbcdebe29815a80cc0f65365727465d
Reviewed-by: Alex Blasche <alexander.blasche@qt.io>
Reviewed-by: Jake Petroules <jake.petroules@qt.io>
---
 mkspecs/features/qlalr.prf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mkspecs/features/qlalr.prf b/mkspecs/features/qlalr.prf
index 941bfe0d9f6..54d8b583c6b 100644
--- a/mkspecs/features/qlalr.prf
+++ b/mkspecs/features/qlalr.prf
@@ -25,7 +25,7 @@ for (s, QLALRSOURCES) {
     $${base}.variable_out = GENERATED_SOURCES
     $${base}.depends += $$QMAKE_QLALR_EXE
     $${base}.commands = $$QMAKE_QLALR $$QMAKE_QLALRFLAGS ${QMAKE_FILE_IN}
-    silent: $${base}.commands = @echo qlalr ${QMAKE_FILE_IN} && $${base}.commands
+    silent: $${base}.commands = @echo qlalr ${QMAKE_FILE_IN} && $$eval($${base}.commands)
     $${base}.name = QLALR ${QMAKE_FILE_IN}
 
     $${base}_h.input = $$invar