dxbjavidandVadim Zeitlin ebd86dee67 Reject out-of-range parent index in cached help book ...

LoadCachedBook reads each index entry's parent back-reference straight
from the .cached file and uses it as an index with no check, so a
crafted cached file (which can sit inside a .htb help archive opened
through AddBook) may result in creating a pointer to data outside the
m_index array; that pointer is later dereferenced when the index is
sorted at the end of AddBookParam.

The change rejects the file when parentShift is negative or larger than
the number of index entries loaded so far, matching the existing version
and flags checks just above.

Also add a small test under tests/html that feeds such a cached stream
and confirms it is now refused rather than reading out of bounds.

Closes #26577.

2026-06-11 23:40:20 +02:00

..

helpdata.cpp

Reject out-of-range parent index in cached help book

2026-06-11 23:40:20 +02:00

htmlparser.cpp

…

htmlwindow.cpp

…

htmprint.cpp

…