AIKIDO-2026-870978

TL;DR

The Qt .qm compiled-translation parser in translate/storage/qm.py reads message subsection lengths as signed 32-bit integers and advances the parse cursor by that length without checking that it is non-negative. A crafted file that declares a negative length for a SourceText, Context, or Disambiguating subsection moves the cursor backward onto already-parsed bytes, so the same data is read again and parsing never terminates. The process spins at full CPU indefinitely without raising an error or allocating memory. The fix reads these subsection lengths as unsigned values and rejects malformed messages with invalid lengths.