diff options
Diffstat (limited to 'dev-qt/qtcore/files')
-rw-r--r-- | dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch | 98 | ||||
-rw-r--r-- | dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch | 28 | ||||
-rw-r--r-- | dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch | 54 |
3 files changed, 180 insertions, 0 deletions
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch new file mode 100644 index 000000000000..055794b51964 --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch @@ -0,0 +1,98 @@ +From 1232205e32464d90e871f39eb1e14fcf9b78a163 Mon Sep 17 00:00:00 2001 +From: Rainer Keller <Rainer.Keller@qt.io> +Date: Tue, 27 Aug 2019 14:44:48 +0200 +Subject: [PATCH] Fix crash when text contains too many directional chars + +In case a text to be layouted contains more than 128 directional characters +it causes the application to crash + +The function initScriptAnalysisAndIsolatePairs() collects information of +RTL/LTR chaaracters into vector "isolatePairs". The size of the vector is +capped to 128. Later the function generateDirectionalRuns() iterates +the text again and tries to access items from the previously capped vector +above the upper bound. + +Task-number: QTBUG-77819 +Change-Id: Ibb7bf12c12b1db22f43ff46236518da3fdeed26a +Reviewed-by: Simon Hausmann <simon.hausmann@qt.io> +--- + src/gui/text/qtextengine.cpp | 15 +++++++-------- + tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp | 17 +++++++++++++++++ + 2 files changed, 24 insertions(+), 8 deletions(-) + +diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp +index 2da13289bfd..a7834587b1e 100644 +--- a/src/gui/text/qtextengine.cpp ++++ b/src/gui/text/qtextengine.cpp +@@ -399,6 +399,7 @@ struct QBidiAlgorithm { + analysis[i].bidiDirection = (level & 1) ? QChar::DirR : QChar::DirL; + runHasContent = true; + lastRunWithContent = -1; ++ ++isolatePairPosition; + } + int runBeforeIsolate = runs.size(); + ushort newLevel = isRtl ? ((stack.top().level + 1) | 1) : ((stack.top().level + 2) & ~1); +@@ -440,21 +441,19 @@ struct QBidiAlgorithm { + doEmbed(true, true, false); + break; + case QChar::DirLRI: +- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i); + doEmbed(false, false, true); +- ++isolatePairPosition; + break; + case QChar::DirRLI: +- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i); + doEmbed(true, false, true); +- ++isolatePairPosition; + break; + case QChar::DirFSI: { +- const auto &pair = isolatePairs.at(isolatePairPosition); +- Q_ASSERT(pair.start == i); +- bool isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft(); ++ bool isRtl = false; ++ if (isolatePairPosition < isolatePairs.size()) { ++ const auto &pair = isolatePairs.at(isolatePairPosition); ++ Q_ASSERT(pair.start == i); ++ isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft(); ++ } + doEmbed(isRtl, false, true); +- ++isolatePairPosition; + break; + } + +diff --git a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp +index 9c477589f93..f0a32c2ed40 100644 +--- a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp ++++ b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp +@@ -138,6 +138,7 @@ private slots: + void noModificationOfInputString(); + void superscriptCrash_qtbug53911(); + void showLineAndParagraphSeparatorsCrash(); ++ void tooManyDirectionalCharctersCrash_qtbug77819(); + + private: + QFont testFont; +@@ -2309,5 +2310,21 @@ void tst_QTextLayout::nbspWithFormat() + QCOMPARE(layout.lineAt(1).textLength(), s2.length() + 1 + s3.length()); + } + ++void tst_QTextLayout::tooManyDirectionalCharctersCrash_qtbug77819() ++{ ++ QString data; ++ data += QString::fromUtf8("\xe2\x81\xa8"); // U+2068 FSI character ++ data += QString::fromUtf8("\xe2\x81\xa7"); // U+2067 RLI character ++ ++ // duplicating the text ++ for (int i = 0; i < 10; i++) ++ data += data; ++ ++ // Nothing to test. It must not crash in beginLayout(). ++ QTextLayout tl(data); ++ tl.beginLayout(); ++ tl.endLayout(); ++} ++ + QTEST_MAIN(tst_QTextLayout) + #include "tst_qtextlayout.moc" +-- +2.16.3 diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch new file mode 100644 index 000000000000..b0e5b564e2d8 --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch @@ -0,0 +1,28 @@ +From bf131e8d2181b3404f5293546ed390999f760404 Mon Sep 17 00:00:00 2001 +From: Olivier Goffart <ogoffart@woboq.com> +Date: Fri, 8 Nov 2019 11:30:40 +0100 +Subject: Do not load plugin from the $PWD + +I see no reason why this would make sense to look for plugins in the current +directory. And when there are plugins there, it may actually be wrong + +Change-Id: I5f5aa168021fedddafce90effde0d5762cd0c4c5 +Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> +--- + src/corelib/plugin/qpluginloader.cpp | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp +index cadff4f32b..c2443dbdda 100644 +--- a/src/corelib/plugin/qpluginloader.cpp ++++ b/src/corelib/plugin/qpluginloader.cpp +@@ -305,7 +305,6 @@ static QString locatePlugin(const QString& fileName) + paths.append(fileName.left(slash)); // don't include the '/' + } else { + paths = QCoreApplication::libraryPaths(); +- paths.prepend(QStringLiteral(".")); // search in current dir first + } + + for (const QString &path : qAsConst(paths)) { +-- +cgit v1.2.1 diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch new file mode 100644 index 000000000000..1f6b2dfafecc --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch @@ -0,0 +1,54 @@ +From e6f1fde24f77f63fb16b2df239f82a89d2bf05dd Mon Sep 17 00:00:00 2001 +From: Thiago Macieira <thiago.macieira@intel.com> +Date: Fri, 10 Jan 2020 09:26:27 -0800 +Subject: QLibrary/Unix: do not attempt to load a library relative to $PWD + +I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to +find libraries in a haswell/ subdir of the main path, but we only need +to do that transformation if the library is contains at least one +directory seprator. That is, if the user asks to load "lib/foo", then we +should try "lib/haswell/foo" (often, the path prefix will be absolute). + +When the library name the user requested has no directory separators, we +let dlopen() do the transformation for us. Testing on Linux confirms +glibc does so: + +$ LD_DEBUG=libs /lib64/ld-linux-x86-64.so.2 --inhibit-cache ./qml -help |& grep Xcursor + 1972475: find library=libXcursor.so.1 [0]; searching + 1972475: trying file=/usr/lib64/haswell/avx512_1/libXcursor.so.1 + 1972475: trying file=/usr/lib64/haswell/libXcursor.so.1 + 1972475: trying file=/usr/lib64/libXcursor.so.1 + 1972475: calling init: /usr/lib64/libXcursor.so.1 + 1972475: calling fini: /usr/lib64/libXcursor.so.1 [0] + +Fixes: QTBUG-81272 +Change-Id: I596aec77785a4e4e84d5fffd15e89689bb91ffbb +Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> +--- + src/corelib/plugin/qlibrary_unix.cpp | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp +index f0de1010d7..135b82cd37 100644 +--- a/src/corelib/plugin/qlibrary_unix.cpp ++++ b/src/corelib/plugin/qlibrary_unix.cpp +@@ -1,7 +1,7 @@ + /**************************************************************************** + ** + ** Copyright (C) 2016 The Qt Company Ltd. +-** Copyright (C) 2018 Intel Corporation ++** Copyright (C) 2020 Intel Corporation + ** Contact: https://www.qt.io/licensing/ + ** + ** This file is part of the QtCore module of the Qt Toolkit. +@@ -218,6 +218,8 @@ bool QLibraryPrivate::load_sys() + for(int suffix = 0; retry && !pHnd && suffix < suffixes.size(); suffix++) { + if (!prefixes.at(prefix).isEmpty() && name.startsWith(prefixes.at(prefix))) + continue; ++ if (path.isEmpty() && prefixes.at(prefix).contains(QLatin1Char('/'))) ++ continue; + if (!suffixes.at(suffix).isEmpty() && name.endsWith(suffixes.at(suffix))) + continue; + if (loadHints & QLibrary::LoadArchiveMemberHint) { +-- +cgit v1.2.1 |