Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (38a90e1e65c5231a65e4cad6fc234bbfc1bf9b00)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ladislav Hagara <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (38a90e1e65c5231a65e4cad6fc234bbfc1bf9b00)
  • Date: Fri, 1 Aug 2014 03:29:40 -0500

GIT changes to master grimoire by Ladislav Hagara <hgr AT vabo.cz>:

x11-toolkits/qt4/CVE-2014-0190.patch | 32 ++++++++++++++++++++++++++++++++
x11-toolkits/qt4/DETAILS | 8 ++++----
x11-toolkits/qt4/HISTORY | 5 +++++
x11-toolkits/qt4/PRE_BUILD | 4 +---
x11-toolkits/qt4/boost.patch | 16 ----------------
5 files changed, 42 insertions(+), 23 deletions(-)

New commits:
commit 38a90e1e65c5231a65e4cad6fc234bbfc1bf9b00
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Ladislav Hagara <hgr AT vabo.cz>

qt4 4.8.6, SECURITY_PATCH=6

diff --git a/x11-toolkits/qt4/CVE-2014-0190.patch
b/x11-toolkits/qt4/CVE-2014-0190.patch
new file mode 100644
index 0000000..e97ee7b
--- /dev/null
+++ b/x11-toolkits/qt4/CVE-2014-0190.patch
@@ -0,0 +1,32 @@
+Don't crash on broken GIF images
+
+Broken GIF images could set invalid width and height
+values inside the image, leading to Qt creating a null
+QImage for it. In that case we need to abort decoding
+the image and return an error.
+
+Initial patch by Rich Moore.
+
+Backport of Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e from Qt 5
+
+Task-number: QTBUG-38367
+Change-Id: I0680740018aaa8356d267b7af3f01fac3697312a
+Security-advisory: CVE-2014-0190
+
+diff -up
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp.QTBUG-38367
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp
+---
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp.QTBUG-38367
2014-04-10 13:37:12.000000000 -0500
++++ qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp
2014-04-24 15:58:54.515862458 -0500
+@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, co
+ memset(bits, 0, image->byteCount());
+ }
+
++ // Check if the previous attempt to create the image
failed. If it
++ // did then the image is broken and we should give up.
++ if (image->isNull()) {
++ state = Error;
++ return -1;
++ }
++
+ disposePrevious(image);
+ disposed = false;
+
diff --git a/x11-toolkits/qt4/DETAILS b/x11-toolkits/qt4/DETAILS
index 50cbcad..c18ebf7 100755
--- a/x11-toolkits/qt4/DETAILS
+++ b/x11-toolkits/qt4/DETAILS
@@ -2,11 +2,11 @@ persistent_remove QT_VER
SPELL=qt4
TMPFS=off
SPELLX=qt-everywhere-opensource-src
- VERSION=4.8.5
- PATCHLEVEL=1
-
SOURCE_HASH=sha512:47118d1aa30c59a1eb74e805023cd060edcb35bb0944fe6651889254b75acbd4b83700ba92a9bc215663474d26330cb44f084098c380fac9270742659e5864eb
+ VERSION=4.8.6
+ PATCHLEVEL=0
+
SOURCE_HASH=sha512:c2d07c3cf9d687cb9b93e337c89df3f0055bd02bc8aa5ecd55d3ffb238b31a4308aeabc3c51a4f94ac76a1b00796f047513d02e427ed93ae8dd99f836fff7692
SOURCE=$SPELLX-$VERSION.tar.gz
- SECURITY_PATCH=5
+ SECURITY_PATCH=6
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELLX-$VERSION

SOURCE_URL[0]=http://download.qt-project.org/official_releases/qt/4.8/$VERSION/$SOURCE
WEB_SITE=http://qt-project.org/
diff --git a/x11-toolkits/qt4/HISTORY b/x11-toolkits/qt4/HISTORY
index 7bf8270..ab25849 100644
--- a/x11-toolkits/qt4/HISTORY
+++ b/x11-toolkits/qt4/HISTORY
@@ -1,3 +1,8 @@
+2014-08-01 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 4.8.6, SECURITY_PATCH=6
+ * PRE_BUILD, boost.patch: patch removed
+ * PRE_BUILD, CVE-2014-0190.patch: security patch from Arch added
+
2013-07-12 Eric Sandall <sandalle AT sourcemage.org>
* DETAILS: PATCHLEVEL++
* PRE_BUILD: Apply boost.patch
diff --git a/x11-toolkits/qt4/PRE_BUILD b/x11-toolkits/qt4/PRE_BUILD
index 5b4e4a7..dd7ef9f 100755
--- a/x11-toolkits/qt4/PRE_BUILD
+++ b/x11-toolkits/qt4/PRE_BUILD
@@ -1,9 +1,7 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&

-message "${MESSAGE_COLOR}Fix moc using boost headers...${DEFAULT_COLOR}" &&
-patch "${SOURCE_DIRECTORY}"/src/tools/moc/main.cpp \
- "${SPELL_DIRECTORY}"/boost.patch &&
+patch -p1 < $SPELL_DIRECTORY/CVE-2014-0190.patch &&

sed -i '/-Werror/d' src/3rdparty/webkit/Source/WebKit.pri &&

diff --git a/x11-toolkits/qt4/boost.patch b/x11-toolkits/qt4/boost.patch
deleted file mode 100644
index bf30552..0000000
--- a/x11-toolkits/qt4/boost.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-# Modified from
https://build.opensuse.org/package/view_file/openSUSE:Factory/libqt4?file=fix-moc-from-choking-on-boost-headers.patch&rev=94537fcad086b40817f06d56bf3d3a2c
-# using information from https://bugreports.qt-project.org/browse/QTBUG-22829
---- qt-everywhere-opensource-src-4.8.5/src/tools/moc/main.cpp.orig
2013-07-12 15:18:04.079264426 -0700
-+++ qt-everywhere-opensource-src-4.8.5/src/tools/moc/main.cpp 2013-07-12
15:24:35.581197919 -0700
-@@ -188,8 +188,10 @@
- pp.macros["Q_MOC_RUN"];
- pp.macros["__cplusplus"];
-
-- // Workaround a bug while parsing the
boost/type_traits/has_operator.hpp header. See QTBUG-22829
-+ // Workaround a bug while parsing the
boost/type_traits/has_operator.hpp header. See QTBUG-22829
(https://bugreports.qt-project.org/browse/QTBUG-22829)
- pp.macros["BOOST_TT_HAS_OPERATOR_HPP_INCLUDED"];
-+ pp.macros["BOOST_LEXICAL_CAST_INCLUDED"];
-+ pp.macros["BOOST_NO_TEMPLATE_PARTIAL_SPECIALIZATION"];
-
- QByteArray filename;
- QByteArray output;



  • [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (38a90e1e65c5231a65e4cad6fc234bbfc1bf9b00), Ladislav Hagara, 08/01/2014

Archive powered by MHonArc 2.6.24.

Top of Page