Source Mage code commit list

[Ladislav Hagara <scm AT sourcemage.org>]

GIT changes to master grimoire by Ladislav Hagara <hgr AT vabo.cz>:

 x11-toolkits/qt4/CVE-2014-0190.patch |   32 ++++++++++++++++++++++++++++++++
 x11-toolkits/qt4/DETAILS             |    8 ++++----
 x11-toolkits/qt4/HISTORY             |    5 +++++
 x11-toolkits/qt4/PRE_BUILD           |    4 +---
 x11-toolkits/qt4/boost.patch         |   16 ----------------
 5 files changed, 42 insertions(+), 23 deletions(-)

New commits:
commit 38a90e1e65c5231a65e4cad6fc234bbfc1bf9b00
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Ladislav Hagara <hgr AT vabo.cz>

    qt4 4.8.6, SECURITY_PATCH=6

diff --git a/x11-toolkits/qt4/CVE-2014-0190.patch 
b/x11-toolkits/qt4/CVE-2014-0190.patch
new file mode 100644
index 0000000..e97ee7b
--- /dev/null
+++ b/x11-toolkits/qt4/CVE-2014-0190.patch
@@ -0,0 +1,32 @@
+Don't crash on broken GIF images
+
+Broken GIF images could set invalid width and height
+values inside the image, leading to Qt creating a null
+QImage for it. In that case we need to abort decoding
+the image and return an error.
+
+Initial patch by Rich Moore.
+
+Backport of Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e from Qt 5
+
+Task-number: QTBUG-38367
+Change-Id: I0680740018aaa8356d267b7af3f01fac3697312a
+Security-advisory: CVE-2014-0190
+
+diff -up 
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp.QTBUG-38367 
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp
+--- 
qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp.QTBUG-38367  
     2014-04-10 13:37:12.000000000 -0500
++++ qt-everywhere-opensource-src-4.8.6/src/gui/image/qgifhandler.cpp   
2014-04-24 15:58:54.515862458 -0500
+@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, co
+                     memset(bits, 0, image->byteCount());
+                 }
+ 
++                // Check if the previous attempt to create the image 
failed. If it
++                // did then the image is broken and we should give up.
++                if (image->isNull()) {
++                    state = Error;
++                    return -1;
++                }
++
+                 disposePrevious(image);
+                 disposed = false;
+ 
diff --git a/x11-toolkits/qt4/DETAILS b/x11-toolkits/qt4/DETAILS
index 50cbcad..c18ebf7 100755
--- a/x11-toolkits/qt4/DETAILS
+++ b/x11-toolkits/qt4/DETAILS
@@ -2,11 +2,11 @@ persistent_remove QT_VER
            SPELL=qt4
            TMPFS=off
          SPELLX=qt-everywhere-opensource-src
-         VERSION=4.8.5
-      PATCHLEVEL=1
-     
SOURCE_HASH=sha512:47118d1aa30c59a1eb74e805023cd060edcb35bb0944fe6651889254b75acbd4b83700ba92a9bc215663474d26330cb44f084098c380fac9270742659e5864eb
+         VERSION=4.8.6
+      PATCHLEVEL=0
+     
SOURCE_HASH=sha512:c2d07c3cf9d687cb9b93e337c89df3f0055bd02bc8aa5ecd55d3ffb238b31a4308aeabc3c51a4f94ac76a1b00796f047513d02e427ed93ae8dd99f836fff7692
           SOURCE=$SPELLX-$VERSION.tar.gz
-  SECURITY_PATCH=5
+  SECURITY_PATCH=6
 SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELLX-$VERSION
    
SOURCE_URL[0]=http://download.qt-project.org/official_releases/qt/4.8/$VERSION/$SOURCE
         WEB_SITE=http://qt-project.org/
diff --git a/x11-toolkits/qt4/HISTORY b/x11-toolkits/qt4/HISTORY
index 7bf8270..ab25849 100644
--- a/x11-toolkits/qt4/HISTORY
+++ b/x11-toolkits/qt4/HISTORY
@@ -1,3 +1,8 @@
+2014-08-01 Ladislav Hagara <hgr AT vabo.cz>
+       * DETAILS: 4.8.6, SECURITY_PATCH=6
+       * PRE_BUILD, boost.patch: patch removed
+       * PRE_BUILD, CVE-2014-0190.patch: security patch from Arch added
+
 2013-07-12 Eric Sandall <sandalle AT sourcemage.org>
        * DETAILS: PATCHLEVEL++
        * PRE_BUILD: Apply boost.patch
diff --git a/x11-toolkits/qt4/PRE_BUILD b/x11-toolkits/qt4/PRE_BUILD
index 5b4e4a7..dd7ef9f 100755
--- a/x11-toolkits/qt4/PRE_BUILD
+++ b/x11-toolkits/qt4/PRE_BUILD
@@ -1,9 +1,7 @@
 default_pre_build          &&
 cd $SOURCE_DIRECTORY      &&
 
-message "${MESSAGE_COLOR}Fix moc using boost headers...${DEFAULT_COLOR}" &&
-patch "${SOURCE_DIRECTORY}"/src/tools/moc/main.cpp  \
-      "${SPELL_DIRECTORY}"/boost.patch  &&
+patch -p1 < $SPELL_DIRECTORY/CVE-2014-0190.patch &&
 
 sed -i '/-Werror/d' src/3rdparty/webkit/Source/WebKit.pri &&
 
diff --git a/x11-toolkits/qt4/boost.patch b/x11-toolkits/qt4/boost.patch
deleted file mode 100644
index bf30552..0000000
--- a/x11-toolkits/qt4/boost.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-# Modified from 
https://build.opensuse.org/package/view_file/openSUSE:Factory/libqt4?file=fix-moc-from-choking-on-boost-headers.patch&rev=94537fcad086b40817f06d56bf3d3a2c
-# using information from https://bugreports.qt-project.org/browse/QTBUG-22829
---- qt-everywhere-opensource-src-4.8.5/src/tools/moc/main.cpp.orig     
2013-07-12 15:18:04.079264426 -0700
-+++ qt-everywhere-opensource-src-4.8.5/src/tools/moc/main.cpp  2013-07-12 
15:24:35.581197919 -0700
-@@ -188,8 +188,10 @@
-     pp.macros["Q_MOC_RUN"];
-     pp.macros["__cplusplus"];
- 
--    // Workaround a bug while parsing the 
boost/type_traits/has_operator.hpp header. See QTBUG-22829
-+    // Workaround a bug while parsing the 
boost/type_traits/has_operator.hpp header. See QTBUG-22829 
(https://bugreports.qt-project.org/browse/QTBUG-22829)
-     pp.macros["BOOST_TT_HAS_OPERATOR_HPP_INCLUDED"];
-+    pp.macros["BOOST_LEXICAL_CAST_INCLUDED"];
-+    pp.macros["BOOST_NO_TEMPLATE_PARTIAL_SPECIALIZATION"];
- 
-     QByteArray filename;
-     QByteArray output;