Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (5893f8e76d23fb672a6c7370660f871fabed50d6)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Treeve Jelbert <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (5893f8e76d23fb672a6c7370660f871fabed50d6)
  • Date: Tue, 2 Jan 2024 15:54:01 +0000

GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:

qt6/qt6base/DETAILS | 2
qt6/qt6base/HISTORY | 4 +
qt6/qt6base/PRE_BUILD | 3 +
qt6/qt6base/patches/0001-CVE-2023-51714-qtbase-6.6.diff | 36 +++++++++++++
qt6/qt6base/patches/0002-CVE-2023-51714-qtbase-6.6.diff | 44
++++++++++++++++
5 files changed, 88 insertions(+), 1 deletion(-)

New commits:
commit 5893f8e76d23fb672a6c7370660f871fabed50d6
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

qt6base - fix CVE-2023-51714 - SECURITY FIX

diff --git a/qt6/qt6base/DETAILS b/qt6/qt6base/DETAILS
index 2411c40..87e01ab 100755
--- a/qt6/qt6base/DETAILS
+++ b/qt6/qt6base/DETAILS
@@ -6,7 +6,7 @@ QT_URL=https://download.qt.io/official_releases
SOURCE=$SPELLX-$VERSION.tar.xz
SOURCE_URL=$QT_URL/qt/${VERSION%.?}/$VERSION/submodules/$SOURCE
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELLX-$VERSION
-# SECURITY_PATCH=2
+ SECURITY_PATCH=3
ENTERED=20210115
LICENSE[0]=LGPL
KEYWORDS="qt6 x11 libs"
diff --git a/qt6/qt6base/HISTORY b/qt6/qt6base/HISTORY
index ac7e09c..f0c0b96 100644
--- a/qt6/qt6base/HISTORY
+++ b/qt6/qt6base/HISTORY
@@ -1,3 +1,7 @@
+2024-01-02 Treeve Jelbert <treeve AT sourcemage.org>
+ * PRE_BUILD patches: added - fix CVE-2023-51714
+ * DETAILS: SECURITY_PATCH++
+
2023-11-27 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 6.6.1

diff --git a/qt6/qt6base/PRE_BUILD b/qt6/qt6base/PRE_BUILD
new file mode 100755
index 0000000..4604ffc
--- /dev/null
+++ b/qt6/qt6base/PRE_BUILD
@@ -0,0 +1,3 @@
+default_pre_build &&
+cd $SOURCE_DIRECTORY &&
+apply_patch_dir patches
diff --git a/qt6/qt6base/patches/0001-CVE-2023-51714-qtbase-6.6.diff
b/qt6/qt6base/patches/0001-CVE-2023-51714-qtbase-6.6.diff
new file mode 100644
index 0000000..31850c1
--- /dev/null
+++ b/qt6/qt6base/patches/0001-CVE-2023-51714-qtbase-6.6.diff
@@ -0,0 +1,36 @@
+From 13c16b756900fe524f6d9534e8a07aa003c05e0c Mon Sep 17 00:00:00 2001
+From: Marc Mutz <marc.mutz AT qt.io>
+Date: Tue, 12 Dec 2023 20:51:56 +0100
+Subject: [PATCH] HPack: fix a Yoda Condition
+
+Putting the variable on the LHS of a relational operation makes the
+expression easier to read. In this case, we find that the whole
+expression is nonsensical as an overflow protection, because if
+name.size() + value.size() overflows, the result will exactly _not_
+be > max() - 32, because UB will have happened.
+
+To be fixed in a follow-up commit.
+
+As a drive-by, add parentheses around the RHS.
+
+Pick-to: 6.5 6.2 5.15
+Change-Id: I35ce598884c37c51b74756b3bd2734b9aad63c09
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen AT qt.io>
+(cherry picked from commit 658607a34ead214fbacbc2cca44915655c318ea9)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot AT qt-project.org>
+(cherry picked from commit 4f7efd41740107f90960116700e3134f5e433867)
+---
+
+diff --git a/src/network/access/http2/hpacktable.cpp
b/src/network/access/http2/hpacktable.cpp
+index 74a09a2..c8c5d09 100644
+--- a/src/network/access/http2/hpacktable.cpp
++++ b/src/network/access/http2/hpacktable.cpp
+@@ -27,7 +27,7 @@
+ // 32 octets of overhead."
+
+ const unsigned sum = unsigned(name.size() + value.size());
+- if (std::numeric_limits<unsigned>::max() - 32 < sum)
++ if (sum > (std::numeric_limits<unsigned>::max() - 32))
+ return HeaderSize();
+ return HeaderSize(true, quint32(sum + 32));
+ }
diff --git a/qt6/qt6base/patches/0002-CVE-2023-51714-qtbase-6.6.diff
b/qt6/qt6base/patches/0002-CVE-2023-51714-qtbase-6.6.diff
new file mode 100644
index 0000000..3703c28
--- /dev/null
+++ b/qt6/qt6base/patches/0002-CVE-2023-51714-qtbase-6.6.diff
@@ -0,0 +1,44 @@
+From 811b9eef6d08d929af8708adbf2a5effb0eb62d7 Mon Sep 17 00:00:00 2001
+From: Marc Mutz <marc.mutz AT qt.io>
+Date: Tue, 12 Dec 2023 22:08:07 +0100
+Subject: [PATCH] HPack: fix incorrect integer overflow check
+
+This code never worked:
+
+For the comparison with max() - 32 to trigger, on 32-bit platforms (or
+Qt 5) signed interger overflow would have had to happen in the
+addition of the two sizes. The compiler can therefore remove the
+overflow check as dead code.
+
+On Qt 6 and 64-bit platforms, the signed integer addition would be
+very unlikely to overflow, but the following truncation to uint32
+would yield the correct result only in a narrow 32-value window just
+below UINT_MAX, if even that.
+
+Fix by using the proper tool, qAddOverflow.
+
+Pick-to: 6.5 6.2 5.15
+Change-Id: I7599f2e75ff7f488077b0c60b81022591005661c
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen AT qt.io>
+(cherry picked from commit ee5da1f2eaf8932aeca02ffea6e4c618585e29e3)
+Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot AT qt-project.org>
+(cherry picked from commit debeb8878da2dc706ead04b6072ecbe7e5313860)
+Reviewed-by: Thiago Macieira <thiago.macieira AT intel.com>
+Reviewed-by: Marc Mutz <marc.mutz AT qt.io>
+---
+
+diff --git a/src/network/access/http2/hpacktable.cpp
b/src/network/access/http2/hpacktable.cpp
+index c8c5d09..2c728b3 100644
+--- a/src/network/access/http2/hpacktable.cpp
++++ b/src/network/access/http2/hpacktable.cpp
+@@ -26,7 +26,9 @@
+ // for counting the number of references to the name and value would
have
+ // 32 octets of overhead."
+
+- const unsigned sum = unsigned(name.size() + value.size());
++ size_t sum;
++ if (qAddOverflow(size_t(name.size()), size_t(value.size()), &sum))
++ return HeaderSize();
+ if (sum > (std::numeric_limits<unsigned>::max() - 32))
+ return HeaderSize();
+ return HeaderSize(true, quint32(sum + 32));



  • [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (5893f8e76d23fb672a6c7370660f871fabed50d6), Treeve Jelbert, 01/02/2024

Archive powered by MHonArc 2.6.24.

Top of Page