sm-commit AT lists.ibiblio.org
Subject: Source Mage code commit list
List archive
[[SM-Commit] ] GIT changes to master grimoire by Treeve Jelbert (dc67da498cb9d48b7349f1b82a2d1032bea1aaea)
- From: Treeve Jelbert <scm AT sourcemage.org>
- To: sm-commit AT lists.ibiblio.org, sm-commit AT lists.sourcemage.org
- Subject: [[SM-Commit] ] GIT changes to master grimoire by Treeve Jelbert (dc67da498cb9d48b7349f1b82a2d1032bea1aaea)
- Date: Wed, 17 Jul 2024 17:04:29 +0000
GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:
qt6/qt6base/DETAILS | 2
qt6/qt6base/HISTORY | 4
qt6/qt6base/patches/CVE-2024-39936-qtbase-6.7.patch | 138
++++++++++++++++++++
windowmanagers/labwc/DETAILS | 4
windowmanagers/labwc/HISTORY | 3
wm-addons/wlroots/DETAILS | 2
wm-addons/wlroots/HISTORY | 3
7 files changed, 152 insertions(+), 4 deletions(-)
New commits:
commit dc67da498cb9d48b7349f1b82a2d1032bea1aaea
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>
qt6base - SECURITY FIX
commit 087244afe4638a6b926b39e751f2b460a075a042
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>
wlroots: => 0.18.0
commit 0ae00347c68034f6df84df22bc9046dcce6075ff
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>
labwc: => 0.7.3
diff --git a/qt6/qt6base/DETAILS b/qt6/qt6base/DETAILS
index bcc1bcb..7543561 100755
--- a/qt6/qt6base/DETAILS
+++ b/qt6/qt6base/DETAILS
@@ -2,7 +2,7 @@
source $GRIMOIRE/$SECTION/QT6_VERSIONS
- SECURITY_PATCH=4
+ SECURITY_PATCH=5
ENTERED=20210115
SHORT="Qt6 simplifies writing and maintaining GUI release-service"
cat << EOF
diff --git a/qt6/qt6base/HISTORY b/qt6/qt6base/HISTORY
index 387f3c9..26c9d7f 100644
--- a/qt6/qt6base/HISTORY
+++ b/qt6/qt6base/HISTORY
@@ -1,3 +1,7 @@
+2024-07-17 Treeve Jelbert <treeve AT sourcemage.org>
+ * CVE-2024-39936-qtbase-6.7.patch: added
+ * DETAILS: SECURITY_PATCH++
+
2024-06-23 Ismael Luceno <ismael AT sourcemage.org>
* BUILD, PRE_BUILD, patches/0001-Fix-build-against-LibreSSL.patch:
fixed build against libressl
diff --git a/qt6/qt6base/patches/CVE-2024-39936-qtbase-6.7.patch
b/qt6/qt6base/patches/CVE-2024-39936-qtbase-6.7.patch
new file mode 100644
index 0000000..bef53fb
--- /dev/null
+++ b/qt6/qt6base/patches/CVE-2024-39936-qtbase-6.7.patch
@@ -0,0 +1,138 @@
+diff --git a/src/network/access/qhttp2protocolhandler.cpp
b/src/network/access/qhttp2protocolhandler.cpp
+index 0abd99b9bc2..3631b13dc85 100644
+--- a/src/network/access/qhttp2protocolhandler.cpp
++++ b/src/network/access/qhttp2protocolhandler.cpp
+@@ -303,12 +303,12 @@ bool QHttp2ProtocolHandler::sendRequest()
+ }
+ }
+
+- if (!prefaceSent && !sendClientPreface())
+- return false;
+-
+ if (!requests.size())
+ return true;
+
++ if (!prefaceSent && !sendClientPreface())
++ return false;
++
+ m_channel->state = QHttpNetworkConnectionChannel::WritingState;
+ // Check what was promised/pushed, maybe we do not have to send a
request
+ // and have a response already?
+diff --git a/src/network/access/qhttpnetworkconnectionchannel.cpp
b/src/network/access/qhttpnetworkconnectionchannel.cpp
+index 6766989690c..1e4161d1fdf 100644
+--- a/src/network/access/qhttpnetworkconnectionchannel.cpp
++++ b/src/network/access/qhttpnetworkconnectionchannel.cpp
+@@ -209,6 +209,10 @@ void QHttpNetworkConnectionChannel::abort()
+ bool QHttpNetworkConnectionChannel::sendRequest()
+ {
+ Q_ASSERT(protocolHandler);
++ if (waitingForPotentialAbort) {
++ needInvokeSendRequest = true;
++ return false; // this return value is unused
++ }
+ return protocolHandler->sendRequest();
+ }
+
+@@ -221,21 +225,28 @@ bool QHttpNetworkConnectionChannel::sendRequest()
+ void QHttpNetworkConnectionChannel::sendRequestDelayed()
+ {
+ QMetaObject::invokeMethod(this, [this] {
+- Q_ASSERT(protocolHandler);
+ if (reply)
+- protocolHandler->sendRequest();
++ sendRequest();
+ }, Qt::ConnectionType::QueuedConnection);
+ }
+
+ void QHttpNetworkConnectionChannel::_q_receiveReply()
+ {
+ Q_ASSERT(protocolHandler);
++ if (waitingForPotentialAbort) {
++ needInvokeReceiveReply = true;
++ return;
++ }
+ protocolHandler->_q_receiveReply();
+ }
+
+ void QHttpNetworkConnectionChannel::_q_readyRead()
+ {
+ Q_ASSERT(protocolHandler);
++ if (waitingForPotentialAbort) {
++ needInvokeReadyRead = true;
++ return;
++ }
+ protocolHandler->_q_readyRead();
+ }
+
+@@ -1239,7 +1250,18 @@ void QHttpNetworkConnectionChannel::_q_encrypted()
+ if (!h2RequestsToSend.isEmpty()) {
+ // Similar to HTTP/1.1 counterpart below:
+ const auto &pair = std::as_const(h2RequestsToSend).first();
++ waitingForPotentialAbort = true;
+ emit pair.second->encrypted();
++
++ // We don't send or handle any received data until any effects
from
++ // emitting encrypted() have been processed. This is necessary
++ // because the user may have called abort(). We may also abort
the
++ // whole connection if the request has been aborted and there is
++ // no more requests to send.
++ QMetaObject::invokeMethod(this,
++
&QHttpNetworkConnectionChannel::checkAndResumeCommunication,
++ Qt::QueuedConnection);
++
+ // In case our peer has sent us its settings (window size, max
concurrent streams etc.)
+ // let's give _q_receiveReply a chance to read them first
('invokeMethod', QueuedConnection).
+ }
+@@ -1257,6 +1279,28 @@ void QHttpNetworkConnectionChannel::_q_encrypted()
+ QMetaObject::invokeMethod(connection, "_q_startNextRequest",
Qt::QueuedConnection);
+ }
+
++
++void QHttpNetworkConnectionChannel::checkAndResumeCommunication()
++{
++ Q_ASSERT(connection->connectionType() ==
QHttpNetworkConnection::ConnectionTypeHTTP2
++ || connection->connectionType() ==
QHttpNetworkConnection::ConnectionTypeHTTP2Direct);
++
++ // Because HTTP/2 requires that we send a SETTINGS frame as the first
thing we do, and respond
++ // to a SETTINGS frame with an ACK, we need to delay any handling until
we can ensure that any
++ // effects from emitting encrypted() have been processed.
++ // This function is called after encrypted() was emitted, so check for
changes.
++
++ if (!reply && h2RequestsToSend.isEmpty())
++ abort();
++ waitingForPotentialAbort = false;
++ if (needInvokeReadyRead)
++ _q_readyRead();
++ if (needInvokeReceiveReply)
++ _q_receiveReply();
++ if (needInvokeSendRequest)
++ sendRequest();
++}
++
+ void QHttpNetworkConnectionChannel::requeueHttp2Requests()
+ {
+ const auto h2RequestsToSendCopy = std::exchange(h2RequestsToSend, {});
+diff --git a/src/network/access/qhttpnetworkconnectionchannel_p.h
b/src/network/access/qhttpnetworkconnectionchannel_p.h
+index c42290feca4..061f20fd426 100644
+--- a/src/network/access/qhttpnetworkconnectionchannel_p.h
++++ b/src/network/access/qhttpnetworkconnectionchannel_p.h
+@@ -74,6 +74,10 @@ public:
+ QAbstractSocket *socket;
+ bool ssl;
+ bool isInitialized;
++ bool waitingForPotentialAbort = false;
++ bool needInvokeReceiveReply = false;
++ bool needInvokeReadyRead = false;
++ bool needInvokeSendRequest = false;
+ ChannelState state;
+ QHttpNetworkRequest request; // current request, only used for HTTP
+ QHttpNetworkReply *reply; // current reply for this request, only used
for HTTP
+@@ -146,6 +150,8 @@ public:
+ void closeAndResendCurrentRequest();
+ void resendCurrentRequest();
+
++ void checkAndResumeCommunication();
++
+ bool isSocketBusy() const;
+ bool isSocketWriting() const;
+ bool isSocketWaiting() const;
diff --git a/windowmanagers/labwc/DETAILS b/windowmanagers/labwc/DETAILS
index a964108..37ab260 100755
--- a/windowmanagers/labwc/DETAILS
+++ b/windowmanagers/labwc/DETAILS
@@ -1,10 +1,10 @@
. "${GRIMOIRE}/MESON_FUNCTIONS"
SPELL=labwc
- VERSION=0.7.2
+ VERSION=0.7.3
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=https://github.com/labwc/labwc/archive/${VERSION}.tar.gz
-
SOURCE_HASH=sha256:b00119451a91a75cc063cfa753f956623acdde4b93bbf78b2b6d5fe7f94c597e
+
SOURCE_HASH=sha256:72352250b2a9758a24d5766030a7c3f62c658df7b94552f3701ea86e557d0f2a
LICENSE[0]=GPL
WEB_SITE=https://github.com/labwc/labwc/
ENTERED=20230227
diff --git a/windowmanagers/labwc/HISTORY b/windowmanagers/labwc/HISTORY
index af81133..6d6c464 100644
--- a/windowmanagers/labwc/HISTORY
+++ b/windowmanagers/labwc/HISTORY
@@ -1,3 +1,6 @@
+2024-07-17 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 0.7.3
+
2024-05-12 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 0.7.2
diff --git a/wm-addons/wlroots/DETAILS b/wm-addons/wlroots/DETAILS
index 83557bc..0b069cb 100755
--- a/wm-addons/wlroots/DETAILS
+++ b/wm-addons/wlroots/DETAILS
@@ -18,7 +18,7 @@ case "${WLROOTS_BRANCH}" in
SOURCE_URL[0]="https://gitlab.freedesktop.org/${SPELL}/${SPELL}/-/archive/${WLROOTS_COMMIT}/${SOURCE}.tar.gz"
;;
(*)
- VERSION=0.17.3
+ VERSION=0.18.0
SOURCE="$SPELL-$VERSION.tar.gz"
SOURCE_URL[0]="https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/$VERSION/downloads/$SOURCE"
SOURCE2=$SOURCE.sig
diff --git a/wm-addons/wlroots/HISTORY b/wm-addons/wlroots/HISTORY
index 2f6251f..95b55a8 100644
--- a/wm-addons/wlroots/HISTORY
+++ b/wm-addons/wlroots/HISTORY
@@ -1,3 +1,6 @@
+2024-07-17 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 0.18.0
+
2024-04-27 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 0.17.3
- [[SM-Commit] ] GIT changes to master grimoire by Treeve Jelbert (dc67da498cb9d48b7349f1b82a2d1032bea1aaea), Treeve Jelbert, 07/17/2024
Archive powered by MHonArc 2.6.24.