rev 5809 - in trunk/packages/qt4-x11/debian: . patches
Brian Nelson
pyro at alioth.debian.org
Fri Mar 30 16:06:34 CET 2007
Author: pyro
Date: 2007-03-30 15:06:33 +0000 (Fri, 30 Mar 2007)
New Revision: 5809
Added:
trunk/packages/qt4-x11/debian/patches/04_utf8_bug_fix.dpatch
Modified:
trunk/packages/qt4-x11/debian/changelog
trunk/packages/qt4-x11/debian/patches/00list
Log:
* debian/patches/04_utf8_bug_fix.dpatch: new patch to fix the "UTF-8
overlong sequence decoding vulnerability" [CVE-2007-0242]
Modified: trunk/packages/qt4-x11/debian/changelog
===================================================================
--- trunk/packages/qt4-x11/debian/changelog 2007-03-30 14:26:20 UTC (rev 5808)
+++ trunk/packages/qt4-x11/debian/changelog 2007-03-30 15:06:33 UTC (rev 5809)
@@ -1,3 +1,10 @@
+qt4-x11 (4.2.2-2) unstable; urgency=high
+
+ * debian/patches/04_utf8_bug_fix.dpatch: new patch to fix the "UTF-8
+ overlong sequence decoding vulnerability" [CVE-2007-0242]
+
+ -- Brian Nelson <pyro at debian.org> Fri, 30 Mar 2007 11:04:20 -0400
+
qt4-x11 (4.2.2-1) unstable; urgency=low
* New upstream release (Closes: #410862)
Modified: trunk/packages/qt4-x11/debian/patches/00list
===================================================================
--- trunk/packages/qt4-x11/debian/patches/00list 2007-03-30 14:26:20 UTC (rev 5808)
+++ trunk/packages/qt4-x11/debian/patches/00list 2007-03-30 15:06:33 UTC (rev 5809)
@@ -1,6 +1,7 @@
01_qmake_for_debian
02_launch_assistant-qt4
03_launch_moc-qt4
+04_utf8_bug_fix
20_mips_atomic_ops
30_arm_ftbfs_fixes
31_arm_eabi_fix
Added: trunk/packages/qt4-x11/debian/patches/04_utf8_bug_fix.dpatch
===================================================================
--- trunk/packages/qt4-x11/debian/patches/04_utf8_bug_fix.dpatch 2007-03-30 14:26:20 UTC (rev 5808)
+++ trunk/packages/qt4-x11/debian/patches/04_utf8_bug_fix.dpatch 2007-03-30 15:06:33 UTC (rev 5809)
@@ -0,0 +1,141 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 04_utf8_bug_fix.dpatch by Brian Nelson <pyro at debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+ at DPATCH@
+diff -urNad qt4-x11-4.2.2~/src/corelib/codecs/qutfcodec.cpp qt4-x11-4.2.2/src/corelib/codecs/qutfcodec.cpp
+--- qt4-x11-4.2.2~/src/corelib/codecs/qutfcodec.cpp 2006-11-27 12:26:05.000000000 -0500
++++ qt4-x11-4.2.2/src/corelib/codecs/qutfcodec.cpp 2007-03-30 10:38:53.000000000 -0400
+@@ -127,15 +127,19 @@
+ bool headerdone = false;
+ QChar replacement = QChar::ReplacementCharacter;
+ int need = 0;
++ int error = -1;
+ uint uc = 0;
++ uint min_uc = 0;
+ if (state) {
+ if (state->flags & IgnoreHeader)
+ headerdone = true;
+ if (state->flags & ConvertInvalidToNull)
+ replacement = QChar::Null;
+ need = state->remainingChars;
+- if (need)
++ if (need) {
+ uc = state->state_data[0];
++ min_uc = state->state_data[1];
++ }
+ }
+ if (!headerdone && len > 3
+ && (uchar)chars[0] == 0xef && (uchar)chars[1] == 0xbb && (uchar)chars[2] == 0xbf) {
+@@ -152,7 +156,7 @@
+ int invalid = 0;
+
+ for (int i=0; i<len; i++) {
+- ch = *chars++;
++ ch = chars[i];
+ if (need) {
+ if ((ch&0xc0) == 0x80) {
+ uc = (uc << 6) | (ch & 0x3f);
+@@ -163,14 +167,27 @@
+ uc -= 0x10000;
+ unsigned short high = uc/0x400 + 0xd800;
+ unsigned short low = uc%0x400 + 0xdc00;
++
++ // resize if necessary
++ long where = qch - result.unicode();
++ if (where + 2 >= result.size()) {
++ result.resize(where + 2);
++ qch = result.data() + where;
++ }
++
+ *qch++ = QChar(high);
+ *qch++ = QChar(low);
++ } else if ((uc < min_uc) || (uc >= 0xd800 && uc <= 0xdfff) || (uc >= 0xfffe)) {
++ // error
++ *qch++ = QChar::ReplacementCharacter;
++ ++invalid;
+ } else {
+ *qch++ = uc;
+ }
+ }
+ } else {
+ // error
++ i = error;
+ *qch++ = QChar::ReplacementCharacter;
+ ++invalid;
+ need = 0;
+@@ -181,12 +198,22 @@
+ } else if ((ch & 0xe0) == 0xc0) {
+ uc = ch & 0x1f;
+ need = 1;
++ error = i;
++ min_uc = 0x80;
+ } else if ((ch & 0xf0) == 0xe0) {
+ uc = ch & 0x0f;
+ need = 2;
++ error = i;
++ min_uc = 0x800;
+ } else if ((ch&0xf8) == 0xf0) {
+ uc = ch & 0x07;
+ need = 3;
++ error = i;
++ min_uc = 0x10000;
++ } else {
++ // error
++ *qch++ = QChar::ReplacementCharacter;
++ ++invalid;
+ }
+ }
+ }
+@@ -197,6 +224,7 @@
+ if (headerdone)
+ state->flags |= IgnoreHeader;
+ state->state_data[0] = need ? uc : 0;
++ state->state_data[1] = need ? min_uc : 0;
+ }
+ return result;
+ }
+diff -urNad qt4-x11-4.2.2~/src/corelib/tools/qstring.cpp qt4-x11-4.2.2/src/corelib/tools/qstring.cpp
+--- qt4-x11-4.2.2~/src/corelib/tools/qstring.cpp 2006-11-27 12:26:07.000000000 -0500
++++ qt4-x11-4.2.2/src/corelib/tools/qstring.cpp 2007-03-30 10:38:53.000000000 -0400
+@@ -3352,6 +3352,7 @@
+ result.resize(size); // worst case
+ ushort *qch = result.d->data;
+ uint uc = 0;
++ uint min_uc = 0;
+ int need = 0;
+ int error = -1;
+ uchar ch;
+@@ -3369,6 +3370,12 @@
+ ushort low = uc%0x400 + 0xdc00;
+ *qch++ = high;
+ *qch++ = low;
++ } else if ((uc < min_uc) || (uc >= 0xd800 && uc <= 0xdfff) || (uc >= 0xfffe)) {
++ // overlong seqence, UTF16 surrogate or BOM
++ i = error;
++ qch = addOne(qch, result);
++ *qch++ = 0xdbff;
++ *qch++ = 0xde00 + ((uchar)str[i]);
+ } else {
+ *qch++ = uc;
+ }
+@@ -3391,14 +3398,17 @@
+ uc = ch & 0x1f;
+ need = 1;
+ error = i;
++ min_uc = 0x80;
+ } else if ((ch & 0xf0) == 0xe0) {
+ uc = ch & 0x0f;
+ need = 2;
+ error = i;
++ min_uc = 0x800;
+ } else if ((ch&0xf8) == 0xf0) {
+ uc = ch & 0x07;
+ need = 3;
+ error = i;
++ min_uc = 0x10000;
+ } else {
+ // Error
+ qch = addOne(qch, result);
Property changes on: trunk/packages/qt4-x11/debian/patches/04_utf8_bug_fix.dpatch
___________________________________________________________________
Name: svn:executable
+ *
More information about the pkg-kde-commits
mailing list