[SCM] Qt 4 packaging branch, master, updated. debian/4.8.6+git155-g716fbae+dfsg-1-3-g2c83578
Lisandro Damián Nicanor Pérez
lisandro at moszumanska.debian.org
Thu Apr 30 23:49:58 UTC 2015
Gitweb-URL: http://git.debian.org/?p=pkg-kde/qt/qt4-x11.git;a=commitdiff;h=2c83578
The following commit has been merged in the master branch:
commit 2c835789e955159e9e89211e2d427c1c4d9ccdee
Author: Lisandro Damián Nicanor Pérez Meyer <perezmeyer at gmail.com>
Date: Thu Apr 30 20:49:33 2015 -0300
Add patch to fix CVE-2015-1858.
---
debian/changelog | 2 +
.../fixes_crash_in_bmp_and_ico_image_decoder.patch | 63 ++++++++++++++++++++++
2 files changed, 65 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 61cb617..a5ae4aa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,8 @@ qt4-x11 (4:4.8.6+git155-g716fbae+dfsg-2) UNRELEASED; urgency=medium
[ Lisandro Damián Nicanor Pérez Meyer ]
* Add fixes_crash_in_gif_image_decoder.patch to fix CVE-2015-1860 (gif image
decoder vulnerability).
+ * Add fixes_crash_in_bmp_and_ico_image_decoder.patch to fix CVE-2015-1858
+ and CVE-2015-1859 (bmp and ico image decoders vulnerabilities).
-- Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org> Thu, 30 Apr 2015 20:42:00 -0300
diff --git a/debian/patches/fixes_crash_in_bmp_and_ico_image_decoder.patch b/debian/patches/fixes_crash_in_bmp_and_ico_image_decoder.patch
new file mode 100644
index 0000000..cd7dc59
--- /dev/null
+++ b/debian/patches/fixes_crash_in_bmp_and_ico_image_decoder.patch
@@ -0,0 +1,63 @@
+From 3e55cd6dc467303a3c35312e9fcb255c2c048b32 Mon Sep 17 00:00:00 2001
+From: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed, 11 Mar 2015 13:34:01 +0100
+Subject: [PATCH] Fixes crash in bmp and ico image decoding
+
+Fuzzing test revealed that for certain malformed bmp and ico files,
+the handler would segfault.
+
+Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+(cherry picked from qtbase/2adbbae5432aa9d8cc41c6fcf55c2e310d2d4078)
+Reviewed-by: Richard J. Moore <rich at kde.org>
+---
+ src/gui/image/qbmphandler.cpp | 13 +++++++------
+ src/plugins/imageformats/ico/qicohandler.cpp | 2 +-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
+index 30fa9e0..17a880b 100644
+--- a/src/gui/image/qbmphandler.cpp
++++ b/src/gui/image/qbmphandler.cpp
+@@ -478,12 +478,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -491,6 +485,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
+index 1a88605..3c34765 100644
+--- a/src/plugins/imageformats/ico/qicohandler.cpp
++++ b/src/plugins/imageformats/ico/qicohandler.cpp
+@@ -571,7 +571,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
+--
+2.1.4
+
--
Qt 4 packaging
More information about the pkg-kde-commits
mailing list