[SCM] qtbase packaging branch, experimental, updated. debian/5.4.1+dfsg-1-8-gbfec405

[Dmitry Shachnev]

Gitweb-URL: http://git.debian.org/?p=pkg-kde/qt/qtbase.git;a=commitdiff;h=bfec405

The following commit has been merged in the experimental branch:
commit bfec405a37d3f5c08b4015a8dcdff89d0e7b342f
Author: Dmitry Shachnev <mitya57 at gmail.com>
Date:   Mon Mar 2 19:48:25 2015 +0300

    Fix CVE-2015-0295 vulnerability in BMP parser (closes: #779580).
---
 debian/changelog                  |  1 +
 debian/patches/cve-2015-0295.diff | 29 +++++++++++++++++++++++++++++
 debian/patches/series             |  1 +
 3 files changed, 31 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index a1fb084..0776fe5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,7 @@ qtbase-opensource-src (5.4.1+dfsg-2) UNRELEASED; urgency=medium
     - Update for the above mark_private_symbols.sh change.
   * Drop obsolete override_dh_makeshlibs code, no longer needed.
     Just use dh_makeshlibs -V instead.
+  * Fix CVE-2015-0295 vulnerability in BMP parser (closes: #779580).
 
  -- Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org>  Wed, 25 Feb 2015 10:39:31 +0300
 
diff --git a/debian/patches/cve-2015-0295.diff b/debian/patches/cve-2015-0295.diff
new file mode 100644
index 0000000..af853d4
--- /dev/null
+++ b/debian/patches/cve-2015-0295.diff
@@ -0,0 +1,29 @@
+Description: fix a division by zero when processing malformed BMP files
+Origin: upstream, http://code.qt.io/cgit/qt/qtbase.git/commit?id=661f6bfd032dacc6
+Bug-Upstream: https://bugreports.qt.io/browse/QTBUG-44547
+Bug-Debian: https://bugs.debian.org/779550
+Last-Update: 2015-03-02
+
+--- a/src/gui/image/qbmphandler.cpp
++++ b/src/gui/image/qbmphandler.cpp
+@@ -314,12 +314,20 @@
+         }
+     } else if (comp == BMP_BITFIELDS && (nbits == 16 || nbits == 32)) {
+         red_shift = calc_shift(red_mask);
++        if (((red_mask >> red_shift) + 1) == 0)
++            return false;
+         red_scale = 256 / ((red_mask >> red_shift) + 1);
+         green_shift = calc_shift(green_mask);
++        if (((green_mask >> green_shift) + 1) == 0)
++            return false;
+         green_scale = 256 / ((green_mask >> green_shift) + 1);
+         blue_shift = calc_shift(blue_mask);
++        if (((blue_mask >> blue_shift) + 1) == 0)
++            return false;
+         blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
+         alpha_shift = calc_shift(alpha_mask);
++        if (((alpha_mask >> alpha_shift) + 1) == 0)
++            return false;
+         alpha_scale = 256 / ((alpha_mask >> alpha_shift) + 1);
+     } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
+         blue_mask = 0x000000ff;
diff --git a/debian/patches/series b/debian/patches/series
index 2c1bf49..a7d9be1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,6 +1,7 @@
 upstream_small-improvements-to-the-hurd-g-mkspec.patch
 upstream_Complete-MIPS-atomic-support-on-pre-MIPS32-architect.patch
 gnukfreebsd.diff
+cve-2015-0295.diff
 
 # Debian specific.
 revert_upstream_bsymbolic_change.patch

-- 
qtbase packaging