[SCM] qtbase packaging branch, experimental, updated. debian/5.4.1+dfsg-2-18-gbc9342a
Lisandro Damián Nicanor Pérez
lisandro at moszumanska.debian.org
Wed May 13 15:33:25 UTC 2015
Gitweb-URL: http://git.debian.org/?p=pkg-kde/qt/qtbase.git;a=commitdiff;h=bc9342a
The following commit has been merged in the experimental branch:
commit bc9342aa475d92ebbf88dac038ebc7e2ea642331
Author: Lisandro Damián Nicanor Pérez Meyer <perezmeyer at gmail.com>
Date: Wed May 13 12:33:05 2015 -0300
Fix CVE-2015-1858, CVE-2015-1859 and CVE 2015-1860
---
debian/changelog | 4 ++
...fixes_crash_in_bmp_and_ico_image_decoders.patch | 62 ++++++++++++++++++++++
.../patches/fixes_crash_in_gif_image_decoder.patch | 30 +++++++++++
debian/patches/series | 2 +
4 files changed, 98 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 43bcce1..eb8a4d3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -25,6 +25,10 @@ qtbase-opensource-src (5.4.1+dfsg-3) UNRELEASED; urgency=medium
patches (Closes: #783127):
- make_qglobal_h_complain_if_you_use_fpie.patch
- require_fpic_instead_of_fpie.patch
+ * Fix CVE-2015-1858, CVE-2015-1859 and CVE 2015-1860 by backporting patches
+ (Closes: #783134):
+ - fixes_crash_in_bmp_and_ico_image_decoders.patch
+ - fixes_crash_in_gif_image_decoder.patch
-- Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org> Thu, 05 Mar 2015 10:26:29 +0300
diff --git a/debian/patches/fixes_crash_in_bmp_and_ico_image_decoders.patch b/debian/patches/fixes_crash_in_bmp_and_ico_image_decoders.patch
new file mode 100644
index 0000000..9a2fc6e
--- /dev/null
+++ b/debian/patches/fixes_crash_in_bmp_and_ico_image_decoders.patch
@@ -0,0 +1,62 @@
+From 51ec7ebfe5f45d1c0a03d992e97053cac66e25fe Mon Sep 17 00:00:00 2001
+From: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed, 11 Mar 2015 13:34:01 +0100
+Subject: [PATCH] Fixes crash in bmp and ico image decoding
+
+Fuzzing test revealed that for certain malformed bmp and ico files,
+the handler would segfault.
+
+Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+Reviewed-by: Lars Knoll <lars.knoll at digia.com>
+---
+ src/gui/image/qbmphandler.cpp | 13 +++++++------
+ src/plugins/imageformats/ico/qicohandler.cpp | 2 +-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
+index df66499..8acc593 100644
+--- a/src/gui/image/qbmphandler.cpp
++++ b/src/gui/image/qbmphandler.cpp
+@@ -484,12 +484,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -497,6 +491,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
+index 00de0c8..ec1654e 100644
+--- a/src/plugins/imageformats/ico/qicohandler.cpp
++++ b/src/plugins/imageformats/ico/qicohandler.cpp
+@@ -567,7 +567,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
+--
+2.1.4
+
diff --git a/debian/patches/fixes_crash_in_gif_image_decoder.patch b/debian/patches/fixes_crash_in_gif_image_decoder.patch
new file mode 100644
index 0000000..d9871ae
--- /dev/null
+++ b/debian/patches/fixes_crash_in_gif_image_decoder.patch
@@ -0,0 +1,30 @@
+From d3048a29797ee2d80d84bbda26bb3c954584f332 Mon Sep 17 00:00:00 2001
+From: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed, 11 Mar 2015 09:00:41 +0100
+Subject: [PATCH] Fixes crash in gif image decoder
+
+Fuzzing test revealed that for certain malformed gif files,
+qgifhandler would segfault.
+
+Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1
+Reviewed-by: Richard J. Moore <rich at kde.org>
+---
+ src/gui/image/qgifhandler.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
+index 03e46ab..8d8c4ae 100644
+--- a/src/gui/image/qgifhandler.cpp
++++ b/src/gui/image/qgifhandler.cpp
+@@ -936,6 +936,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co
+
+ void QGIFFormat::nextY(unsigned char *bits, int bpl)
+ {
++ if (out_of_bounds)
++ return;
+ int my;
+ switch (interlace) {
+ case 0: // Non-interlaced
+--
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index 246a5f9..4b42677 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,6 +7,8 @@ qtsystemtrayicon_handle_submenus_correctly.patch
xcb_delay_showing_tray_icon_window_until_it_is_embedded.patch
require_fpic_instead_of_fpie.patch
make_qglobal_h_complain_if_you_use_fpie.patch
+fixes_crash_in_bmp_and_ico_image_decoders.patch
+fixes_crash_in_gif_image_decoder.patch
# Debian specific.
revert_upstream_bsymbolic_change.patch
--
qtbase packaging
More information about the pkg-kde-commits
mailing list