diff options
author | Kai Kang <kai.kang@windriver.com> | 2015-05-27 17:40:40 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-06-28 09:44:17 +0100 |
commit | 4acf353ffd1a300ee0e4656ba6473cc58b18dcef (patch) | |
tree | e6731e35909b6bb1643f5a38608cf2cad612b307 | |
parent | 4dd8c7e80538347301a75aeede3899e1bf32311a (diff) | |
download | poky-4acf353ffd1a300ee0e4656ba6473cc58b18dcef.tar.gz |
qt4: fix CVE issues
Backport patches to fix qt4 CVE issues:
* CVE-2015-1858
* CVE-2015-1859
* CVE-2015-1860
(From OE-Core rev: e57a090d8f806f55b99649e072b4d2dde6f036ee)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3 files changed, 112 insertions, 0 deletions
diff --git a/meta/recipes-qt/qt4/qt4-4.8.6.inc b/meta/recipes-qt/qt4/qt4-4.8.6.inc index 19f52a7711..44cf47440e 100644 --- a/meta/recipes-qt/qt4/qt4-4.8.6.inc +++ b/meta/recipes-qt/qt4/qt4-4.8.6.inc | |||
@@ -27,6 +27,8 @@ SRC_URI = "http://download.qt-project.org/official_releases/qt/4.8/${PV}/qt-ever | |||
27 | file://0031-aarch64_arm64_mkspecs.patch \ | 27 | file://0031-aarch64_arm64_mkspecs.patch \ |
28 | file://0032-aarch64_add_header.patch \ | 28 | file://0032-aarch64_add_header.patch \ |
29 | file://0034-Fix-a-division-by-zero-when-processing-malformed-BMP.patch \ | 29 | file://0034-Fix-a-division-by-zero-when-processing-malformed-BMP.patch \ |
30 | file://0035-Fixes-crash-in-bmp-and-ico-image-decoding.patch \ | ||
31 | file://0036-Fixes-crash-in-gif-image-decoder.patch \ | ||
30 | file://Fix-QWSLock-invalid-argument-logs.patch \ | 32 | file://Fix-QWSLock-invalid-argument-logs.patch \ |
31 | file://g++.conf \ | 33 | file://g++.conf \ |
32 | file://linux.conf \ | 34 | file://linux.conf \ |
diff --git a/meta/recipes-qt/qt4/qt4-4.8.6/0035-Fixes-crash-in-bmp-and-ico-image-decoding.patch b/meta/recipes-qt/qt4/qt4-4.8.6/0035-Fixes-crash-in-bmp-and-ico-image-decoding.patch new file mode 100644 index 0000000000..c88879a38a --- /dev/null +++ b/meta/recipes-qt/qt4/qt4-4.8.6/0035-Fixes-crash-in-bmp-and-ico-image-decoding.patch | |||
@@ -0,0 +1,71 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | Backport patch to fix CVE-2015-1858 and CVE-2015-1859 | ||
4 | |||
5 | http://code.qt.io/cgit/qt/qt.git/commit/?id=3e55cd6 | ||
6 | |||
7 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
8 | --- | ||
9 | From 3e55cd6dc467303a3c35312e9fcb255c2c048b32 Mon Sep 17 00:00:00 2001 | ||
10 | From: Eirik Aavitsland <eirik.aavitsland@theqtcompany.com> | ||
11 | Date: Wed, 11 Mar 2015 13:34:01 +0100 | ||
12 | Subject: [PATCH] Fixes crash in bmp and ico image decoding | ||
13 | |||
14 | Fuzzing test revealed that for certain malformed bmp and ico files, | ||
15 | the handler would segfault. | ||
16 | |||
17 | Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe | ||
18 | (cherry picked from qtbase/2adbbae5432aa9d8cc41c6fcf55c2e310d2d4078) | ||
19 | Reviewed-by: Richard J. Moore <rich@kde.org> | ||
20 | --- | ||
21 | src/gui/image/qbmphandler.cpp | 13 +++++++------ | ||
22 | src/plugins/imageformats/ico/qicohandler.cpp | 2 +- | ||
23 | 2 files changed, 8 insertions(+), 7 deletions(-) | ||
24 | |||
25 | diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp | ||
26 | index 30fa9e0..17a880b 100644 | ||
27 | --- a/src/gui/image/qbmphandler.cpp | ||
28 | +++ b/src/gui/image/qbmphandler.cpp | ||
29 | @@ -478,12 +478,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int | ||
30 | p = data + (h-y-1)*bpl; | ||
31 | break; | ||
32 | case 2: // delta (jump) | ||
33 | - // Protection | ||
34 | - if ((uint)x >= (uint)w) | ||
35 | - x = w-1; | ||
36 | - if ((uint)y >= (uint)h) | ||
37 | - y = h-1; | ||
38 | - | ||
39 | { | ||
40 | quint8 tmp; | ||
41 | d->getChar((char *)&tmp); | ||
42 | @@ -491,6 +485,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int | ||
43 | d->getChar((char *)&tmp); | ||
44 | y += tmp; | ||
45 | } | ||
46 | + | ||
47 | + // Protection | ||
48 | + if ((uint)x >= (uint)w) | ||
49 | + x = w-1; | ||
50 | + if ((uint)y >= (uint)h) | ||
51 | + y = h-1; | ||
52 | + | ||
53 | p = data + (h-y-1)*bpl + x; | ||
54 | break; | ||
55 | default: // absolute mode | ||
56 | diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp | ||
57 | index 1a88605..3c34765 100644 | ||
58 | --- a/src/plugins/imageformats/ico/qicohandler.cpp | ||
59 | +++ b/src/plugins/imageformats/ico/qicohandler.cpp | ||
60 | @@ -571,7 +571,7 @@ QImage ICOReader::iconAt(int index) | ||
61 | QImage::Format format = QImage::Format_ARGB32; | ||
62 | if (icoAttrib.nbits == 24) | ||
63 | format = QImage::Format_RGB32; | ||
64 | - else if (icoAttrib.ncolors == 2) | ||
65 | + else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1) | ||
66 | format = QImage::Format_Mono; | ||
67 | else if (icoAttrib.ncolors > 0) | ||
68 | format = QImage::Format_Indexed8; | ||
69 | -- | ||
70 | 2.4.1 | ||
71 | |||
diff --git a/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch b/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch new file mode 100644 index 0000000000..c1baf0e53a --- /dev/null +++ b/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | Backport patch to fix CVE-2015-1860 | ||
4 | |||
5 | http://code.qt.io/cgit/qt/qt.git/commit/?id=9f2425a | ||
6 | |||
7 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
8 | --- | ||
9 | From a1cf194c54be57d6ab55dfd26b9562a60532208e Mon Sep 17 00:00:00 2001 | ||
10 | From: Eirik Aavitsland <eirik.aavitsland@theqtcompany.com> | ||
11 | Date: Wed, 11 Mar 2015 09:00:41 +0100 | ||
12 | Subject: [PATCH] Fixes crash in gif image decoder | ||
13 | |||
14 | Fuzzing test revealed that for certain malformed gif files, | ||
15 | qgifhandler would segfault. | ||
16 | |||
17 | Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1 | ||
18 | (cherry picked from qtbase/ea2c5417fcd374302f5019e67f72af5facbd29f6) | ||
19 | Reviewed-by: Richard J. Moore <rich@kde.org> | ||
20 | --- | ||
21 | src/gui/image/qgifhandler.cpp | 2 ++ | ||
22 | 1 file changed, 2 insertions(+) | ||
23 | |||
24 | diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp | ||
25 | index 5199dd3..49aa2a6 100644 | ||
26 | --- a/src/gui/image/qgifhandler.cpp | ||
27 | +++ b/src/gui/image/qgifhandler.cpp | ||
28 | @@ -944,6 +944,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co | ||
29 | |||
30 | void QGIFFormat::nextY(unsigned char *bits, int bpl) | ||
31 | { | ||
32 | + if (out_of_bounds) | ||
33 | + return; | ||
34 | int my; | ||
35 | switch (interlace) { | ||
36 | case 0: // Non-interlaced | ||
37 | -- | ||
38 | 2.4.1 | ||
39 | |||