summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorEric Bénard <eric@eukrea.com>2013-02-05 15:04:12 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2013-02-06 09:37:28 +0000
commit4832cd2a4af6a59ffad5b808a0fd1a43c0cfc096 (patch)
tree68becc6e589f2015374483ee329179cdca42b22f /meta
parent4cb7c9a7ca3632c15414177e6e3ee399ad48ba08 (diff)
downloadpoky-4832cd2a4af6a59ffad5b808a0fd1a43c0cfc096.tar.gz
qt4: fix CVE-2013-0254
fix "POSIX shared memory segments created world-writeable" more details : http://lists.qt-project.org/pipermail/announce/2013-February/000023.html (From OE-Core rev: e7d8746c32d1ef08327ca4774812af9a8e75a0c4) Signed-off-by: Eric Bénard <eric@eukrea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-qt/qt4/qt4-4.8.4.inc1
-rw-r--r--meta/recipes-qt/qt4/qt4-4.8.4/0024-Change-all-shmget-calls-to-user-only-memory.patch147
-rw-r--r--meta/recipes-qt/qt4/qt4-embedded_4.8.4.bb2
-rw-r--r--meta/recipes-qt/qt4/qt4-x11-free_4.8.4.bb2
4 files changed, 150 insertions, 2 deletions
diff --git a/meta/recipes-qt/qt4/qt4-4.8.4.inc b/meta/recipes-qt/qt4/qt4-4.8.4.inc
index 0bc106251e..3f0f0036c4 100644
--- a/meta/recipes-qt/qt4/qt4-4.8.4.inc
+++ b/meta/recipes-qt/qt4/qt4-4.8.4.inc
@@ -23,6 +23,7 @@ SRC_URI = "http://releases.qt-project.org/qt4/source/qt-everywhere-opensource-sr
23 file://0020-webkit-disable-the-fuse-ld-gold-flag.patch \ 23 file://0020-webkit-disable-the-fuse-ld-gold-flag.patch \
24 file://0022-ssl-certificates-blacklist-mis-issued-turktrust-certificates.patch \ 24 file://0022-ssl-certificates-blacklist-mis-issued-turktrust-certificates.patch \
25 file://0023-qtnetwork-blacklist-two-more-certificates.patch \ 25 file://0023-qtnetwork-blacklist-two-more-certificates.patch \
26 file://0024-Change-all-shmget-calls-to-user-only-memory.patch \
26 file://g++.conf \ 27 file://g++.conf \
27 file://linux.conf \ 28 file://linux.conf \
28 " 29 "
diff --git a/meta/recipes-qt/qt4/qt4-4.8.4/0024-Change-all-shmget-calls-to-user-only-memory.patch b/meta/recipes-qt/qt4/qt4-4.8.4/0024-Change-all-shmget-calls-to-user-only-memory.patch
new file mode 100644
index 0000000000..6c796a36c9
--- /dev/null
+++ b/meta/recipes-qt/qt4/qt4-4.8.4/0024-Change-all-shmget-calls-to-user-only-memory.patch
@@ -0,0 +1,147 @@
1From 20b26bdb3dd5e46b01b9a7e1ce8342074df3c89c Mon Sep 17 00:00:00 2001
2From: Thiago Macieira <thiago.macieira@intel.com>
3Date: Sat, 22 Dec 2012 08:32:12 -0800
4Subject: [PATCH] Change all shmget calls to user-only memory
5
6Drop the read and write permissions for group and other users in the
7system.
8
9Change-Id: I8fc753f09126651af3fb82df3049050f0b14e876
10(cherry-picked from Qt 5 commit 856f209fb63ae336bfb389a12d2a75fa886dc1c5)
11Reviewed-by: Richard J. Moore <rich@kde.org>
12
13Upstream-Status: Accepted http://qt.gitorious.org/qt/qt/commit/20b26bdb3dd5e46b01b9a7e1ce8342074df3c89c
14---
15 src/corelib/kernel/qsharedmemory_unix.cpp | 6 +++---
16 src/corelib/kernel/qsystemsemaphore_unix.cpp | 4 ++--
17 src/gui/image/qnativeimage.cpp | 2 +-
18 src/gui/image/qpixmap_x11.cpp | 2 +-
19 src/plugins/platforms/xcb/qxcbwindowsurface.cpp | 2 +-
20 src/plugins/platforms/xlib/qxlibwindowsurface.cpp | 2 +-
21 .../auto/qtipc/qsharedmemory/tst_qsharedmemory.cpp | 2 +-
22 tools/qvfb/qvfbshmem.cpp | 4 ++--
23 8 files changed, 12 insertions(+), 12 deletions(-)
24
25diff --git a/src/corelib/kernel/qsharedmemory_unix.cpp b/src/corelib/kernel/qsharedmemory_unix.cpp
26index 20d76e3..4cf3acf 100644
27--- a/src/corelib/kernel/qsharedmemory_unix.cpp
28+++ b/src/corelib/kernel/qsharedmemory_unix.cpp
29@@ -238,7 +238,7 @@ bool QSharedMemoryPrivate::create(int size)
30 }
31
32 // create
33- if (-1 == shmget(unix_key, size, 0666 | IPC_CREAT | IPC_EXCL)) {
34+ if (-1 == shmget(unix_key, size, 0600 | IPC_CREAT | IPC_EXCL)) {
35 QString function = QLatin1String("QSharedMemory::create");
36 switch (errno) {
37 case EINVAL:
38@@ -293,7 +293,7 @@ bool QSharedMemoryPrivate::attach(QSharedMemory::AccessMode mode)
39 {
40 #ifndef QT_POSIX_IPC
41 // grab the shared memory segment id
42- int id = shmget(unix_key, 0, (mode == QSharedMemory::ReadOnly ? 0444 : 0660));
43+ int id = shmget(unix_key, 0, (mode == QSharedMemory::ReadOnly ? 0400 : 0600));
44 if (-1 == id) {
45 setErrorString(QLatin1String("QSharedMemory::attach (shmget)"));
46 return false;
47@@ -381,7 +381,7 @@ bool QSharedMemoryPrivate::detach()
48 size = 0;
49
50 // Get the number of current attachments
51- int id = shmget(unix_key, 0, 0444);
52+ int id = shmget(unix_key, 0, 0400);
53 cleanHandle();
54
55 struct shmid_ds shmid_ds;
56diff --git a/src/corelib/kernel/qsystemsemaphore_unix.cpp b/src/corelib/kernel/qsystemsemaphore_unix.cpp
57index fad9acc..e77456b 100644
58--- a/src/corelib/kernel/qsystemsemaphore_unix.cpp
59+++ b/src/corelib/kernel/qsystemsemaphore_unix.cpp
60@@ -153,10 +153,10 @@ key_t QSystemSemaphorePrivate::handle(QSystemSemaphore::AccessMode mode)
61 }
62
63 // Get semaphore
64- semaphore = semget(unix_key, 1, 0666 | IPC_CREAT | IPC_EXCL);
65+ semaphore = semget(unix_key, 1, 0600 | IPC_CREAT | IPC_EXCL);
66 if (-1 == semaphore) {
67 if (errno == EEXIST)
68- semaphore = semget(unix_key, 1, 0666 | IPC_CREAT);
69+ semaphore = semget(unix_key, 1, 0600 | IPC_CREAT);
70 if (-1 == semaphore) {
71 setErrorString(QLatin1String("QSystemSemaphore::handle"));
72 cleanHandle();
73diff --git a/src/gui/image/qnativeimage.cpp b/src/gui/image/qnativeimage.cpp
74index 9654afe..fef38c5 100644
75--- a/src/gui/image/qnativeimage.cpp
76+++ b/src/gui/image/qnativeimage.cpp
77@@ -176,7 +176,7 @@ QNativeImage::QNativeImage(int width, int height, QImage::Format format,bool /*
78
79 bool ok;
80 xshminfo.shmid = shmget(IPC_PRIVATE, xshmimg->bytes_per_line * xshmimg->height,
81- IPC_CREAT | 0777);
82+ IPC_CREAT | 0700);
83 ok = xshminfo.shmid != -1;
84 if (ok) {
85 xshmimg->data = (char*)shmat(xshminfo.shmid, 0, 0);
86diff --git a/src/gui/image/qpixmap_x11.cpp b/src/gui/image/qpixmap_x11.cpp
87index 280d8bd..88c9b7b 100644
88--- a/src/gui/image/qpixmap_x11.cpp
89+++ b/src/gui/image/qpixmap_x11.cpp
90@@ -193,7 +193,7 @@ static bool qt_create_mitshm_buffer(const QPaintDevice* dev, int w, int h)
91 bool ok;
92 xshminfo.shmid = shmget(IPC_PRIVATE,
93 xshmimg->bytes_per_line * xshmimg->height,
94- IPC_CREAT | 0777);
95+ IPC_CREAT | 0700);
96 ok = xshminfo.shmid != -1;
97 if (ok) {
98 xshmimg->data = (char*)shmat(xshminfo.shmid, 0, 0);
99diff --git a/src/plugins/platforms/xcb/qxcbwindowsurface.cpp b/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
100index b6a42d8..0d56821 100644
101--- a/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
102+++ b/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
103@@ -98,7 +98,7 @@ QXcbShmImage::QXcbShmImage(QXcbScreen *screen, const QSize &size, uint depth, QI
104 0);
105
106 m_shm_info.shmid = shmget (IPC_PRIVATE,
107- m_xcb_image->stride * m_xcb_image->height, IPC_CREAT|0777);
108+ m_xcb_image->stride * m_xcb_image->height, IPC_CREAT|0600);
109
110 m_shm_info.shmaddr = m_xcb_image->data = (quint8 *)shmat (m_shm_info.shmid, 0, 0);
111 m_shm_info.shmseg = xcb_generate_id(xcb_connection());
112diff --git a/src/plugins/platforms/xlib/qxlibwindowsurface.cpp b/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
113index bf003eb..46a2f97 100644
114--- a/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
115+++ b/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
116@@ -99,7 +99,7 @@ void QXlibWindowSurface::resizeShmImage(int width, int height)
117
118
119 image_info->shminfo.shmid = shmget (IPC_PRIVATE,
120- image->bytes_per_line * image->height, IPC_CREAT|0777);
121+ image->bytes_per_line * image->height, IPC_CREAT|0700);
122
123 image_info->shminfo.shmaddr = image->data = (char*)shmat (image_info->shminfo.shmid, 0, 0);
124 image_info->shminfo.readOnly = False;
125diff --git a/tools/qvfb/qvfbshmem.cpp b/tools/qvfb/qvfbshmem.cpp
126index 7f9671f..84b6ebe 100644
127--- a/tools/qvfb/qvfbshmem.cpp
128+++ b/tools/qvfb/qvfbshmem.cpp
129@@ -176,13 +176,13 @@ QShMemViewProtocol::QShMemViewProtocol(int displayid, const QSize &s,
130 uint data_offset_value = sizeof(QVFbHeader);
131
132 int dataSize = bpl * h + data_offset_value;
133- shmId = shmget(key, dataSize, IPC_CREAT | 0666);
134+ shmId = shmget(key, dataSize, IPC_CREAT | 0600);
135 if (shmId != -1)
136 data = (unsigned char *)shmat(shmId, 0, 0);
137 else {
138 struct shmid_ds shm;
139 shmctl(shmId, IPC_RMID, &shm);
140- shmId = shmget(key, dataSize, IPC_CREAT | 0666);
141+ shmId = shmget(key, dataSize, IPC_CREAT | 0600);
142 if (shmId == -1) {
143 perror("QShMemViewProtocol::QShMemViewProtocol");
144 qFatal("Cannot get shared memory 0x%08x", key);
145--
1461.7.1
147
diff --git a/meta/recipes-qt/qt4/qt4-embedded_4.8.4.bb b/meta/recipes-qt/qt4/qt4-embedded_4.8.4.bb
index 6024192ec9..286da95e2f 100644
--- a/meta/recipes-qt/qt4/qt4-embedded_4.8.4.bb
+++ b/meta/recipes-qt/qt4/qt4-embedded_4.8.4.bb
@@ -1,7 +1,7 @@
1require qt4-${PV}.inc 1require qt4-${PV}.inc
2require qt4-embedded.inc 2require qt4-embedded.inc
3 3
4PR = "${INC_PR}.2" 4PR = "${INC_PR}.3"
5 5
6QT_CONFIG_FLAGS_append_arm = "${@bb.utils.contains("TUNE_FEATURES", "neon", "", " -no-neon" ,d)}" 6QT_CONFIG_FLAGS_append_arm = "${@bb.utils.contains("TUNE_FEATURES", "neon", "", " -no-neon" ,d)}"
7 7
diff --git a/meta/recipes-qt/qt4/qt4-x11-free_4.8.4.bb b/meta/recipes-qt/qt4/qt4-x11-free_4.8.4.bb
index 7de6a82a62..e5db30d41d 100644
--- a/meta/recipes-qt/qt4/qt4-x11-free_4.8.4.bb
+++ b/meta/recipes-qt/qt4/qt4-x11-free_4.8.4.bb
@@ -1,7 +1,7 @@
1require qt4-x11-free.inc 1require qt4-x11-free.inc
2require qt4-${PV}.inc 2require qt4-${PV}.inc
3 3
4PR = "${INC_PR}.2" 4PR = "${INC_PR}.3"
5 5
6QT_CONFIG_FLAGS_append_arm = "${@bb.utils.contains("TUNE_FEATURES", "neon", "", " -no-neon" ,d)}" 6QT_CONFIG_FLAGS_append_arm = "${@bb.utils.contains("TUNE_FEATURES", "neon", "", " -no-neon" ,d)}"
7 7