kensington 15/05/16 18:51:53
Added: qtgui-5.4.1-CVE-2015-1858-1859.patch
qtgui-5.4.1-CVE-2015-1860.patch
Log:
Backport patches from upstream to solve CVE-2015-1858, CVE-2015-1859, and
CVE-2015-1860 wrt bug #546174.
(Portage version: 2.2.19/cvs/Linux x86_64, signed Manifest commit with key
0x06B1F38DCA45A1EC!)
Revision Changes Path
1.1 dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1858-1859.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1858-1859.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1858-1859.patch?rev=1.1&content-type=text/plain
Index: qtgui-5.4.1-CVE-2015-1858-1859.patch
===================================================================
>From 51ec7ebfe5f45d1c0a03d992e97053cac66e25fe Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <[email protected]>
Date: Wed, 11 Mar 2015 13:34:01 +0100
Subject: Fixes crash in bmp and ico image decoding
Fuzzing test revealed that for certain malformed bmp and ico files,
the handler would segfault.
Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
Reviewed-by: Lars Knoll <[email protected]>
---
src/gui/image/qbmphandler.cpp | 13 +++++++------
src/plugins/imageformats/ico/qicohandler.cpp | 2 +-
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
index df66499..8acc593 100644
--- a/src/gui/image/qbmphandler.cpp
+++ b/src/gui/image/qbmphandler.cpp
@@ -484,12 +484,6 @@ static bool read_dib_body(QDataStream &s, const
BMP_INFOHDR &bi, int offset, int
p = data + (h-y-1)*bpl;
break;
case 2: // delta (jump)
- // Protection
- if ((uint)x >= (uint)w)
- x = w-1;
- if ((uint)y >= (uint)h)
- y = h-1;
-
{
quint8 tmp;
d->getChar((char *)&tmp);
@@ -497,6 +491,13 @@ static bool read_dib_body(QDataStream &s, const
BMP_INFOHDR &bi, int offset, int
d->getChar((char *)&tmp);
y += tmp;
}
+
+ // Protection
+ if ((uint)x >= (uint)w)
+ x = w-1;
+ if ((uint)y >= (uint)h)
+ y = h-1;
+
p = data + (h-y-1)*bpl + x;
break;
default: // absolute mode
diff --git a/src/plugins/imageformats/ico/qicohandler.cpp
b/src/plugins/imageformats/ico/qicohandler.cpp
index 00de0c8..ec1654e 100644
--- a/src/plugins/imageformats/ico/qicohandler.cpp
+++ b/src/plugins/imageformats/ico/qicohandler.cpp
@@ -567,7 +567,7 @@ QImage ICOReader::iconAt(int index)
QImage::Format format = QImage::Format_ARGB32;
if (icoAttrib.nbits == 24)
format = QImage::Format_RGB32;
- else if (icoAttrib.ncolors == 2)
+ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
format = QImage::Format_Mono;
else if (icoAttrib.ncolors > 0)
format = QImage::Format_Indexed8;
--
cgit v0.11.0
1.1 dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1860.patch
file :
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1860.patch?rev=1.1&view=markup
plain:
http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-qt/qtgui/files/qtgui-5.4.1-CVE-2015-1860.patch?rev=1.1&content-type=text/plain
Index: qtgui-5.4.1-CVE-2015-1860.patch
===================================================================
>From d3048a29797ee2d80d84bbda26bb3c954584f332 Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <[email protected]>
Date: Wed, 11 Mar 2015 09:00:41 +0100
Subject: Fixes crash in gif image decoder
Fuzzing test revealed that for certain malformed gif files,
qgifhandler would segfault.
Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1
Reviewed-by: Richard J. Moore <[email protected]>
---
src/gui/image/qgifhandler.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
index 03e46ab..8d8c4ae 100644
--- a/src/gui/image/qgifhandler.cpp
+++ b/src/gui/image/qgifhandler.cpp
@@ -936,6 +936,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row,
int w, int h, QRgb co
void QGIFFormat::nextY(unsigned char *bits, int bpl)
{
+ if (out_of_bounds)
+ return;
int my;
switch (interlace) {
case 0: // Non-interlaced
--
cgit v0.11.0
