svn commit: r383986 - in head: graphics/qt4-imageformats graphics/qt4-imageformats/files x11-toolkits/qt4-gui x11-toolkits/qt4-gui/files x11-toolkits/qt5-gui x11-toolkits/qt5-gui/files
Raphael Kubo da Costa
rakuco at FreeBSD.org
Tue Apr 14 08:34:45 UTC 2015
Author: rakuco
Date: Tue Apr 14 08:34:41 2015
New Revision: 383986
URL: https://svnweb.freebsd.org/changeset/ports/383986
Log:
Add patches for CVE-2015-1858, CVE-2015-1859 and CVE-2015-1860.
Multiple vulnerabilities in Qt image format handling.
MFH: 2015Q2
Security: 5713bfda-e27d-11e4-b2ce-5453ed2e2b49
Added:
head/graphics/qt4-imageformats/files/patch-CVE-2015-1858 (contents, props changed)
head/graphics/qt4-imageformats/files/patch-CVE-2015-1859 (contents, props changed)
head/x11-toolkits/qt4-gui/files/patch-CVE-2015-1859 (contents, props changed)
head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1858 (contents, props changed)
head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1859 (contents, props changed)
Modified:
head/graphics/qt4-imageformats/Makefile
head/x11-toolkits/qt4-gui/Makefile
head/x11-toolkits/qt5-gui/Makefile
Modified: head/graphics/qt4-imageformats/Makefile
==============================================================================
--- head/graphics/qt4-imageformats/Makefile Tue Apr 14 08:33:04 2015 (r383985)
+++ head/graphics/qt4-imageformats/Makefile Tue Apr 14 08:34:41 2015 (r383986)
@@ -3,7 +3,7 @@
PORTNAME= imageformats
DISTVERSION= ${QT4_VERSION}
-PORTREVISION= 2
+PORTREVISION= 3
CATEGORIES= graphics
PKGNAMEPREFIX= qt4-
Added: head/graphics/qt4-imageformats/files/patch-CVE-2015-1858
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/graphics/qt4-imageformats/files/patch-CVE-2015-1858 Tue Apr 14 08:34:41 2015 (r383986)
@@ -0,0 +1,24 @@
+commit a1cf194c54be57d6ab55dfd26b9562a60532208e
+Author: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed Mar 11 09:00:41 2015 +0100
+
+ Fixes crash in gif image decoder
+
+ Fuzzing test revealed that for certain malformed gif files,
+ qgifhandler would segfault.
+
+ Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1
+ (cherry picked from qtbase/ea2c5417fcd374302f5019e67f72af5facbd29f6)
+ Reviewed-by: Richard J. Moore <rich at kde.org>
+
+--- src/gui/image/qgifhandler.cpp
++++ src/gui/image/qgifhandler.cpp
+@@ -944,6 +944,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co
+
+ void QGIFFormat::nextY(unsigned char *bits, int bpl)
+ {
++ if (out_of_bounds)
++ return;
+ int my;
+ switch (interlace) {
+ case 0: // Non-interlaced
Added: head/graphics/qt4-imageformats/files/patch-CVE-2015-1859
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/graphics/qt4-imageformats/files/patch-CVE-2015-1859 Tue Apr 14 08:34:41 2015 (r383986)
@@ -0,0 +1,53 @@
+commit 3e55cd6dc467303a3c35312e9fcb255c2c048b32
+Author: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed Mar 11 13:34:01 2015 +0100
+
+ Fixes crash in bmp and ico image decoding
+
+ Fuzzing test revealed that for certain malformed bmp and ico files,
+ the handler would segfault.
+
+ Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+ (cherry picked from qtbase/2adbbae5432aa9d8cc41c6fcf55c2e310d2d4078)
+ Reviewed-by: Richard J. Moore <rich at kde.org>
+
+--- src/gui/image/qbmphandler.cpp
++++ src/gui/image/qbmphandler.cpp
+@@ -478,12 +478,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -491,6 +485,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+--- src/plugins/imageformats/ico/qicohandler.cpp
++++ src/plugins/imageformats/ico/qicohandler.cpp
+@@ -571,7 +571,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
Modified: head/x11-toolkits/qt4-gui/Makefile
==============================================================================
--- head/x11-toolkits/qt4-gui/Makefile Tue Apr 14 08:33:04 2015 (r383985)
+++ head/x11-toolkits/qt4-gui/Makefile Tue Apr 14 08:34:41 2015 (r383986)
@@ -3,7 +3,7 @@
PORTNAME= gui
DISTVERSION= ${QT4_VERSION}
-PORTREVISION= 4
+PORTREVISION= 5
CATEGORIES= x11-toolkits
PKGNAMEPREFIX= qt4-
Added: head/x11-toolkits/qt4-gui/files/patch-CVE-2015-1859
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/x11-toolkits/qt4-gui/files/patch-CVE-2015-1859 Tue Apr 14 08:34:41 2015 (r383986)
@@ -0,0 +1,53 @@
+commit 3e55cd6dc467303a3c35312e9fcb255c2c048b32
+Author: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed Mar 11 13:34:01 2015 +0100
+
+ Fixes crash in bmp and ico image decoding
+
+ Fuzzing test revealed that for certain malformed bmp and ico files,
+ the handler would segfault.
+
+ Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+ (cherry picked from qtbase/2adbbae5432aa9d8cc41c6fcf55c2e310d2d4078)
+ Reviewed-by: Richard J. Moore <rich at kde.org>
+
+--- src/gui/image/qbmphandler.cpp
++++ src/gui/image/qbmphandler.cpp
+@@ -478,12 +478,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -491,6 +485,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+--- src/plugins/imageformats/ico/qicohandler.cpp
++++ src/plugins/imageformats/ico/qicohandler.cpp
+@@ -571,7 +571,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
Modified: head/x11-toolkits/qt5-gui/Makefile
==============================================================================
--- head/x11-toolkits/qt5-gui/Makefile Tue Apr 14 08:33:04 2015 (r383985)
+++ head/x11-toolkits/qt5-gui/Makefile Tue Apr 14 08:34:41 2015 (r383986)
@@ -2,6 +2,7 @@
PORTNAME= gui
DISTVERSION= ${QT5_VERSION}
+PORTREVISION= 1
CATEGORIES= x11-toolkits graphics
PKGNAMEPREFIX= qt5-
Added: head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1858
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1858 Tue Apr 14 08:34:41 2015 (r383986)
@@ -0,0 +1,23 @@
+commit d3048a29797ee2d80d84bbda26bb3c954584f332
+Author: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed Mar 11 09:00:41 2015 +0100
+
+ Fixes crash in gif image decoder
+
+ Fuzzing test revealed that for certain malformed gif files,
+ qgifhandler would segfault.
+
+ Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1
+ Reviewed-by: Richard J. Moore <rich at kde.org>
+
+--- src/gui/image/qgifhandler.cpp
++++ src/gui/image/qgifhandler.cpp
+@@ -936,6 +936,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co
+
+ void QGIFFormat::nextY(unsigned char *bits, int bpl)
+ {
++ if (out_of_bounds)
++ return;
+ int my;
+ switch (interlace) {
+ case 0: // Non-interlaced
Added: head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1859
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/x11-toolkits/qt5-gui/files/patch-CVE-2015-1859 Tue Apr 14 08:34:41 2015 (r383986)
@@ -0,0 +1,52 @@
+commit 51ec7ebfe5f45d1c0a03d992e97053cac66e25fe
+Author: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed Mar 11 13:34:01 2015 +0100
+
+ Fixes crash in bmp and ico image decoding
+
+ Fuzzing test revealed that for certain malformed bmp and ico files,
+ the handler would segfault.
+
+ Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+ Reviewed-by: Lars Knoll <lars.knoll at digia.com>
+
+--- src/gui/image/qbmphandler.cpp
++++ src/gui/image/qbmphandler.cpp
+@@ -484,12 +484,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -497,6 +491,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+--- src/plugins/imageformats/ico/qicohandler.cpp
++++ src/plugins/imageformats/ico/qicohandler.cpp
+@@ -567,7 +567,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
More information about the svn-ports-head
mailing list