epienbro pushed to mingw-qt5-qtbase (f22). "Fix CVE-2015-0295, CVE-2015-1858, CVE-2015-1859 and CVE-2015-1860"
notifications at fedoraproject.org
notifications at fedoraproject.org
Fri Apr 24 14:11:27 UTC 2015
>From 3aa2ffc52946fa4171ce05f3ff955cacc37b19ff Mon Sep 17 00:00:00 2001
From: Erik van Pienbroek <epienbro at fedoraproject.org>
Date: Fri, 24 Apr 2015 16:10:15 +0200
Subject: Fix CVE-2015-0295, CVE-2015-1858, CVE-2015-1859 and CVE-2015-1860
diff --git a/0149-Fix-a-division-by-zero-when-processing-malformed-BMP.patch b/0149-Fix-a-division-by-zero-when-processing-malformed-BMP.patch
new file mode 100644
index 0000000..a1a5df1
--- /dev/null
+++ b/0149-Fix-a-division-by-zero-when-processing-malformed-BMP.patch
@@ -0,0 +1,45 @@
+From 661f6bfd032dacc62841037732816a583640e187 Mon Sep 17 00:00:00 2001
+From: "Richard J. Moore" <rich at kde.org>
+Date: Sat, 21 Feb 2015 17:43:21 +0000
+Subject: [PATCH 149/163] Fix a division by zero when processing malformed BMP
+ files.
+
+This fixes a division by 0 when processing a maliciously crafted BMP
+file. No impact beyond DoS.
+
+Task-number: QTBUG-44547
+Change-Id: Ifcded2c0aa712e90d23e6b3969af0ec3add53973
+Reviewed-by: Thiago Macieira <thiago.macieira at intel.com>
+Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen at theqtcompany.com>
+---
+ src/gui/image/qbmphandler.cpp | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
+index 21c1a2f..df66499 100644
+--- a/src/gui/image/qbmphandler.cpp
++++ b/src/gui/image/qbmphandler.cpp
+@@ -314,12 +314,20 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ }
+ } else if (comp == BMP_BITFIELDS && (nbits == 16 || nbits == 32)) {
+ red_shift = calc_shift(red_mask);
++ if (((red_mask >> red_shift) + 1) == 0)
++ return false;
+ red_scale = 256 / ((red_mask >> red_shift) + 1);
+ green_shift = calc_shift(green_mask);
++ if (((green_mask >> green_shift) + 1) == 0)
++ return false;
+ green_scale = 256 / ((green_mask >> green_shift) + 1);
+ blue_shift = calc_shift(blue_mask);
++ if (((blue_mask >> blue_shift) + 1) == 0)
++ return false;
+ blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
+ alpha_shift = calc_shift(alpha_mask);
++ if (((alpha_mask >> alpha_shift) + 1) == 0)
++ return false;
+ alpha_scale = 256 / ((alpha_mask >> alpha_shift) + 1);
+ } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
+ blue_mask = 0x000000ff;
+--
+1.9.3
+
diff --git a/0200-Fixes-crash-in-gif-image-decoder.patch b/0200-Fixes-crash-in-gif-image-decoder.patch
new file mode 100644
index 0000000..db7cefc
--- /dev/null
+++ b/0200-Fixes-crash-in-gif-image-decoder.patch
@@ -0,0 +1,30 @@
+From d3048a29797ee2d80d84bbda26bb3c954584f332 Mon Sep 17 00:00:00 2001
+From: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed, 11 Mar 2015 09:00:41 +0100
+Subject: [PATCH 200/238] Fixes crash in gif image decoder
+
+Fuzzing test revealed that for certain malformed gif files,
+qgifhandler would segfault.
+
+Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1
+Reviewed-by: Richard J. Moore <rich at kde.org>
+---
+ src/gui/image/qgifhandler.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
+index 03e46ab..8d8c4ae 100644
+--- a/src/gui/image/qgifhandler.cpp
++++ b/src/gui/image/qgifhandler.cpp
+@@ -936,6 +936,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co
+
+ void QGIFFormat::nextY(unsigned char *bits, int bpl)
+ {
++ if (out_of_bounds)
++ return;
+ int my;
+ switch (interlace) {
+ case 0: // Non-interlaced
+--
+1.9.3
+
diff --git a/0201-Fixes-crash-in-bmp-and-ico-image-decoding.patch b/0201-Fixes-crash-in-bmp-and-ico-image-decoding.patch
new file mode 100644
index 0000000..94e91c0
--- /dev/null
+++ b/0201-Fixes-crash-in-bmp-and-ico-image-decoding.patch
@@ -0,0 +1,62 @@
+From 51ec7ebfe5f45d1c0a03d992e97053cac66e25fe Mon Sep 17 00:00:00 2001
+From: Eirik Aavitsland <eirik.aavitsland at theqtcompany.com>
+Date: Wed, 11 Mar 2015 13:34:01 +0100
+Subject: [PATCH 201/238] Fixes crash in bmp and ico image decoding
+
+Fuzzing test revealed that for certain malformed bmp and ico files,
+the handler would segfault.
+
+Change-Id: I19d45145f31e7f808f7f6a1a1610270ea4159cbe
+Reviewed-by: Lars Knoll <lars.knoll at digia.com>
+---
+ src/gui/image/qbmphandler.cpp | 13 +++++++------
+ src/plugins/imageformats/ico/qicohandler.cpp | 2 +-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
+index df66499..8acc593 100644
+--- a/src/gui/image/qbmphandler.cpp
++++ b/src/gui/image/qbmphandler.cpp
+@@ -484,12 +484,6 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ p = data + (h-y-1)*bpl;
+ break;
+ case 2: // delta (jump)
+- // Protection
+- if ((uint)x >= (uint)w)
+- x = w-1;
+- if ((uint)y >= (uint)h)
+- y = h-1;
+-
+ {
+ quint8 tmp;
+ d->getChar((char *)&tmp);
+@@ -497,6 +491,13 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
+ d->getChar((char *)&tmp);
+ y += tmp;
+ }
++
++ // Protection
++ if ((uint)x >= (uint)w)
++ x = w-1;
++ if ((uint)y >= (uint)h)
++ y = h-1;
++
+ p = data + (h-y-1)*bpl + x;
+ break;
+ default: // absolute mode
+diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
+index 00de0c8..ec1654e 100644
+--- a/src/plugins/imageformats/ico/qicohandler.cpp
++++ b/src/plugins/imageformats/ico/qicohandler.cpp
+@@ -567,7 +567,7 @@ QImage ICOReader::iconAt(int index)
+ QImage::Format format = QImage::Format_ARGB32;
+ if (icoAttrib.nbits == 24)
+ format = QImage::Format_RGB32;
+- else if (icoAttrib.ncolors == 2)
++ else if (icoAttrib.ncolors == 2 && icoAttrib.depth == 1)
+ format = QImage::Format_Mono;
+ else if (icoAttrib.ncolors > 0)
+ format = QImage::Format_Indexed8;
+--
+1.9.3
+
diff --git a/mingw-qt5-qtbase.spec b/mingw-qt5-qtbase.spec
index 4f9a8d7..1860103 100644
--- a/mingw-qt5-qtbase.spec
+++ b/mingw-qt5-qtbase.spec
@@ -77,6 +77,11 @@ Patch6: qt5-fix-static-harfbuzz-detection.patch
# When using pkg-config to detect static libraries, the --static flag should also be used
Patch7: qt5-use-correct-pkg-config-static-flags.patch
+# Security fixes
+Patch10: 0149-Fix-a-division-by-zero-when-processing-malformed-BMP.patch
+Patch11: 0200-Fixes-crash-in-gif-image-decoder.patch
+Patch12: 0201-Fixes-crash-in-bmp-and-ico-image-decoding.patch
+
###########################
# Fedora specific patches #
###########################
@@ -308,6 +313,10 @@ Static version of the mingw64-qt5-qtbase library.
%patch6 -p1 -b .harfbuzz_static
%patch7 -p1 -b .pkgconfig_static
+%patch10 -p1 -b .CVE-2015-0295
+%patch11 -p1
+%patch12 -p1
+
%patch100 -p0
%patch101 -p0
%patch102 -p0 -b .angle
@@ -806,6 +815,9 @@ ln -s %{mingw64_target}-qmake-qt5 $RPM_BUILD_ROOT%{_bindir}/mingw64-qmake-qt5
%changelog
+* Fri Apr 24 2015 Erik van Pienbroek <epienbro at fedoraproject.org> - 5.4.1-2
+- Fix CVE-2015-0295, CVE-2015-1858, CVE-2015-1859 and CVE-2015-1860
+
* Sun Mar 8 2015 Erik van Pienbroek <epienbro at fedoraproject.org> - 5.4.1-1
- Update to 5.4.1
- Added some more BuildRequires for mingw*-static libraries as the ./configure
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/mingw-qt5-qtbase.git/commit/?h=f22&id=3aa2ffc52946fa4171ce05f3ff955cacc37b19ff
More information about the scm-commits
mailing list