1 |
commit: 2130279f2fa917a2e5ee9a29cd8413b39484897a |
2 |
Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Feb 2 18:50:59 2020 +0000 |
4 |
Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Feb 2 23:23:54 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2130279f |
7 |
|
8 |
dev-qt/qtcore: Fix CVE-2020-0569 and CVE-2020-0570 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/707354 |
11 |
Package-Manager: Portage-2.3.87, Repoman-2.3.20 |
12 |
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org> |
13 |
|
14 |
.../qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch | 28 +++++++ |
15 |
.../qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch | 54 +++++++++++++ |
16 |
dev-qt/qtcore/qtcore-5.12.3-r2.ebuild | 90 ++++++++++++++++++++++ |
17 |
dev-qt/qtcore/qtcore-5.13.2-r2.ebuild | 89 +++++++++++++++++++++ |
18 |
4 files changed, 261 insertions(+) |
19 |
|
20 |
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch |
21 |
new file mode 100644 |
22 |
index 00000000000..b0e5b564e2d |
23 |
--- /dev/null |
24 |
+++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch |
25 |
@@ -0,0 +1,28 @@ |
26 |
+From bf131e8d2181b3404f5293546ed390999f760404 Mon Sep 17 00:00:00 2001 |
27 |
+From: Olivier Goffart <ogoffart@×××××.com> |
28 |
+Date: Fri, 8 Nov 2019 11:30:40 +0100 |
29 |
+Subject: Do not load plugin from the $PWD |
30 |
+ |
31 |
+I see no reason why this would make sense to look for plugins in the current |
32 |
+directory. And when there are plugins there, it may actually be wrong |
33 |
+ |
34 |
+Change-Id: I5f5aa168021fedddafce90effde0d5762cd0c4c5 |
35 |
+Reviewed-by: Thiago Macieira <thiago.macieira@×××××.com> |
36 |
+--- |
37 |
+ src/corelib/plugin/qpluginloader.cpp | 1 - |
38 |
+ 1 file changed, 1 deletion(-) |
39 |
+ |
40 |
+diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp |
41 |
+index cadff4f32b..c2443dbdda 100644 |
42 |
+--- a/src/corelib/plugin/qpluginloader.cpp |
43 |
++++ b/src/corelib/plugin/qpluginloader.cpp |
44 |
+@@ -305,7 +305,6 @@ static QString locatePlugin(const QString& fileName) |
45 |
+ paths.append(fileName.left(slash)); // don't include the '/' |
46 |
+ } else { |
47 |
+ paths = QCoreApplication::libraryPaths(); |
48 |
+- paths.prepend(QStringLiteral(".")); // search in current dir first |
49 |
+ } |
50 |
+ |
51 |
+ for (const QString &path : qAsConst(paths)) { |
52 |
+-- |
53 |
+cgit v1.2.1 |
54 |
|
55 |
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch |
56 |
new file mode 100644 |
57 |
index 00000000000..1f6b2dfafec |
58 |
--- /dev/null |
59 |
+++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch |
60 |
@@ -0,0 +1,54 @@ |
61 |
+From e6f1fde24f77f63fb16b2df239f82a89d2bf05dd Mon Sep 17 00:00:00 2001 |
62 |
+From: Thiago Macieira <thiago.macieira@×××××.com> |
63 |
+Date: Fri, 10 Jan 2020 09:26:27 -0800 |
64 |
+Subject: QLibrary/Unix: do not attempt to load a library relative to $PWD |
65 |
+ |
66 |
+I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to |
67 |
+find libraries in a haswell/ subdir of the main path, but we only need |
68 |
+to do that transformation if the library is contains at least one |
69 |
+directory seprator. That is, if the user asks to load "lib/foo", then we |
70 |
+should try "lib/haswell/foo" (often, the path prefix will be absolute). |
71 |
+ |
72 |
+When the library name the user requested has no directory separators, we |
73 |
+let dlopen() do the transformation for us. Testing on Linux confirms |
74 |
+glibc does so: |
75 |
+ |
76 |
+$ LD_DEBUG=libs /lib64/ld-linux-x86-64.so.2 --inhibit-cache ./qml -help |& grep Xcursor |
77 |
+ 1972475: find library=libXcursor.so.1 [0]; searching |
78 |
+ 1972475: trying file=/usr/lib64/haswell/avx512_1/libXcursor.so.1 |
79 |
+ 1972475: trying file=/usr/lib64/haswell/libXcursor.so.1 |
80 |
+ 1972475: trying file=/usr/lib64/libXcursor.so.1 |
81 |
+ 1972475: calling init: /usr/lib64/libXcursor.so.1 |
82 |
+ 1972475: calling fini: /usr/lib64/libXcursor.so.1 [0] |
83 |
+ |
84 |
+Fixes: QTBUG-81272 |
85 |
+Change-Id: I596aec77785a4e4e84d5fffd15e89689bb91ffbb |
86 |
+Reviewed-by: Thiago Macieira <thiago.macieira@×××××.com> |
87 |
+--- |
88 |
+ src/corelib/plugin/qlibrary_unix.cpp | 4 +++- |
89 |
+ 1 file changed, 3 insertions(+), 1 deletion(-) |
90 |
+ |
91 |
+diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp |
92 |
+index f0de1010d7..135b82cd37 100644 |
93 |
+--- a/src/corelib/plugin/qlibrary_unix.cpp |
94 |
++++ b/src/corelib/plugin/qlibrary_unix.cpp |
95 |
+@@ -1,7 +1,7 @@ |
96 |
+ /**************************************************************************** |
97 |
+ ** |
98 |
+ ** Copyright (C) 2016 The Qt Company Ltd. |
99 |
+-** Copyright (C) 2018 Intel Corporation |
100 |
++** Copyright (C) 2020 Intel Corporation |
101 |
+ ** Contact: https://www.qt.io/licensing/ |
102 |
+ ** |
103 |
+ ** This file is part of the QtCore module of the Qt Toolkit. |
104 |
+@@ -218,6 +218,8 @@ bool QLibraryPrivate::load_sys() |
105 |
+ for(int suffix = 0; retry && !pHnd && suffix < suffixes.size(); suffix++) { |
106 |
+ if (!prefixes.at(prefix).isEmpty() && name.startsWith(prefixes.at(prefix))) |
107 |
+ continue; |
108 |
++ if (path.isEmpty() && prefixes.at(prefix).contains(QLatin1Char('/'))) |
109 |
++ continue; |
110 |
+ if (!suffixes.at(suffix).isEmpty() && name.endsWith(suffixes.at(suffix))) |
111 |
+ continue; |
112 |
+ if (loadHints & QLibrary::LoadArchiveMemberHint) { |
113 |
+-- |
114 |
+cgit v1.2.1 |
115 |
|
116 |
diff --git a/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild b/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild |
117 |
new file mode 100644 |
118 |
index 00000000000..a4e53c82962 |
119 |
--- /dev/null |
120 |
+++ b/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild |
121 |
@@ -0,0 +1,90 @@ |
122 |
+# Copyright 1999-2020 Gentoo Authors |
123 |
+# Distributed under the terms of the GNU General Public License v2 |
124 |
+ |
125 |
+EAPI=6 |
126 |
+QT5_MODULE="qtbase" |
127 |
+inherit qt5-build |
128 |
+ |
129 |
+DESCRIPTION="Cross-platform application development framework" |
130 |
+ |
131 |
+if [[ ${QT5_BUILD_TYPE} == release ]]; then |
132 |
+ KEYWORDS="~arm ~x86" |
133 |
+fi |
134 |
+ |
135 |
+IUSE="icu systemd" |
136 |
+ |
137 |
+DEPEND=" |
138 |
+ dev-libs/double-conversion:= |
139 |
+ dev-libs/glib:2 |
140 |
+ dev-libs/libpcre2[pcre16,unicode] |
141 |
+ sys-libs/zlib:= |
142 |
+ icu? ( dev-libs/icu:= ) |
143 |
+ !icu? ( virtual/libiconv ) |
144 |
+ systemd? ( sys-apps/systemd:= ) |
145 |
+" |
146 |
+RDEPEND="${DEPEND} |
147 |
+ !<dev-qt/qtcore-4.8.7-r4:4 |
148 |
+" |
149 |
+ |
150 |
+QT5_TARGET_SUBDIRS=( |
151 |
+ src/tools/bootstrap |
152 |
+ src/tools/moc |
153 |
+ src/tools/rcc |
154 |
+ src/tools/qfloat16-tables |
155 |
+ src/corelib |
156 |
+ src/tools/qlalr |
157 |
+ doc |
158 |
+) |
159 |
+ |
160 |
+QT5_GENTOO_PRIVATE_CONFIG=( |
161 |
+ !:network |
162 |
+ !:sql |
163 |
+ !:testlib |
164 |
+ !:xml |
165 |
+) |
166 |
+ |
167 |
+PATCHES=( |
168 |
+ "${FILESDIR}/${P}-CVE-2019-18281.patch" |
169 |
+ "${FILESDIR}/${P}-CVE-2020-0569.patch" |
170 |
+ "${FILESDIR}/${P}-CVE-2020-0570.patch" |
171 |
+) |
172 |
+ |
173 |
+src_prepare() { |
174 |
+ # don't add -O3 to CXXFLAGS, bug 549140 |
175 |
+ sed -i -e '/CONFIG\s*+=/s/optimize_full//' src/corelib/corelib.pro || die |
176 |
+ |
177 |
+ # fix missing qt_version_tag symbol w/ LTO, bug 674382 |
178 |
+ sed -i -e 's/^gcc:ltcg/gcc/' src/corelib/global/global.pri || die |
179 |
+ |
180 |
+ qt5-build_src_prepare |
181 |
+} |
182 |
+ |
183 |
+src_configure() { |
184 |
+ local myconf=( |
185 |
+ -no-feature-statx # bug 672856 |
186 |
+ $(qt_use icu) |
187 |
+ $(qt_use !icu iconv) |
188 |
+ $(qt_use systemd journald) |
189 |
+ ) |
190 |
+ qt5-build_src_configure |
191 |
+} |
192 |
+ |
193 |
+src_install() { |
194 |
+ qt5-build_src_install |
195 |
+ |
196 |
+ local flags=( |
197 |
+ DBUS FREETYPE IMAGEFORMAT_JPEG IMAGEFORMAT_PNG |
198 |
+ OPENGL OPENSSL SSL WIDGETS |
199 |
+ ) |
200 |
+ |
201 |
+ for flag in ${flags[@]}; do |
202 |
+ cat >> "${D%/}"/${QT5_HEADERDIR}/QtCore/qconfig.h <<- _EOF_ || die |
203 |
+ |
204 |
+ #if defined(QT_NO_${flag}) && defined(QT_${flag}) |
205 |
+ # undef QT_NO_${flag} |
206 |
+ #elif !defined(QT_NO_${flag}) && !defined(QT_${flag}) |
207 |
+ # define QT_NO_${flag} |
208 |
+ #endif |
209 |
+ _EOF_ |
210 |
+ done |
211 |
+} |
212 |
|
213 |
diff --git a/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild b/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild |
214 |
new file mode 100644 |
215 |
index 00000000000..417c8e6a627 |
216 |
--- /dev/null |
217 |
+++ b/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild |
218 |
@@ -0,0 +1,89 @@ |
219 |
+# Copyright 1999-2020 Gentoo Authors |
220 |
+# Distributed under the terms of the GNU General Public License v2 |
221 |
+ |
222 |
+EAPI=7 |
223 |
+QT5_MODULE="qtbase" |
224 |
+inherit qt5-build |
225 |
+ |
226 |
+DESCRIPTION="Cross-platform application development framework" |
227 |
+ |
228 |
+if [[ ${QT5_BUILD_TYPE} == release ]]; then |
229 |
+ KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86" |
230 |
+fi |
231 |
+ |
232 |
+IUSE="icu systemd" |
233 |
+ |
234 |
+DEPEND=" |
235 |
+ dev-libs/double-conversion:= |
236 |
+ dev-libs/glib:2 |
237 |
+ dev-libs/libpcre2[pcre16,unicode] |
238 |
+ sys-libs/zlib:= |
239 |
+ icu? ( dev-libs/icu:= ) |
240 |
+ !icu? ( virtual/libiconv ) |
241 |
+ systemd? ( sys-apps/systemd:= ) |
242 |
+" |
243 |
+RDEPEND="${DEPEND} |
244 |
+ !<dev-qt/qtcore-4.8.7-r4:4 |
245 |
+" |
246 |
+ |
247 |
+QT5_TARGET_SUBDIRS=( |
248 |
+ src/tools/bootstrap |
249 |
+ src/tools/moc |
250 |
+ src/tools/rcc |
251 |
+ src/tools/qfloat16-tables |
252 |
+ src/corelib |
253 |
+ src/tools/qlalr |
254 |
+ doc |
255 |
+) |
256 |
+ |
257 |
+QT5_GENTOO_PRIVATE_CONFIG=( |
258 |
+ !:network |
259 |
+ !:sql |
260 |
+ !:testlib |
261 |
+ !:xml |
262 |
+) |
263 |
+ |
264 |
+PATCHES=( |
265 |
+ "${FILESDIR}/${PN}-5.12.3-CVE-2020-0569.patch" |
266 |
+ "${FILESDIR}/${PN}-5.12.3-CVE-2020-0570.patch" |
267 |
+) |
268 |
+ |
269 |
+src_prepare() { |
270 |
+ # don't add -O3 to CXXFLAGS, bug 549140 |
271 |
+ sed -i -e '/CONFIG\s*+=/s/optimize_full//' src/corelib/corelib.pro || die |
272 |
+ |
273 |
+ # fix missing qt_version_tag symbol w/ LTO, bug 674382 |
274 |
+ sed -i -e 's/^gcc:ltcg/gcc/' src/corelib/global/global.pri || die |
275 |
+ |
276 |
+ qt5-build_src_prepare |
277 |
+} |
278 |
+ |
279 |
+src_configure() { |
280 |
+ local myconf=( |
281 |
+ -no-feature-statx # bug 672856 |
282 |
+ $(qt_use icu) |
283 |
+ $(qt_use !icu iconv) |
284 |
+ $(qt_use systemd journald) |
285 |
+ ) |
286 |
+ qt5-build_src_configure |
287 |
+} |
288 |
+ |
289 |
+src_install() { |
290 |
+ qt5-build_src_install |
291 |
+ |
292 |
+ local flags=( |
293 |
+ DBUS FREETYPE IMAGEFORMAT_JPEG IMAGEFORMAT_PNG |
294 |
+ OPENGL OPENSSL SSL WIDGETS |
295 |
+ ) |
296 |
+ |
297 |
+ for flag in ${flags[@]}; do |
298 |
+ cat >> "${D}"/${QT5_HEADERDIR}/QtCore/qconfig.h <<- _EOF_ || die |
299 |
+ |
300 |
+ #if defined(QT_NO_${flag}) && defined(QT_${flag}) |
301 |
+ # undef QT_NO_${flag} |
302 |
+ #elif !defined(QT_NO_${flag}) && !defined(QT_${flag}) |
303 |
+ # define QT_NO_${flag} |
304 |
+ #endif |
305 |
+ _EOF_ |
306 |
+ done |
307 |
+} |