From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 47B53138330 for ; Thu, 6 Oct 2016 18:33:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id B0EF0E0C26; Thu, 6 Oct 2016 18:33:42 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 8389AE0C26 for ; Thu, 6 Oct 2016 18:33:42 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id DA1503412EA for ; Thu, 6 Oct 2016 18:33:38 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 00FEA2490 for ; Thu, 6 Oct 2016 18:33:37 +0000 (UTC) From: "Michael Palimaka" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Michael Palimaka" Message-ID: <1475778807.bc4885e20e781ccef65f90991090df7d79545078.kensington@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: kde-apps/kdepimlibs/files/, kde-apps/kdepimlibs/ X-VCS-Repository: repo/gentoo X-VCS-Files: kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966.patch kde-apps/kdepimlibs/kdepimlibs-4.14.10-r1.ebuild kde-apps/kdepimlibs/kdepimlibs-4.14.11_pre20160211-r1.ebuild X-VCS-Directories: kde-apps/kdepimlibs/ kde-apps/kdepimlibs/files/ X-VCS-Committer: kensington X-VCS-Committer-Name: Michael Palimaka X-VCS-Revision: bc4885e20e781ccef65f90991090df7d79545078 X-VCS-Branch: master Date: Thu, 6 Oct 2016 18:33:37 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 1d582240-26bb-4b04-913d-90b99950bf10 X-Archives-Hash: ed014016d94166fe67d0fa412b3fdeb0 commit: bc4885e20e781ccef65f90991090df7d79545078 Author: Michael Palimaka gentoo org> AuthorDate: Thu Oct 6 18:20:46 2016 +0000 Commit: Michael Palimaka gentoo org> CommitDate: Thu Oct 6 18:33:27 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc4885e2 kde-apps/kdepimlibs: backport patch from upstream for CVE-2016-7966 Gentoo-bug: 596224 Package-Manager: portage-2.3.1 .../files/kdepimlibs-CVE-2016-7966.patch | 94 ++++++++++++++++++++++ kde-apps/kdepimlibs/kdepimlibs-4.14.10-r1.ebuild | 63 +++++++++++++++ .../kdepimlibs-4.14.11_pre20160211-r1.ebuild | 67 +++++++++++++++ 3 files changed, 224 insertions(+) diff --git a/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966.patch b/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966.patch new file mode 100644 index 00000000..b6f278a --- /dev/null +++ b/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966.patch @@ -0,0 +1,94 @@ +From 176fee25ca79145ab5c8e2275d248f1a46a8d8cf Mon Sep 17 00:00:00 2001 +From: Montel Laurent +Date: Fri, 30 Sep 2016 15:55:35 +0200 +Subject: [PATCH] Backport avoid to transform as a url when we have a quote + +--- + kpimutils/linklocator.cpp | 30 +++++++++++++++++++++++++++--- + kpimutils/linklocator.h | 3 ++- + 2 files changed, 29 insertions(+), 4 deletions(-) + +diff --git a/kpimutils/linklocator.cpp b/kpimutils/linklocator.cpp +index f5d9afd..f30e8fc 100644 +--- a/kpimutils/linklocator.cpp ++++ b/kpimutils/linklocator.cpp +@@ -95,6 +95,12 @@ int LinkLocator::maxAddressLen() const + + QString LinkLocator::getUrl() + { ++ return getUrlAndCheckValidHref(); ++} ++ ++ ++QString LinkLocator::getUrlAndCheckValidHref(bool *badurl) ++{ + QString url; + if ( atUrl() ) { + // NOTE: see http://tools.ietf.org/html/rfc3986#appendix-A and especially appendix-C +@@ -129,13 +135,26 @@ QString LinkLocator::getUrl() + + url.reserve( maxUrlLen() ); // avoid allocs + int start = mPos; ++ bool previousCharIsADoubleQuote = false; + while ( ( mPos < (int)mText.length() ) && + ( mText[mPos].isPrint() || mText[mPos].isSpace() ) && + ( ( afterUrl.isNull() && !mText[mPos].isSpace() ) || + ( !afterUrl.isNull() && mText[mPos] != afterUrl ) ) ) { + if ( !mText[mPos].isSpace() ) { // skip whitespace +- url.append( mText[mPos] ); +- if ( url.length() > maxUrlLen() ) { ++ if (mText[mPos] == QLatin1Char('>') && previousCharIsADoubleQuote) { ++ //it's an invalid url ++ if (badurl) { ++ *badurl = true; ++ } ++ return QString(); ++ } ++ if (mText[mPos] == QLatin1Char('"')) { ++ previousCharIsADoubleQuote = true; ++ } else { ++ previousCharIsADoubleQuote = false; ++ } ++ url.append( mText[mPos] ); ++ if ( url.length() > maxUrlLen() ) { + break; + } + } +@@ -367,7 +386,12 @@ QString LinkLocator::convertToHtml( const QString &plainText, int flags, + } else { + const int start = locator.mPos; + if ( !( flags & IgnoreUrls ) ) { +- str = locator.getUrl(); ++ bool badUrl = false; ++ str = locator.getUrlAndCheckValidHref(&badUrl); ++ if (badUrl) { ++ return locator.mText; ++ } ++ + if ( !str.isEmpty() ) { + QString hyperlink; + if ( str.left( 4 ) == QLatin1String("www.") ) { +diff --git a/kpimutils/linklocator.h b/kpimutils/linklocator.h +index 3049397..375498d 100644 +--- a/kpimutils/linklocator.h ++++ b/kpimutils/linklocator.h +@@ -107,6 +107,7 @@ class KPIMUTILS_EXPORT LinkLocator + @return The URL at the current scan position, or an empty string. + */ + QString getUrl(); ++ QString getUrlAndCheckValidHref(bool *badurl = 0); + + /** + Attempts to grab an email address. If there is an @ symbol at the +@@ -155,7 +156,7 @@ class KPIMUTILS_EXPORT LinkLocator + */ + static QString pngToDataUrl( const QString & iconPath ); + +- protected: ++protected: + /** + The plaintext string being scanned for URLs and email addresses. + */ +-- +2.7.3 + diff --git a/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r1.ebuild b/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r1.ebuild new file mode 100644 index 00000000..4275aaa --- /dev/null +++ b/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r1.ebuild @@ -0,0 +1,63 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 + +KDE_HANDBOOK="optional" +CPPUNIT_REQUIRED="optional" +EGIT_BRANCH="KDE/4.14" +inherit kde4-base + +DESCRIPTION="Common library for KDE PIM apps" +KEYWORDS="~amd64 ~arm ~x86 ~amd64-linux ~x86-linux" +LICENSE="LGPL-2.1" +IUSE="debug ldap prison" + +# some akonadi tests timeout, that probaly needs more work as its ~700 tests +RESTRICT="test" + +DEPEND=" + !kde-misc/akonadi-social-utils + >=app-crypt/gpgme-1.1.6 + >=app-office/akonadi-server-1.12.90[qt4(+)] + >=dev-libs/boost-1.35.0-r5:= + dev-libs/libgpg-error + >=dev-libs/libical-0.48-r2:= + dev-libs/cyrus-sasl + >=dev-libs/qjson-0.8.1 + media-libs/phonon[qt4] + x11-misc/shared-mime-info + prison? ( media-libs/prison:4 ) + ldap? ( net-nds/openldap ) +" +# boost is not linked to, but headers which include it are installed +# bug #418071 +RDEPEND="${DEPEND} + !=kde-apps/kdepim-runtime-4.10* + !=kde-apps/kdepim-runtime-4.11* + !