From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 5E926138351 for ; Sun, 2 Feb 2020 23:24:11 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 82AF6E0872; Sun, 2 Feb 2020 23:24:10 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 58E4FE0864 for ; Sun, 2 Feb 2020 23:24:10 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 53BEB34E411 for ; Sun, 2 Feb 2020 23:24:09 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id CA1CFED for ; Sun, 2 Feb 2020 23:24:07 +0000 (UTC) From: "Andreas Sturmlechner" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Andreas Sturmlechner" Message-ID: <1580685834.2130279f2fa917a2e5ee9a29cd8413b39484897a.asturm@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: dev-qt/qtcore/, dev-qt/qtcore/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch dev-qt/qtcore/qtcore-5.12.3-r2.ebuild dev-qt/qtcore/qtcore-5.13.2-r2.ebuild X-VCS-Directories: dev-qt/qtcore/files/ dev-qt/qtcore/ X-VCS-Committer: asturm X-VCS-Committer-Name: Andreas Sturmlechner X-VCS-Revision: 2130279f2fa917a2e5ee9a29cd8413b39484897a X-VCS-Branch: master Date: Sun, 2 Feb 2020 23:24:07 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 3810f0ea-8a70-4680-8ab6-f131e866d13c X-Archives-Hash: 439725d4cce9cef87e4dc1dd747285e3 commit: 2130279f2fa917a2e5ee9a29cd8413b39484897a Author: Andreas Sturmlechner gentoo org> AuthorDate: Sun Feb 2 18:50:59 2020 +0000 Commit: Andreas Sturmlechner gentoo org> CommitDate: Sun Feb 2 23:23:54 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2130279f dev-qt/qtcore: Fix CVE-2020-0569 and CVE-2020-0570 Bug: https://bugs.gentoo.org/707354 Package-Manager: Portage-2.3.87, Repoman-2.3.20 Signed-off-by: Andreas Sturmlechner gentoo.org> .../qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch | 28 +++++++ .../qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch | 54 +++++++++++++ dev-qt/qtcore/qtcore-5.12.3-r2.ebuild | 90 ++++++++++++++++++++++ dev-qt/qtcore/qtcore-5.13.2-r2.ebuild | 89 +++++++++++++++++++++ 4 files changed, 261 insertions(+) diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch new file mode 100644 index 00000000000..b0e5b564e2d --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch @@ -0,0 +1,28 @@ +From bf131e8d2181b3404f5293546ed390999f760404 Mon Sep 17 00:00:00 2001 +From: Olivier Goffart +Date: Fri, 8 Nov 2019 11:30:40 +0100 +Subject: Do not load plugin from the $PWD + +I see no reason why this would make sense to look for plugins in the current +directory. And when there are plugins there, it may actually be wrong + +Change-Id: I5f5aa168021fedddafce90effde0d5762cd0c4c5 +Reviewed-by: Thiago Macieira +--- + src/corelib/plugin/qpluginloader.cpp | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp +index cadff4f32b..c2443dbdda 100644 +--- a/src/corelib/plugin/qpluginloader.cpp ++++ b/src/corelib/plugin/qpluginloader.cpp +@@ -305,7 +305,6 @@ static QString locatePlugin(const QString& fileName) + paths.append(fileName.left(slash)); // don't include the '/' + } else { + paths = QCoreApplication::libraryPaths(); +- paths.prepend(QStringLiteral(".")); // search in current dir first + } + + for (const QString &path : qAsConst(paths)) { +-- +cgit v1.2.1 diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch new file mode 100644 index 00000000000..1f6b2dfafec --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch @@ -0,0 +1,54 @@ +From e6f1fde24f77f63fb16b2df239f82a89d2bf05dd Mon Sep 17 00:00:00 2001 +From: Thiago Macieira +Date: Fri, 10 Jan 2020 09:26:27 -0800 +Subject: QLibrary/Unix: do not attempt to load a library relative to $PWD + +I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to +find libraries in a haswell/ subdir of the main path, but we only need +to do that transformation if the library is contains at least one +directory seprator. That is, if the user asks to load "lib/foo", then we +should try "lib/haswell/foo" (often, the path prefix will be absolute). + +When the library name the user requested has no directory separators, we +let dlopen() do the transformation for us. Testing on Linux confirms +glibc does so: + +$ LD_DEBUG=libs /lib64/ld-linux-x86-64.so.2 --inhibit-cache ./qml -help |& grep Xcursor + 1972475: find library=libXcursor.so.1 [0]; searching + 1972475: trying file=/usr/lib64/haswell/avx512_1/libXcursor.so.1 + 1972475: trying file=/usr/lib64/haswell/libXcursor.so.1 + 1972475: trying file=/usr/lib64/libXcursor.so.1 + 1972475: calling init: /usr/lib64/libXcursor.so.1 + 1972475: calling fini: /usr/lib64/libXcursor.so.1 [0] + +Fixes: QTBUG-81272 +Change-Id: I596aec77785a4e4e84d5fffd15e89689bb91ffbb +Reviewed-by: Thiago Macieira +--- + src/corelib/plugin/qlibrary_unix.cpp | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp +index f0de1010d7..135b82cd37 100644 +--- a/src/corelib/plugin/qlibrary_unix.cpp ++++ b/src/corelib/plugin/qlibrary_unix.cpp +@@ -1,7 +1,7 @@ + /**************************************************************************** + ** + ** Copyright (C) 2016 The Qt Company Ltd. +-** Copyright (C) 2018 Intel Corporation ++** Copyright (C) 2020 Intel Corporation + ** Contact: https://www.qt.io/licensing/ + ** + ** This file is part of the QtCore module of the Qt Toolkit. +@@ -218,6 +218,8 @@ bool QLibraryPrivate::load_sys() + for(int suffix = 0; retry && !pHnd && suffix < suffixes.size(); suffix++) { + if (!prefixes.at(prefix).isEmpty() && name.startsWith(prefixes.at(prefix))) + continue; ++ if (path.isEmpty() && prefixes.at(prefix).contains(QLatin1Char('/'))) ++ continue; + if (!suffixes.at(suffix).isEmpty() && name.endsWith(suffixes.at(suffix))) + continue; + if (loadHints & QLibrary::LoadArchiveMemberHint) { +-- +cgit v1.2.1 diff --git a/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild b/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild new file mode 100644 index 00000000000..a4e53c82962 --- /dev/null +++ b/dev-qt/qtcore/qtcore-5.12.3-r2.ebuild @@ -0,0 +1,90 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 +QT5_MODULE="qtbase" +inherit qt5-build + +DESCRIPTION="Cross-platform application development framework" + +if [[ ${QT5_BUILD_TYPE} == release ]]; then + KEYWORDS="~arm ~x86" +fi + +IUSE="icu systemd" + +DEPEND=" + dev-libs/double-conversion:= + dev-libs/glib:2 + dev-libs/libpcre2[pcre16,unicode] + sys-libs/zlib:= + icu? ( dev-libs/icu:= ) + !icu? ( virtual/libiconv ) + systemd? ( sys-apps/systemd:= ) +" +RDEPEND="${DEPEND} + !> "${D%/}"/${QT5_HEADERDIR}/QtCore/qconfig.h <<- _EOF_ || die + + #if defined(QT_NO_${flag}) && defined(QT_${flag}) + # undef QT_NO_${flag} + #elif !defined(QT_NO_${flag}) && !defined(QT_${flag}) + # define QT_NO_${flag} + #endif + _EOF_ + done +} diff --git a/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild b/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild new file mode 100644 index 00000000000..417c8e6a627 --- /dev/null +++ b/dev-qt/qtcore/qtcore-5.13.2-r2.ebuild @@ -0,0 +1,89 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +QT5_MODULE="qtbase" +inherit qt5-build + +DESCRIPTION="Cross-platform application development framework" + +if [[ ${QT5_BUILD_TYPE} == release ]]; then + KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +fi + +IUSE="icu systemd" + +DEPEND=" + dev-libs/double-conversion:= + dev-libs/glib:2 + dev-libs/libpcre2[pcre16,unicode] + sys-libs/zlib:= + icu? ( dev-libs/icu:= ) + !icu? ( virtual/libiconv ) + systemd? ( sys-apps/systemd:= ) +" +RDEPEND="${DEPEND} + !> "${D}"/${QT5_HEADERDIR}/QtCore/qconfig.h <<- _EOF_ || die + + #if defined(QT_NO_${flag}) && defined(QT_${flag}) + # undef QT_NO_${flag} + #elif !defined(QT_NO_${flag}) && !defined(QT_${flag}) + # define QT_NO_${flag} + #endif + _EOF_ + done +}