[arch-commits] Commit in qt/repos/extra-i686 (CVE-2009-1725.patch PKGBUILD)

[Pierre Schmitz]

    Date: Wednesday, July 29, 2009 @ 06:43:12
  Author: pierre
Revision: 47898

backport fix for FS#15706

Added:
  qt/repos/extra-i686/CVE-2009-1725.patch
    (from rev 47896, qt/repos/extra-x86_64/CVE-2009-1725.patch)
Modified:
  qt/repos/extra-i686/PKGBUILD

---------------------+
 CVE-2009-1725.patch |   26 ++++++++++++++++++++++++++
 PKGBUILD            |   11 ++++++++---
 2 files changed, 34 insertions(+), 3 deletions(-)

Copied: qt/repos/extra-i686/CVE-2009-1725.patch (from rev 47896, qt/repos/extra-x86_64/CVE-2009-1725.patch)
===================================================================
--- CVE-2009-1725.patch	                        (rev 0)
+++ CVE-2009-1725.patch	2009-07-29 10:43:12 UTC (rev 47898)
@@ -0,0 +1,26 @@
+Fixed upstream and included in Qt 4.5.3
+
+--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
++++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+@@ -867,7 +867,9 @@ HTMLTokenizer::State HTMLTokenizer::pars
+                     }
+                 } else {
+                     // FIXME: We should eventually colorize entities by sending them as a special token.
+-                    checkBuffer(11);
++                    // 12 bytes required: up to 10 bytes in m_cBuffer plus the
++                    // leading '&' and trailing ';'
++                    checkBuffer(12);
+                     *dest++ = '&';
+                     for (unsigned i = 0; i < cBufferPos; i++)
+                         dest[i] = m_cBuffer[i];
+@@ -878,7 +880,9 @@ HTMLTokenizer::State HTMLTokenizer::pars
+                     }
+                 }
+             } else {
+-                checkBuffer(10);
++                // 11 bytes required: up to 10 bytes in m_cBuffer plus the
++                // leading '&'
++                checkBuffer(11);
+                 // ignore the sequence, add it to the buffer as plaintext
+                 *dest++ = '&';
+                 for (unsigned i = 0; i < cBufferPos; i++)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2009-07-29 10:41:28 UTC (rev 47897)
+++ PKGBUILD	2009-07-29 10:43:12 UTC (rev 47898)
@@ -3,7 +3,7 @@
 
 pkgname=qt
 pkgver=4.5.2
-pkgrel=3
+pkgrel=4
 _kdeqtver=2d1727e396d5dca24ae0fb6a45d35ffc1abd0c12
 pkgdesc='A cross-platform application and UI framework'
 arch=('i686' 'x86_64')
@@ -21,14 +21,15 @@
 source=("ftp://ftp.qtsoftware.com/qt/source/${_pkgfqn}.tar.bz2"
         "ftp://ftp.archlinux.org/other/kde-qt/kde-qt-patches-${_kdeqtver}.tar.bz2"
         'assistant.desktop' 'designer.desktop' 'linguist.desktop' 'qtconfig.desktop'
-        'qdoc3.patch')
+        'qdoc3.patch' 'CVE-2009-1725.patch')
 md5sums=('28a7e8ac9805a6f614d2a27ee1a6ac9d'
          '4b333add3031f59538629b35858178d9'
          'b352b4b70faba2571af3fce5d119580a'
          '491a96682faa03407f768a53cca71db5'
          'cda7ed7e132689991dc2968a0043b4b0'
          '717669b728a0a795217d2f52969e454c'
-         '9c0a0db3569e889a54a6cddcd55c538c')
+         '9c0a0db3569e889a54a6cddcd55c538c'
+         '428fa87aab0032df1ac97f4561c6b08c')
 
 _create-kdeqt-patches() {
 	local codir=$(mktemp -d)
@@ -60,6 +61,10 @@
 
 	patch -p0 -i $srcdir/qdoc3.patch
 
+	# fix security issue FS#15706
+	# patch from svn://svn.debian.org/pkg-kde/trunk/packages/qt4-x11/debian/patches/
+	patch -p1 -i $srcdir/CVE-2009-1725.patch || return 1
+
 	sed -i "s|-O2|$CXXFLAGS|" mkspecs/common/g++.conf
 	sed -i "/^QMAKE_RPATH/s| -Wl,-rpath,||g" mkspecs/common/g++.conf