diff --git a/qt5-qtwebkit-5.212.0-CVE-2026-84635.patch b/qt5-qtwebkit-5.212.0-CVE-2026-84635.patch new file mode 100644 index 0000000000000000000000000000000000000000..55bbde1d0e32b3a95bd32300023161885de4fef2 --- /dev/null +++ b/qt5-qtwebkit-5.212.0-CVE-2026-84635.patch @@ -0,0 +1,95 @@ +From 9654ed7d9e3db5a2d34b5b0de7e6ba054cd53dd5 Mon Sep 17 00:00:00 2001 +From: Sosuke Suzuki +Date: Thu, 26 Mar 2026 00:07:14 -0700 +Subject: [PATCH] [JSC] TypedArray `[[Set]]` should check receiver before + writing to typed array https://bugs.webkit.org/show_bug.cgi?id=310457 + +Reviewed by Yusuke Suzuki. + +Implement the receiver check in TypedArray [[Set]] introduced by +https://github.com/tc39/ecma262/pull/1556. When Receiver differs from +the typed array, we should fall back to OrdinarySet for valid indices +and return true without coercion for invalid indices. + +This is the indexed [[Set]] follow-up to Bug 217916, which fixed +non-index property names. + +1. JSGenericTypedArrayView::put checks isThisValueAltered and falls + back to ordinarySetSlow for valid indices, or returns true for + invalid indices. +2. ordinarySetWithOwnDescriptor delegates to the typed array's put + when found in the prototype chain. +3. attemptToInterceptPutByIndexOnHoleForPrototype stops walking at + a typed array, intercepting invalid indices and letting the caller + write to the receiver for valid indices. + +Also update JSTests/stress/reflect-set.js to the new spec behavior. + +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +Canonical link: https://commits.webkit.org/309967@main +--- + 2 files changed, 33 insertions(+) + +diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h +index 4dac83b..9e971b3 100644 +--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h ++++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h +@@ -32,6 +32,7 @@ + #include "ExceptionHelpers.h" + #include "JSArrayBuffer.h" + #include "JSGenericTypedArrayView.h" ++#include "PropertyDescriptor.h" + #include "Reject.h" + #include "TypedArrays.h" + +@@ -310,7 +311,28 @@ void JSGenericTypedArrayView::put( + { + JSGenericTypedArrayView* thisObject = jsCast(cell); + ++ // https://tc39.es/ecma262/#sec-typedarray-set + if (Optional index = parseIndex(propertyName)) { ++ if (slot.thisValue() != JSValue(thisObject)) { ++ // The receiver is not this typed array, so the write must not land on the ++ // typed array: fall back to an ordinary [[Set]] onto the receiver instead. ++ if (thisObject->isNeutered() || !thisObject->canSetIndexQuickly(index.value())) ++ return; ++ JSObject* receiver = jsDynamicCast(slot.thisValue()); ++ if (!receiver) ++ return; ++ PropertyDescriptor existingDescriptor; ++ if (receiver->getOwnPropertyDescriptor(exec, propertyName, existingDescriptor)) { ++ if (existingDescriptor.isAccessorDescriptor() || !existingDescriptor.writable()) ++ return; ++ PropertyDescriptor valueDescriptor; ++ valueDescriptor.setValue(value); ++ receiver->methodTable()->defineOwnProperty(receiver, exec, propertyName, valueDescriptor, slot.isStrictMode()); ++ return; ++ } ++ receiver->methodTable()->defineOwnProperty(receiver, exec, propertyName, PropertyDescriptor(value, 0), slot.isStrictMode()); ++ return; ++ } + putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode()); + return; + } +diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp +index 3ac4317..1987322 100644 +--- a/Source/JavaScriptCore/runtime/JSObject.cpp ++++ b/Source/JavaScriptCore/runtime/JSObject.cpp +@@ -1920,6 +1920,17 @@ bool JSObject::attemptToInterceptPutByIndexOnHoleForPrototype(ExecState* exec, J + // we're after rather than intercepting it via an override of JSObject::put(), and + // (b) that property is declared as ReadOnly or Accessor. + ++ // A typed array must not be written through when it is only reached via the ++ // prototype chain: an out-of-bounds index is intercepted, while a valid index is ++ // left to the caller so that it writes to the receiver instead. ++ // https://tc39.es/ecma262/#sec-typedarray-set ++ if (isTypedView(current->classInfo()->typedArrayStorageType)) { ++ JSArrayBufferView* typedArray = jsCast(current); ++ if (i >= typedArray->length()) ++ return true; ++ return false; ++ } ++ + ArrayStorage* storage = current->arrayStorageOrNull(); + if (storage && storage->m_sparseMap) { + SparseArrayValueMap::iterator iter = storage->m_sparseMap->find(i); diff --git a/qt5-qtwebkit.spec b/qt5-qtwebkit.spec index 0d6e96703c3f55e7c0ffc42911e00ecb834b5975..6e3fccb1768161f135f678e1f96ad0b5ecb4a0ea 100644 --- a/qt5-qtwebkit.spec +++ b/qt5-qtwebkit.spec @@ -15,13 +15,15 @@ Name: qt5-%{qt_module} Version: 5.212.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Qt5 - QtWebKit components License: LGPL-2.0-only AND BSD-3-Clause URL: https://github.com/qtwebkit/qtwebkit Source0: https://github.com/qtwebkit/qtwebkit/releases/download/%{qt_module}-%{version}%{?prerel_tag}/%{qt_module}-%{version}%{?prerel_tag}.tar.xz +Patch0001: qt5-qtwebkit-5.212.0-CVE-2026-84635.patch + Patch2: qtwebkit-5.212.0_cmake_cmp0071.patch Patch3: qtwebkit-5.212.0-json.patch Patch4: qtwebkit-bison37.patch @@ -216,6 +218,10 @@ test -z "$(pkg-config --cflags Qt5WebKit | grep Qt5WebKit)" %changelog +* Mon Sep 21 2026 PkgAgent Robot - 5.212.0-5 +- [Type] security +- [DESC] Fix CVE-2026-84635: JavaScriptCore TypedArray [[Set]] misses receiver check + * Fri Aug 15 2025 liujie - 5.212.0-4 - [Type] bugfix - [DESC] add support for loongarch