Fix CVE-2024-39936 · Pull Request !152 · src-openEuler/qt5-qtbase

Dear qt5-qtbase maintainer:

I've found qt5-qtbase latest CVE-2024-39936, is about HTTP2: Delay any communication until encrypted() can be responded to. This Commit has fixed this CVE.

HTTP2: Delay any communication until encrypted() can be responded to

We have the encrypted() signal that lets users do extra checks on the
established connection. It is emitted as BlockingQueued, so the HTTP
thread stalls until it is done emitting. Users can potentially call
abort() on the QNetworkReply at that point, which is passed as a Queued
call back to the HTTP thread. That means that any currently queued
signal emission will be processed before the abort() call is processed.

In the case of HTTP2 it is a little special since it is multiplexed and
the code is built to start requests as they are available. This means
that, while the code worked fine for HTTP1, since one connection only
has one request, it is not working for HTTP2, since we try to send more
requests in-between the encrypted() signal and the abort() call.

This patch changes the code to delay any communication until the
encrypted() signal has been emitted and processed, for HTTP2 only.
It's done by adding a few booleans, both to know that we have to return
early and so we can keep track of what events arose and what we need to
resume once enough time has passed that any abort() call must have been
processed.

Pick-to: 6.8 6.7 6.5 6.2 5.15 5.12
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

Please consider to be Merged.

Sincerely From ZhaoYu Jiang jiangzhaoyu@kylinos.cn

If you think this is not proper issue, Please visit https://gitee.com/openeuler/openEuler-Advisor.
Issues and feedbacks are welcome.

Attach Descriptions:
其他PR中的此CVE的修复代码没有考虑目前QHttpNetworkConnection的Connectiontype新增了SPDY的连接方式支持。
本次提交增补了ConnectionType为SPDY的支持以及修复代码中其他的错误。
 Q_ASSERT(connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2
        || connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2Direct);
Patch来源地址：https://codereview.qt-project.org/c/qt/qtbase/+/571601

This pull request related issue(s):
#IAB7IH

src-openEuler/qt5-qtbase .gitee-modal { width: 500px !important; }

搜索帮助

src-openEuler/qt5-qtbase