diff --git a/Fix-lupdate-command-error-on-loongarch64.patch b/1000-add-loongarch64-support-for-syscall_fork.patch similarity index 64% rename from Fix-lupdate-command-error-on-loongarch64.patch rename to 1000-add-loongarch64-support-for-syscall_fork.patch index 8ba3d3d9b480086b1f7cdf937a53b9a89561005d..29ed8a818e7b0b32692a63a32e8c2487daba1924 100644 --- a/Fix-lupdate-command-error-on-loongarch64.patch +++ b/1000-add-loongarch64-support-for-syscall_fork.patch @@ -1,25 +1,13 @@ -From 0621699a4b5f9bb74355eb106afb7fe68be6db2a Mon Sep 17 00:00:00 2001 -From: Jingyun Hua -Date: Thu, 8 Jun 2023 06:23:44 +0000 -Subject: [PATCH] Fix lupdate command execution error on loongarch64 - -Signed-off-by: Jingyun Hua ---- - src/3rdparty/forkfd/forkfd_linux.c | 3 ++- - src/corelib/global/qprocessordetection.h | 5 +++-- - 2 files changed, 5 insertions(+), 3 deletions(-) - diff --git a/src/3rdparty/forkfd/forkfd_linux.c b/src/3rdparty/forkfd/forkfd_linux.c -index ffe0e9a5..b1f5408d 100644 +index ffe0e9a5..1ec9fea4 100644 --- a/src/3rdparty/forkfd/forkfd_linux.c +++ b/src/3rdparty/forkfd/forkfd_linux.c -@@ -82,7 +82,8 @@ static int sys_clone(unsigned long cloneflags, int *ptid) +@@ -82,7 +82,7 @@ static int sys_clone(unsigned long cloneflags, int *ptid) return syscall(__NR_clone, cloneflags, child_stack, stack_size, ptid, newtls, ctid); #elif defined(__arc__) || defined(__arm__) || defined(__aarch64__) || defined(__mips__) || \ defined(__nds32__) || defined(__hppa__) || defined(__powerpc__) || defined(__i386__) || \ - defined(__x86_64__) || defined(__xtensa__) || defined(__alpha__) || defined(__riscv) -+ defined(__x86_64__) || defined(__xtensa__) || defined(__alpha__) || defined(__riscv) || \ -+ defined(__loongarch__) ++ defined(__x86_64__) || defined(__xtensa__) || defined(__alpha__) || defined(__riscv) || defined(__loongarch64) /* ctid and newtls are inverted on CONFIG_CLONE_BACKWARDS architectures, * but since both values are 0, there's no harm. */ return syscall(__NR_clone, cloneflags, child_stack, ptid, ctid, newtls); @@ -33,12 +21,10 @@ index ca9d4080..6f0bc7e7 100644 #elif defined(__loongarch64) -# define Q_PROCESSOR_LOONGARCH_64 -# define Q_PROCESSOR_WORDSIZE 8 -+# define Q_PROCESSOR_LOONGARCH_64 -+# define Q_PROCESSOR_WORDSIZE 8 -+# define Q_BYTE_ORDER Q_LITTLE_ENDIAN ++# define Q_PROCESSOR_LOONGARCH_64 ++# define Q_PROCESSOR_WORDSIZE 8 ++# define Q_BYTE_ORDER Q_LITTLE_ENDIAN /* MIPS family, known revisions: I, II, III, IV, 32, 64 --- -2.33.0 diff --git a/1001-add-sw_64-support-for-syscall_fork.patch b/1001-add-sw_64-support-for-syscall_fork.patch new file mode 100644 index 0000000000000000000000000000000000000000..aad6165c7cf70c47e689ef24778b900990b5d401 --- /dev/null +++ b/1001-add-sw_64-support-for-syscall_fork.patch @@ -0,0 +1,14 @@ +diff --git a/src/3rdparty/forkfd/forkfd_linux.c b/src/3rdparty/forkfd/forkfd_linux.c +index 1ec9fea4..2e9a7b68 100644 +--- a/src/3rdparty/forkfd/forkfd_linux.c ++++ b/src/3rdparty/forkfd/forkfd_linux.c +@@ -82,7 +82,8 @@ static int sys_clone(unsigned long cloneflags, int *ptid) + return syscall(__NR_clone, cloneflags, child_stack, stack_size, ptid, newtls, ctid); + #elif defined(__arc__) || defined(__arm__) || defined(__aarch64__) || defined(__mips__) || \ + defined(__nds32__) || defined(__hppa__) || defined(__powerpc__) || defined(__i386__) || \ +- defined(__x86_64__) || defined(__xtensa__) || defined(__alpha__) || defined(__riscv) || defined(__loongarch64) ++ defined(__x86_64__) || defined(__xtensa__) || defined(__alpha__) || defined(__riscv) || \ ++ defined(__loongarch64) ||defined(__sw_64__) + /* ctid and newtls are inverted on CONFIG_CLONE_BACKWARDS architectures, + * but since both values are 0, there's no harm. */ + return syscall(__NR_clone, cloneflags, child_stack, ptid, ctid, newtls); diff --git a/CVE-2023-33285.patch b/CVE-2023-33285.patch new file mode 100644 index 0000000000000000000000000000000000000000..8346573a2a3db77b43c6a511f9d83d7faa3727cc --- /dev/null +++ b/CVE-2023-33285.patch @@ -0,0 +1,73 @@ +diff --git a/src/network/kernel/qdnslookup_unix.cpp b/src/network/kernel/qdnslookup_unix.cpp +index 12b40fc3..99e999d4 100644 +--- a/src/network/kernel/qdnslookup_unix.cpp ++++ b/src/network/kernel/qdnslookup_unix.cpp +@@ -227,7 +227,6 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN + // responseLength in case of error, we still can extract the + // exact error code from the response. + HEADER *header = (HEADER*)response; +- const int answerCount = ntohs(header->ancount); + switch (header->rcode) { + case NOERROR: + break; +@@ -260,18 +259,31 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN + return; + } + +- // Skip the query host, type (2 bytes) and class (2 bytes). + char host[PACKETSZ], answer[PACKETSZ]; + unsigned char *p = response + sizeof(HEADER); +- int status = local_dn_expand(response, response + responseLength, p, host, sizeof(host)); +- if (status < 0) { ++ int status; ++ ++ if (ntohs(header->qdcount) == 1) { ++ // Skip the query host, type (2 bytes) and class (2 bytes). ++ status = local_dn_expand(response, response + responseLength, p, host, sizeof(host)); ++ if (status < 0) { ++ reply->error = QDnsLookup::InvalidReplyError; ++ reply->errorString = tr("Could not expand domain name"); ++ return; ++ } ++ if ((p - response) + status + 4 >= responseLength) ++ header->qdcount = 0xffff; // invalid reply below ++ else ++ p += status + 4; ++ } ++ if (ntohs(header->qdcount) > 1) { + reply->error = QDnsLookup::InvalidReplyError; +- reply->errorString = tr("Could not expand domain name"); ++ reply->errorString = tr("Invalid reply received"); + return; + } +- p += status + 4; + + // Extract results. ++ const int answerCount = ntohs(header->ancount); + int answerIndex = 0; + while ((p < response + responseLength) && (answerIndex < answerCount)) { + status = local_dn_expand(response, response + responseLength, p, host, sizeof(host)); +@@ -283,6 +295,11 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN + const QString name = QUrl::fromAce(host); + + p += status; ++ ++ if ((p - response) + 10 > responseLength) { ++ // probably just a truncated reply, return what we have ++ return; ++ } + const quint16 type = (p[0] << 8) | p[1]; + p += 2; // RR type + p += 2; // RR class +@@ -290,6 +307,8 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN + p += 4; + const quint16 size = (p[0] << 8) | p[1]; + p += 2; ++ if ((p - response) + size > responseLength) ++ return; // truncated + + if (type == QDnsLookup::A) { + if (size != 4) { +-- +2.27.0 + diff --git a/qt5-qtbase.spec b/qt5-qtbase.spec index 76f92eb722b7a5ce94c3044ee6fc1bdf69f17881..ec8ad8277b3e3df589757192ac1bcf2f2451ecfd 100644 --- a/qt5-qtbase.spec +++ b/qt5-qtbase.spec @@ -34,7 +34,7 @@ BuildRequires: pkgconfig(libsystemd) Name: qt5-qtbase Summary: Qt5 - QtBase components Version: 5.15.2 -Release: 9 +Release: 11 # See LGPL_EXCEPTIONS.txt, for exception details @@ -116,13 +116,18 @@ Patch0021: qt5-qtbase-Add-sw64-architecture.patch Patch0022: add-loongarch64-support.patch # https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff Patch0023: CVE-2023-24607.patch -Patch0024: Fix-lupdate-command-error-on-loongarch64.patch -Patch0025: CVE-2023-32762.patch -Patch0026: CVE-2023-32763.patch +Patch0024: CVE-2023-32762.patch +Patch0025: CVE-2023-32763.patch # https://github.com/qt/qtbase/commit/d76b11a # https://download.qt.io/official_releases/qt/5.15/CVE-2023-37369-qtbase-5.15.diff -Patch0027: CVE-2023-37369-pre.patch -Patch0028: CVE-2023-37369.patch +Patch0026: CVE-2023-37369-pre.patch +Patch0027: CVE-2023-37369.patch +Patch0028: CVE-2023-33285.patch +Patch0029: qtbase5.15-CVE-2023-34410.patch + +Patch1000: 1000-add-loongarch64-support-for-syscall_fork.patch +Patch1001: 1001-add-sw_64-support-for-syscall_fork.patch + # Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires. # Those themes are there for platform integration. If the required libraries are # not there, the platform to integrate with isn't either. Then Qt will just @@ -386,6 +391,10 @@ Qt5 libraries used for drawing widgets and OpenGL items. %patch0026 -p1 %patch0027 -p1 %patch0028 -p1 +%patch0029 -p1 +%patch1000 -p1 +%patch1001 -p1 + # move some bundled libs to ensure they're not accidentally used pushd src/3rdparty mkdir UNUSED @@ -1027,15 +1036,21 @@ fi %changelog -* Fri Sep 01 2023 wangkai <13474090681@163.com> - 5.15.2-9 +* Thu Nov 02 2023 peijiankang - 5.15.2-11 +- fix CVE-2023-34410 + +* Wed Nov 01 2023 peijiankang - 5.15.2-10 +- fix CVE-2023-33285 + +* Wed Sep 06 2023 panchenbo - 5.15.2-9 +- add loongarch64 and sw_64 syscall_fork support + +* Fri Sep 01 2023 wangkai <13474090681@163.com> - 5.15.2-8 - Fix CVE-2023-37369 -* Wed Jun 28 2023 yaoxin - 5.15.2-8 +* Wed Jun 28 2023 yaoxin - 5.15.2-7 - Fix CVE-2023-32762 and CVE-2023-32763 -* Thu Jun 08 2023 huajingyun - 5.15.2-7 -- Fix lupdate command error on loongarch64 - * Fri Apr 28 2023 douyan - 5.15.2-6 - fix CVE-2023-24607 diff --git a/qtbase5.15-CVE-2023-34410.patch b/qtbase5.15-CVE-2023-34410.patch new file mode 100644 index 0000000000000000000000000000000000000000..dd46bace4868f37b8b9bf5c7a2ce10220f4de5b2 --- /dev/null +++ b/qtbase5.15-CVE-2023-34410.patch @@ -0,0 +1,26 @@ +diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp +index fbeb9de1..6d1cdd1d 100644 +--- a/src/network/ssl/qsslsocket.cpp ++++ b/src/network/ssl/qsslsocket.cpp +@@ -2221,6 +2221,10 @@ QSslSocketPrivate::QSslSocketPrivate() + , flushTriggered(false) + { + QSslConfigurationPrivate::deepCopyDefaultConfiguration(&configuration); ++ // If the global configuration doesn't allow root certificates to be loaded ++ // on demand then we have to disable it for this socket as well. ++ if (!configuration.allowRootCertOnDemandLoading) ++ allowRootCertOnDemandLoading = false; + } + + /*! +@@ -2470,6 +2474,7 @@ void QSslConfigurationPrivate::deepCopyDefaultConfiguration(QSslConfigurationPri + ptr->sessionProtocol = global->sessionProtocol; + ptr->ciphers = global->ciphers; + ptr->caCertificates = global->caCertificates; ++ ptr->allowRootCertOnDemandLoading = global->allowRootCertOnDemandLoading; + ptr->protocol = global->protocol; + ptr->peerVerifyMode = global->peerVerifyMode; + ptr->peerVerifyDepth = global->peerVerifyDepth; +-- +2.27.0 +