forked from pool/libqt5-qtbase
Accepting request 798262 from KDE:Qt:5.14
- Add patch to fix use-after-free (boo#1170582, CVE-2020-12267): * 0001-QTextMarkdownImporter-fix-use-after-free-add-fuzz-ge.patch OBS-URL: https://build.opensuse.org/request/show/798262 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libqt5-qtbase?expand=0&rev=105
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
c6eb576eeb
142
0001-QTextMarkdownImporter-fix-use-after-free-add-fuzz-ge.patch
Normal file
142
0001-QTextMarkdownImporter-fix-use-after-free-add-fuzz-ge.patch
Normal file
@ -0,0 +1,142 @@
|
|||||||
|
From 9dcf75766469dbe61c19389bae0413767360c234 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Shawn Rutledge <shawn.rutledge@qt.io>
|
||||||
|
Date: Mon, 24 Feb 2020 16:23:27 +0100
|
||||||
|
Subject: [PATCH] QTextMarkdownImporter: fix use after free; add fuzz-generated
|
||||||
|
tests
|
||||||
|
|
||||||
|
It was possible to end up with a dangling pointer in m_listStack.
|
||||||
|
This is now avoided by using QPointer and doing nullptr checks before
|
||||||
|
accessing any QTextList pointer stored there.
|
||||||
|
|
||||||
|
We have 2 specimens of garbage that caused crashes before; now they don't.
|
||||||
|
But only fuzz20450 triggered the dangling pointer in the list stack.
|
||||||
|
The crash caused by fuzz20580 was fixed by updating md4c from upstream:
|
||||||
|
4b0fc030777cd541604f5ebaaad47a2b76d61ff9
|
||||||
|
|
||||||
|
Change-Id: I8e1eca23b281256a03aea0f55e9ae20f1bdd2a38
|
||||||
|
Reviewed-by: Robert Loehning <robert.loehning@qt.io>
|
||||||
|
---
|
||||||
|
src/gui/text/qtextmarkdownimporter.cpp | 7 ++++--
|
||||||
|
src/gui/text/qtextmarkdownimporter_p.h | 2 +-
|
||||||
|
.../qtextmarkdownimporter/data/fuzz20450.md | 5 ++++
|
||||||
|
.../qtextmarkdownimporter/data/fuzz20580.md | 1 +
|
||||||
|
.../qtextmarkdownimporter.pro | 2 ++
|
||||||
|
.../tst_qtextmarkdownimporter.cpp | 24 +++++++++++++++++++
|
||||||
|
6 files changed, 38 insertions(+), 3 deletions(-)
|
||||||
|
create mode 100644 tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20450.md
|
||||||
|
create mode 100644 tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20580.md
|
||||||
|
|
||||||
|
diff --git a/src/gui/text/qtextmarkdownimporter.cpp b/src/gui/text/qtextmarkdownimporter.cpp
|
||||||
|
index 88965046ce..ea62d5c2e5 100644
|
||||||
|
--- a/src/gui/text/qtextmarkdownimporter.cpp
|
||||||
|
+++ b/src/gui/text/qtextmarkdownimporter.cpp
|
||||||
|
@@ -575,7 +575,10 @@ void QTextMarkdownImporter::insertBlock()
|
||||||
|
QTextBlockFormat blockFormat;
|
||||||
|
if (!m_listStack.isEmpty() && !m_needsInsertList && m_listItem) {
|
||||||
|
QTextList *list = m_listStack.top();
|
||||||
|
- blockFormat = list->item(list->count() - 1).blockFormat();
|
||||||
|
+ if (list)
|
||||||
|
+ blockFormat = list->item(list->count() - 1).blockFormat();
|
||||||
|
+ else
|
||||||
|
+ qWarning() << "attempted to insert into a list that no longer exists";
|
||||||
|
}
|
||||||
|
if (m_blockQuoteDepth) {
|
||||||
|
blockFormat.setProperty(QTextFormat::BlockQuoteLevel, m_blockQuoteDepth);
|
||||||
|
@@ -605,7 +608,7 @@ void QTextMarkdownImporter::insertBlock()
|
||||||
|
}
|
||||||
|
if (m_needsInsertList) {
|
||||||
|
m_listStack.push(m_cursor->createList(m_listFormat));
|
||||||
|
- } else if (!m_listStack.isEmpty() && m_listItem) {
|
||||||
|
+ } else if (!m_listStack.isEmpty() && m_listItem && m_listStack.top()) {
|
||||||
|
m_listStack.top()->add(m_cursor->block());
|
||||||
|
}
|
||||||
|
m_needsInsertList = false;
|
||||||
|
diff --git a/src/gui/text/qtextmarkdownimporter_p.h b/src/gui/text/qtextmarkdownimporter_p.h
|
||||||
|
index f450da5eb3..e3b4bcd0f2 100644
|
||||||
|
--- a/src/gui/text/qtextmarkdownimporter_p.h
|
||||||
|
+++ b/src/gui/text/qtextmarkdownimporter_p.h
|
||||||
|
@@ -113,7 +113,7 @@ private:
|
||||||
|
#endif
|
||||||
|
QString m_blockCodeLanguage;
|
||||||
|
QVector<int> m_nonEmptyTableCells; // in the current row
|
||||||
|
- QStack<QTextList *> m_listStack;
|
||||||
|
+ QStack<QPointer<QTextList>> m_listStack;
|
||||||
|
QStack<QTextCharFormat> m_spanFormatStack;
|
||||||
|
QFont m_monoFont;
|
||||||
|
QPalette m_palette;
|
||||||
|
diff --git a/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20450.md b/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20450.md
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..d7005cb01e
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20450.md
|
||||||
|
@@ -0,0 +1,5 @@
|
||||||
|
+<t>ÿ
|
||||||
|
+* ÿ
|
||||||
|
+
|
||||||
|
+ ÿ
|
||||||
|
+* ÿ
|
||||||
|
\ No newline at end of file
|
||||||
|
diff --git a/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20580.md b/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20580.md
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..22006f5876
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/auto/gui/text/qtextmarkdownimporter/data/fuzz20580.md
|
||||||
|
@@ -0,0 +1 @@
|
||||||
|
+|
--:|
<?`?><?|`
|
||||||
|
\ No newline at end of file
|
||||||
|
diff --git a/tests/auto/gui/text/qtextmarkdownimporter/qtextmarkdownimporter.pro b/tests/auto/gui/text/qtextmarkdownimporter/qtextmarkdownimporter.pro
|
||||||
|
index 7b7fb61244..f3818efbf7 100644
|
||||||
|
--- a/tests/auto/gui/text/qtextmarkdownimporter/qtextmarkdownimporter.pro
|
||||||
|
+++ b/tests/auto/gui/text/qtextmarkdownimporter/qtextmarkdownimporter.pro
|
||||||
|
@@ -5,5 +5,7 @@ SOURCES += tst_qtextmarkdownimporter.cpp
|
||||||
|
TESTDATA += \
|
||||||
|
data/thematicBreaks.md \
|
||||||
|
data/headingBulletsContinuations.md \
|
||||||
|
+ data/fuzz20450.md \
|
||||||
|
+ data/fuzz20580.md \
|
||||||
|
|
||||||
|
DEFINES += SRCDIR=\\\"$$PWD\\\"
|
||||||
|
diff --git a/tests/auto/gui/text/qtextmarkdownimporter/tst_qtextmarkdownimporter.cpp b/tests/auto/gui/text/qtextmarkdownimporter/tst_qtextmarkdownimporter.cpp
|
||||||
|
index 39a1370f6f..5eb04af696 100644
|
||||||
|
--- a/tests/auto/gui/text/qtextmarkdownimporter/tst_qtextmarkdownimporter.cpp
|
||||||
|
+++ b/tests/auto/gui/text/qtextmarkdownimporter/tst_qtextmarkdownimporter.cpp
|
||||||
|
@@ -57,6 +57,8 @@ private slots:
|
||||||
|
void lists();
|
||||||
|
void avoidBlankLineAtBeginning_data();
|
||||||
|
void avoidBlankLineAtBeginning();
|
||||||
|
+ void pathological_data();
|
||||||
|
+ void pathological();
|
||||||
|
};
|
||||||
|
|
||||||
|
void tst_QTextMarkdownImporter::headingBulletsContinuations()
|
||||||
|
@@ -256,5 +258,27 @@ void tst_QTextMarkdownImporter::avoidBlankLineAtBeginning() // QTBUG-81060
|
||||||
|
QCOMPARE(i, expectedNumberOfParagraphs);
|
||||||
|
}
|
||||||
|
|
||||||
|
+void tst_QTextMarkdownImporter::pathological_data()
|
||||||
|
+{
|
||||||
|
+ QTest::addColumn<QString>("warning");
|
||||||
|
+ QTest::newRow("fuzz20450") << "attempted to insert into a list that no longer exists";
|
||||||
|
+ QTest::newRow("fuzz20580") << "";
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+void tst_QTextMarkdownImporter::pathological() // avoid crashing on crazy input
|
||||||
|
+{
|
||||||
|
+ QFETCH(QString, warning);
|
||||||
|
+ QString filename = QLatin1String("data/") + QTest::currentDataTag() + QLatin1String(".md");
|
||||||
|
+ QFile f(QFINDTESTDATA(filename));
|
||||||
|
+ QVERIFY(f.open(QFile::ReadOnly));
|
||||||
|
+#ifdef QT_NO_DEBUG
|
||||||
|
+ Q_UNUSED(warning)
|
||||||
|
+#else
|
||||||
|
+ if (!warning.isEmpty())
|
||||||
|
+ QTest::ignoreMessage(QtWarningMsg, warning.toLatin1());
|
||||||
|
+#endif
|
||||||
|
+ QTextDocument().setMarkdown(f.readAll());
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
QTEST_MAIN(tst_QTextMarkdownImporter)
|
||||||
|
#include "tst_qtextmarkdownimporter.moc"
|
||||||
|
--
|
||||||
|
2.25.1
|
||||||
|
|
||||||
@ -1,3 +1,9 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Apr 27 12:45:07 UTC 2020 - Fabian Vogt <fabian@ritter-vogt.de>
|
||||||
|
|
||||||
|
- Add patch to fix use-after-free (boo#1170582, CVE-2020-12267):
|
||||||
|
* 0001-QTextMarkdownImporter-fix-use-after-free-add-fuzz-ge.patch
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Jan 27 13:13:57 UTC 2020 - Fabian Vogt <fabian@ritter-vogt.de>
|
Mon Jan 27 13:13:57 UTC 2020 - Fabian Vogt <fabian@ritter-vogt.de>
|
||||||
|
|
||||||
|
|||||||
@ -66,6 +66,7 @@ Patch22: 0002-Revert-qtlite-Fix-build-libs-with-no-feature-regular.patch
|
|||||||
Patch23: 0003-Revert-White-list-more-recent-Mesa-version-for-multi.patch
|
Patch23: 0003-Revert-White-list-more-recent-Mesa-version-for-multi.patch
|
||||||
Patch24: fix-fixqt4headers.patch
|
Patch24: fix-fixqt4headers.patch
|
||||||
# patches 1000-2000 and above from upstream 5.14 branch #
|
# patches 1000-2000 and above from upstream 5.14 branch #
|
||||||
|
Patch1000: 0001-QTextMarkdownImporter-fix-use-after-free-add-fuzz-ge.patch
|
||||||
# patches 2000-3000 and above from upstream 5.15/dev branch #
|
# patches 2000-3000 and above from upstream 5.15/dev branch #
|
||||||
# Not accepted yet, https://codereview.qt-project.org/c/qt/qtbase/+/255384
|
# Not accepted yet, https://codereview.qt-project.org/c/qt/qtbase/+/255384
|
||||||
Patch2001: 0002-Synthesize-Enter-LeaveEvent-for-accepted-QTabletEven.patch
|
Patch2001: 0002-Synthesize-Enter-LeaveEvent-for-accepted-QTabletEven.patch
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user