gentoo resync : 05.02.2020

3 files changed, 180 insertions, 0 deletions

diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch
new file mode 100644
index 000000000000..055794b51964
--- /dev/null
+++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch
@@ -0,0 +1,98 @@
+From 1232205e32464d90e871f39eb1e14fcf9b78a163 Mon Sep 17 00:00:00 2001
+From: Rainer Keller <Rainer.Keller@qt.io>
+Date: Tue, 27 Aug 2019 14:44:48 +0200
+Subject: [PATCH] Fix crash when text contains too many directional chars
+
+In case a text to be layouted contains more than 128 directional characters
+it causes the application to crash
+
+The function initScriptAnalysisAndIsolatePairs() collects information of
+RTL/LTR chaaracters into vector "isolatePairs". The size of the vector is
+capped to 128. Later the function generateDirectionalRuns() iterates
+the text again and tries to access items from the previously capped vector
+above the upper bound.
+
+Task-number: QTBUG-77819
+Change-Id: Ibb7bf12c12b1db22f43ff46236518da3fdeed26a
+Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
+---
+ src/gui/text/qtextengine.cpp                        | 15 +++++++--------
+ tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp | 17 +++++++++++++++++
+ 2 files changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp
+index 2da13289bfd..a7834587b1e 100644
+--- a/src/gui/text/qtextengine.cpp
++++ b/src/gui/text/qtextengine.cpp
+@@ -399,6 +399,7 @@ struct QBidiAlgorithm {
+                         analysis[i].bidiDirection = (level & 1) ? QChar::DirR : QChar::DirL;
+                     runHasContent = true;
+                     lastRunWithContent = -1;
++                    ++isolatePairPosition;
+                 }
+                 int runBeforeIsolate = runs.size();
+                 ushort newLevel = isRtl ? ((stack.top().level + 1) | 1) : ((stack.top().level + 2) & ~1);
+@@ -440,21 +441,19 @@ struct QBidiAlgorithm {
+                 doEmbed(true, true, false);
+                 break;
+             case QChar::DirLRI:
+-                Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i);
+                 doEmbed(false, false, true);
+-                ++isolatePairPosition;
+                 break;
+             case QChar::DirRLI:
+-                Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i);
+                 doEmbed(true, false, true);
+-                ++isolatePairPosition;
+                 break;
+             case QChar::DirFSI: {
+-                const auto &pair = isolatePairs.at(isolatePairPosition);
+-                Q_ASSERT(pair.start == i);
+-                bool isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft();
++                bool isRtl = false;
++                if (isolatePairPosition < isolatePairs.size()) {
++                    const auto &pair = isolatePairs.at(isolatePairPosition);
++                    Q_ASSERT(pair.start == i);
++                    isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft();
++                }
+                 doEmbed(isRtl, false, true);
+-                ++isolatePairPosition;
+                 break;
+             }
+ 
+diff --git a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
+index 9c477589f93..f0a32c2ed40 100644
+--- a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
++++ b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
+@@ -138,6 +138,7 @@ private slots:
+     void noModificationOfInputString();
+     void superscriptCrash_qtbug53911();
+     void showLineAndParagraphSeparatorsCrash();
++    void tooManyDirectionalCharctersCrash_qtbug77819();
+ 
+ private:
+     QFont testFont;
+@@ -2309,5 +2310,21 @@ void tst_QTextLayout::nbspWithFormat()
+     QCOMPARE(layout.lineAt(1).textLength(), s2.length() + 1 + s3.length());
+ }
+ 
++void tst_QTextLayout::tooManyDirectionalCharctersCrash_qtbug77819()
++{
++    QString data;
++    data += QString::fromUtf8("\xe2\x81\xa8"); // U+2068 FSI character
++    data += QString::fromUtf8("\xe2\x81\xa7"); // U+2067 RLI character
++
++    // duplicating the text
++    for (int i = 0; i < 10; i++)
++        data += data;
++
++    // Nothing to test. It must not crash in beginLayout().
++    QTextLayout tl(data);
++    tl.beginLayout();
++    tl.endLayout();
++}
++
+ QTEST_MAIN(tst_QTextLayout)
+ #include "tst_qtextlayout.moc"
+-- 
+2.16.3
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch
new file mode 100644
index 000000000000..b0e5b564e2d8
--- /dev/null
+++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0569.patch
@@ -0,0 +1,28 @@
+From bf131e8d2181b3404f5293546ed390999f760404 Mon Sep 17 00:00:00 2001
+From: Olivier Goffart <ogoffart@woboq.com>
+Date: Fri, 8 Nov 2019 11:30:40 +0100
+Subject: Do not load plugin from the $PWD
+
+I see no reason why this would make sense to look for plugins in the current
+directory. And when there are plugins there, it may actually be wrong
+
+Change-Id: I5f5aa168021fedddafce90effde0d5762cd0c4c5
+Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+---
+ src/corelib/plugin/qpluginloader.cpp | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp
+index cadff4f32b..c2443dbdda 100644
+--- a/src/corelib/plugin/qpluginloader.cpp
++++ b/src/corelib/plugin/qpluginloader.cpp
+@@ -305,7 +305,6 @@ static QString locatePlugin(const QString& fileName)
+         paths.append(fileName.left(slash)); // don't include the '/'
+     } else {
+         paths = QCoreApplication::libraryPaths();
+-        paths.prepend(QStringLiteral(".")); // search in current dir first
+     }
+ 
+     for (const QString &path : qAsConst(paths)) {
+-- 
+cgit v1.2.1
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch
new file mode 100644
index 000000000000..1f6b2dfafecc
--- /dev/null
+++ b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2020-0570.patch
@@ -0,0 +1,54 @@
+From e6f1fde24f77f63fb16b2df239f82a89d2bf05dd Mon Sep 17 00:00:00 2001
+From: Thiago Macieira <thiago.macieira@intel.com>
+Date: Fri, 10 Jan 2020 09:26:27 -0800
+Subject: QLibrary/Unix: do not attempt to load a library relative to $PWD
+
+I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to
+find libraries in a haswell/ subdir of the main path, but we only need
+to do that transformation if the library is contains at least one
+directory seprator. That is, if the user asks to load "lib/foo", then we
+should try "lib/haswell/foo" (often, the path prefix will be absolute).
+
+When the library name the user requested has no directory separators, we
+let dlopen() do the transformation for us. Testing on Linux confirms
+glibc does so:
+
+$ LD_DEBUG=libs /lib64/ld-linux-x86-64.so.2 --inhibit-cache ./qml -help |& grep Xcursor
+   1972475:     find library=libXcursor.so.1 [0]; searching
+   1972475:       trying file=/usr/lib64/haswell/avx512_1/libXcursor.so.1
+   1972475:       trying file=/usr/lib64/haswell/libXcursor.so.1
+   1972475:       trying file=/usr/lib64/libXcursor.so.1
+   1972475:     calling init: /usr/lib64/libXcursor.so.1
+   1972475:     calling fini: /usr/lib64/libXcursor.so.1 [0]
+
+Fixes: QTBUG-81272
+Change-Id: I596aec77785a4e4e84d5fffd15e89689bb91ffbb
+Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+---
+ src/corelib/plugin/qlibrary_unix.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp
+index f0de1010d7..135b82cd37 100644
+--- a/src/corelib/plugin/qlibrary_unix.cpp
++++ b/src/corelib/plugin/qlibrary_unix.cpp
+@@ -1,7 +1,7 @@
+ /****************************************************************************
+ **
+ ** Copyright (C) 2016 The Qt Company Ltd.
+-** Copyright (C) 2018 Intel Corporation
++** Copyright (C) 2020 Intel Corporation
+ ** Contact: https://www.qt.io/licensing/
+ **
+ ** This file is part of the QtCore module of the Qt Toolkit.
+@@ -218,6 +218,8 @@ bool QLibraryPrivate::load_sys()
+         for(int suffix = 0; retry && !pHnd && suffix < suffixes.size(); suffix++) {
+             if (!prefixes.at(prefix).isEmpty() && name.startsWith(prefixes.at(prefix)))
+                 continue;
++            if (path.isEmpty() && prefixes.at(prefix).contains(QLatin1Char('/')))
++                continue;
+             if (!suffixes.at(suffix).isEmpty() && name.endsWith(suffixes.at(suffix)))
+                 continue;
+             if (loadHints & QLibrary::LoadArchiveMemberHint) {
+-- 
+cgit v1.2.1