fix CVE-2023-32573

(cherry picked from commit 3952bd2f0668b81c3c317cf2cf4d5e930b639b5d)
2023-08-22 09:37:23 +08:00 · 2023-08-22 09:37:23 +08:00 · f457d3d6c1
commit f457d3d6c1
parent 2f8f9252a3
3 changed files with 182 additions and 3 deletions
--- a/CVE-2023-32573.patch
+++ b/CVE-2023-32573.patch
@ -0,0 +1,34 @@
+diff -up qt-everywhere-opensource-src-4.8.7/src/svg/qsvgfont_p.h.me qt-everywhere-opensource-src-4.8.7/src/svg/qsvgfont_p.h
+--- qt-everywhere-opensource-src-4.8.7/src/svg/qsvgfont_p.h.me	2023-05-18 14:45:36.239081107 +0200
+++ qt-everywhere-opensource-src-4.8.7/src/svg/qsvgfont_p.h	2023-05-18 14:47:11.440869275 +0200
+@@ -78,6 +78,7 @@ public:
+ class QSvgFont : public QSvgRefCounted
+ {
+ public:
+    static const qreal DEFAULT_UNITS_PER_EM = 1000;
+     QSvgFont(qreal horizAdvX);
+ 
+     void setFamilyName(const QString &name);
+@@ -90,9 +91,7 @@ public:
+     void draw(QPainter *p, const QPointF &point, const QString &str, qreal pixelSize, Qt::Alignment alignment) const;
+ public:
+     QString m_familyName;
+-    qreal m_unitsPerEm;
+-    qreal m_ascent;
+-    qreal m_descent;
+    qreal m_unitsPerEm = DEFAULT_UNITS_PER_EM;
+     qreal m_horizAdvX;
+     QHash<QChar, QSvgGlyph> m_glyphs;
+ };
+diff -up qt-everywhere-opensource-src-4.8.7/src/svg/qsvghandler.cpp.me qt-everywhere-opensource-src-4.8.7/src/svg/qsvghandler.cpp
+--- qt-everywhere-opensource-src-4.8.7/src/svg/qsvghandler.cpp.me	2023-05-18 14:45:24.569107055 +0200
+++ qt-everywhere-opensource-src-4.8.7/src/svg/qsvghandler.cpp	2023-05-18 14:45:10.885137479 +0200
+@@ -2571,7 +2571,7 @@ static bool parseFontFaceNode(QSvgStyleP
+ 
+     qreal unitsPerEm = toDouble(unitsPerEmStr);
+     if (!unitsPerEm)
+-        unitsPerEm = 1000;
+        unitsPerEm = QSvgFont::DEFAULT_UNITS_PER_EM;
+ 
+     if (!name.isEmpty())
+         font->setFamilyName(name);
--- a/fix-build-error-for-loongarch64.patch
+++ b/fix-build-error-for-loongarch64.patch
@ -0,0 +1,127 @@
+From a4ee1523dbcbd2e26e5c92298a612d60b204fd75 Mon Sep 17 00:00:00 2001
+From: Wenlong Zhang <zhangwenlong@loongson.cn>
+Date: Wed, 17 May 2023 07:59:00 +0000
+Subject: [PATCH] fix build error for loongarch64 test000
+
+---
+ configure                                                | 6 ++++++
+ mkspecs/linux-g++-64/qmake.conf                          | 4 ++--
+ mkspecs/solaris-g++-64/qmake.conf                        | 2 +-
+ src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h | 7 ++++++-
+ src/corelib/arch/loongarch64/arch.pri                    | 6 ++++++
+ src/corelib/arch/qatomic_arch.h                          | 2 ++
+ src/dbus/qdbusintegrator.cpp                             | 2 +-
+ 7 files changed, 24 insertions(+), 5 deletions(-)
+ create mode 100644 src/corelib/arch/loongarch64/arch.pri
+
+diff --git a/configure b/configure
+index 226a602f..d3f10f08 100755
+--- a/configure
+++ b/configure
+@@ -3273,6 +3273,12 @@ if [ -z "${CFG_HOST_ARCH}" ]; then
+             ;;
+         esac
+         ;;
+    *:*:loongarch64**)
+        if [ "$OPT_VERBOSE" = "yes" ]; then
+            echo "    LoongArch64 (loongarch64)"
+        fi
+        CFG_HOST_ARCH=loongarch64
+        ;;
+     *:*:*)
+         if [ "$OPT_VERBOSE" = "yes" ]; then
+             echo "    Trying '$UNAME_MACHINE'..."
+diff --git a/mkspecs/linux-g++-64/qmake.conf b/mkspecs/linux-g++-64/qmake.conf
+index 222f6b7e..dd129afd 100644
+--- a/mkspecs/linux-g++-64/qmake.conf
+++ b/mkspecs/linux-g++-64/qmake.conf
+@@ -12,8 +12,8 @@ CONFIG			+= qt warn_on release incremental link_prl gdb_dwarf_index
+ QT			+= core gui
+ QMAKE_INCREMENTAL_STYLE = sublib
+ 
+-QMAKE_CFLAGS		= -m64
+-QMAKE_LFLAGS		= -m64
+QMAKE_CFLAGS		= 
+QMAKE_LFLAGS		= 
+ 
+ include(../common/linux.conf)
+ include(../common/gcc-base-unix.conf)
+diff --git a/mkspecs/solaris-g++-64/qmake.conf b/mkspecs/solaris-g++-64/qmake.conf
+index 7bc7b9fd..2ecbaac8 100644
+--- a/mkspecs/solaris-g++-64/qmake.conf
+++ b/mkspecs/solaris-g++-64/qmake.conf
+@@ -36,7 +36,7 @@ QMAKE_LEX		= flex
+ QMAKE_LEXFLAGS		=
+ QMAKE_YACC		= yacc
+ QMAKE_YACCFLAGS		= -d
+-QMAKE_CFLAGS		= -m64 -D_XOPEN_SOURCE=500 -D__EXTENSIONS__
+QMAKE_CFLAGS		= -D_XOPEN_SOURCE=500 -D__EXTENSIONS__
+ QMAKE_CFLAGS_DEPS	= -M
+ QMAKE_CFLAGS_WARN_ON	= -Wall -W
+ QMAKE_CFLAGS_WARN_OFF	= -w
+diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
+index 635df39e..a9def901 100644
+--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
+@@ -236,6 +236,11 @@
+ #define WTF_CPU_X86_64 1
+ #endif
+ 
+/* CPU(LOONGARCH64) - LOONGARCH64 */
+#if defined(__loongarch64)
+#define WTF_CPU_LOONGARCH64 1
+#endif
+
+ /* CPU(ARM) - ARM, any version*/
+ #if   defined(arm) \
+     || defined(__arm__) \
+@@ -1012,7 +1017,7 @@
+     || CPU(SPARC64) \
+     || CPU(S390X) \
+     || CPU(PPC64) \
+-    || CPU(MIPS64) || CPU(AARCH64)
+    || CPU(MIPS64) || CPU(AARCH64) || CPU(LOONGARCH64)
+ #define WTF_USE_JSVALUE64 1
+ #else
+ #define WTF_USE_JSVALUE32_64 1
+diff --git a/src/corelib/arch/loongarch64/arch.pri b/src/corelib/arch/loongarch64/arch.pri
+new file mode 100644
+index 00000000..7fe8c602
+--- /dev/null
+++ b/src/corelib/arch/loongarch64/arch.pri
+@@ -0,0 +1,6 @@
+#
+# LoongArch 64 architecture
+#
+
+unix:SOURCES += ../generic/qatomic_generic_unix.cpp
+win32:SOURCES += ../generic/qatomic_generic_windows.cpp
+diff --git a/src/corelib/arch/qatomic_arch.h b/src/corelib/arch/qatomic_arch.h
+index c91c20b3..d8b5a308 100644
+--- a/src/corelib/arch/qatomic_arch.h
+++ b/src/corelib/arch/qatomic_arch.h
+@@ -96,6 +96,8 @@ QT_BEGIN_HEADER
+ #  include "QtCore/qatomic_generic.h"
+ #elif defined(QT_ARCH_AARCH64)
+ #  include "QtCore/qatomic_aarch64.h"
+#elif defined(QT_ARCH_LOONGARCH64)
+#  include "QtCore/qatomic_generic.h"
+ #else
+ #  error "Qt has not been ported to this architecture"
+ #endif
+diff --git a/src/dbus/qdbusintegrator.cpp b/src/dbus/qdbusintegrator.cpp
+index eaf3e291..10b246ca 100644
+--- a/src/dbus/qdbusintegrator.cpp
+++ b/src/dbus/qdbusintegrator.cpp
+@@ -73,7 +73,7 @@ QT_BEGIN_NAMESPACE
+ static bool isDebugging;
+ #define qDBusDebug              if (!::isDebugging); else qDebug
+ 
+-Q_GLOBAL_STATIC_WITH_ARGS(const QString, orgFreedesktopDBusString, (QLatin1String(DBUS_SERVICE_DBUS)))
+Q_GLOBAL_STATIC_WITH_ARGS(QString, orgFreedesktopDBusString, (QLatin1String(DBUS_SERVICE_DBUS)))
+ 
+ static inline QString dbusServiceString()
+ { return *orgFreedesktopDBusString(); }
+-- 
+2.33.0
+
--- a/qt.spec
+++ b/qt.spec
@ -13,7 +13,7 @@
 Name:           qt
 Epoch:          1
 Version:        4.8.7
-Release:        51
+Release:        53
 Summary:        A software toolkit for developing applications
 License:        (LGPLv2 with exceptions or GPLv3 with exceptions) and ASL 2.0 and BSD and FTL and MIT
 URL:            http://qt-project.org/
@ -73,6 +73,9 @@ Patch41:        qt-everywhere-opensource-src-4.8.5-QTBUG-35459.patch
 Patch42:        qt-everywhere-opensource-src-4.8.6-systemtrayicon.patch
 Patch43:        stack-protector.patch
 Patch44:        0001-Redo-the-Q_FOREACH-loop-control-without-GCC-statemen.patch
+%ifarch loongarch64
+Patch47:	fix-build-error-for-loongarch64.patch
+%endif
 Patch6000:      CVE-2018-19869.patch
 Patch6001:      CVE-2018-19872.patch
 Patch6002:      CVE-2018-19871.patch
@ -80,6 +83,7 @@ Patch6003:      CVE-2018-19870.patch
 Patch6004:      CVE-2018-19873.patch
 Patch6005:      CVE-2020-17507.patch
 Patch6006:      CVE-2020-0570.patch
+Patch6007:      CVE-2023-32573.patch

 BuildRequires:  cups-devel desktop-file-utils gcc-c++ libjpeg-devel findutils libmng-devel libtiff-devel pkgconfig pkgconfig(alsa)
 BuildRequires:  pkgconfig(dbus-1) pkgconfig(fontconfig) pkgconfig(glib-2.0) pkgconfig(icu-i18n) openssl-devel pkgconfig(libpng)
@ -159,8 +163,13 @@ RPM_OPT_FLAGS=`echo $RPM_OPT_FLAGS | sed 's|-fexceptions||g'`
 CXXFLAGS="$CXXFLAGS -std=gnu++98 -Wno-deprecated"

 export LD_LIBRARY_PATH=$PWD/lib/
+%ifarch loongarch64
+export CXXFLAGS="$CXXFLAGS $RPM_OPT_FLAGS -fpermissive"
+export CFLAGS="$CFLAGS $RPM_OPT_FLAGS -fpermissive"
+%else
 export CXXFLAGS="$CXXFLAGS $RPM_OPT_FLAGS"
 export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%endif
 export LDFLAGS="$LDFLAGS $RPM_LD_FLAGS"
 export PATH=$PWD/bin:$PATH
 export QTDIR=$PWD
@ -446,13 +455,22 @@ fi
 %{_qt4_prefix}/examples/

 %changelog
-* Wed 14 Oct 2020 wangyue <wangyue92@huawei.com> - 1:4.8.7-51
+* Mon Aug 21 2023 peijiankang<peijiankang@kylinos.cn> - 1:4.8.7-53
+- Type:cves
+- ID:CVE-2023-32573
+- SUG:NA
+- DESC:fix CVE-2023-32573
+
+* Mon May  8 2023 Wenlong Zhang <zhangwenlong@loongson.cn> - 1:4.8.7-52
+- add loongarch64 support for qt
+
+* Wed Oct 14 2020 wangyue <wangyue92@huawei.com> - 1:4.8.7-51
 - fix CVE-2020-0570

 * Sun Sep 20 2020 shaoqiang kang <kangshaoqiang1@huawei.com> - 1:4.8.7-50
 - fix CVE-2020-17507

-* Tue Sep 2020 shaoqiang kang <kangshaoqiang1@huawei.com> - 1:4.8.7-49
+* Wed Sep 16 2020 shaoqiang kang <kangshaoqiang1@huawei.com> - 1:4.8.7-49
 - Modify source

 * Mon May 25 2020 lizhenhua <lizhenhua12@huawei.com> - 1:4.8.7-48