diff options
author | Fathi Boudra <fabo@debian.org> | 2007-07-30 20:32:57 +0000 |
---|---|---|
committer | Fathi Boudra <fabo@debian.org> | 2007-07-30 20:32:57 +0000 |
commit | 344467d8abf4a941efde7b31f0c195897ccc22e9 (patch) | |
tree | da6c752628013e475b5b3ad878a2b37b22e190cd | |
parent | feb570b186b23e87a94063577daa9871da9aa0f1 (diff) | |
download | qt4-x11-344467d8abf4a941efde7b31f0c195897ccc22e9.tar.gz |
* Update 01_qmake_for_debian patch. Add DEFINES += -DQT_SHARED in qmake.conf
along with the removal of link_prl. (Closes: #434019)
* Apply qt-copy patches:
* 00_0185-fix-format-strings: This patch fixes various code issues with
handling format strings. None of them seem to be exceptionally bad,
but its better safe than sorry. It is related to CVE-2007-3388.
TT claims the problem is not present in any version of Qt 4. Dirk Muller
disagrees and believes that some of them are possible to exploit.
* 00_0186-fix-component-alpha-text: This patch fixes component alpha
(LCD hinted) text when it's drawn on a non-opaque background. Qt doesn't
initialize the alpha channel in the glyph masks, which causes problems
in Konsole when transparency is enabled, and in other situations where
the background isn't fully opaque.
-rw-r--r-- | debian/changelog | 19 | ||||
-rwxr-xr-x | debian/patches/00_0185-fix-format-strings.dpatch | 271 | ||||
-rwxr-xr-x | debian/patches/00_0186-fix-component-alpha-text.dpatch | 48 | ||||
-rw-r--r-- | debian/patches/00list | 2 | ||||
-rwxr-xr-x | debian/patches/01_qmake_for_debian.dpatch | 18 |
5 files changed, 350 insertions, 8 deletions
diff --git a/debian/changelog b/debian/changelog index d42d290..5c0c2e7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,22 @@ +qt4-x11 (4.3.0-5) unstable; urgency=low + + [Fathi Boudra] + * Update 01_qmake_for_debian patch. Add DEFINES += -DQT_SHARED in qmake.conf + along with the removal of link_prl. (Closes: #434019) + * Apply qt-copy patches: + * 00_0185-fix-format-strings: This patch fixes various code issues with + handling format strings. None of them seem to be exceptionally bad, + but its better safe than sorry. It is related to CVE-2007-3388. + TT claims the problem is not present in any version of Qt 4. Dirk Muller + disagrees and believes that some of them are possible to exploit. + * 00_0186-fix-component-alpha-text: This patch fixes component alpha + (LCD hinted) text when it's drawn on a non-opaque background. Qt doesn't + initialize the alpha channel in the glyph masks, which causes problems + in Konsole when transparency is enabled, and in other situations where + the background isn't fully opaque. + + -- Fathi Boudra <fboudra@free.fr> Mon, 30 Jul 2007 21:36:25 +0200 + qt4-x11 (4.3.0-4) unstable; urgency=low [Fathi Boudra] diff --git a/debian/patches/00_0185-fix-format-strings.dpatch b/debian/patches/00_0185-fix-format-strings.dpatch new file mode 100755 index 0000000..9a6c813 --- /dev/null +++ b/debian/patches/00_0185-fix-format-strings.dpatch @@ -0,0 +1,271 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 00_0185-fix-format-strings.dpatch by Fathi Boudra <fboudra@free.fr> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad qt4-x11-4.3.0~/src/corelib/global/qglobal.h qt4-x11-4.3.0/src/corelib/global/qglobal.h +--- qt4-x11-4.3.0~/src/corelib/global/qglobal.h 2007-05-25 15:24:09.000000000 +0200 ++++ qt4-x11-4.3.0/src/corelib/global/qglobal.h 2007-07-30 22:05:17.000000000 +0200 +@@ -1261,8 +1261,16 @@ + #ifdef QT3_SUPPORT + Q_CORE_EXPORT QT3_SUPPORT void qSystemWarning(const char *msg, int code = -1); + #endif /* QT3_SUPPORT */ +-Q_CORE_EXPORT void qErrnoWarning(int code, const char *msg, ...); +-Q_CORE_EXPORT void qErrnoWarning(const char *msg, ...); ++Q_CORE_EXPORT void qErrnoWarning(int code, const char *msg, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 2, 3))) ++#endif ++ ; ++Q_CORE_EXPORT void qErrnoWarning(const char *msg, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 1, 2))) ++#endif ++ ; + + #if (defined(QT_NO_DEBUG_OUTPUT) || defined(QT_NO_TEXTSTREAM)) && !defined(QT_NO_DEBUG_STREAM) + #define QT_NO_DEBUG_STREAM +diff -urNad qt4-x11-4.3.0~/src/corelib/tools/qbytearray.h qt4-x11-4.3.0/src/corelib/tools/qbytearray.h +--- qt4-x11-4.3.0~/src/corelib/tools/qbytearray.h 2007-05-25 15:24:11.000000000 +0200 ++++ qt4-x11-4.3.0/src/corelib/tools/qbytearray.h 2007-07-30 22:05:17.000000000 +0200 +@@ -71,8 +71,16 @@ + Q_CORE_EXPORT int qstrnicmp(const char *, const char *, uint len); + + // implemented in qvsnprintf.cpp +-Q_CORE_EXPORT int qvsnprintf(char *str, size_t n, const char *fmt, va_list ap); +-Q_CORE_EXPORT int qsnprintf(char *str, size_t n, const char *fmt, ...); ++Q_CORE_EXPORT int qvsnprintf(char *str, size_t n, const char *fmt, va_list ap) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 3, 0))) ++#endif ++ ; ++Q_CORE_EXPORT int qsnprintf(char *str, size_t n, const char *fmt, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 3, 4))) ++#endif ++ ; + + #ifdef QT3_SUPPORT + inline QT3_SUPPORT void *qmemmove(void *dst, const void *src, uint len) +diff -urNad qt4-x11-4.3.0~/src/gui/painting/qprintengine_pdf.cpp qt4-x11-4.3.0/src/gui/painting/qprintengine_pdf.cpp +--- qt4-x11-4.3.0~/src/gui/painting/qprintengine_pdf.cpp 2007-05-25 15:24:13.000000000 +0200 ++++ qt4-x11-4.3.0/src/gui/painting/qprintengine_pdf.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -386,9 +386,8 @@ + object = addXrefEntry(-1); + QByteArray alphaDef; + QPdf::ByteStream s(&alphaDef); +- s << "<< /ca " << (alpha/qreal(255.)) << ">>\n"; +- xprintf(alphaDef.constData()); +- xprintf("endobj\n"); ++ s << "<< /ca " << (alpha/qreal(255.)) << ">>"; ++ xprintf("%s\nendobj\n", alphaDef.constData()); + } + currentPage->graphicStates.append(object); + return object; +diff -urNad qt4-x11-4.3.0~/src/gui/painting/qprintengine_pdf_p.h qt4-x11-4.3.0/src/gui/painting/qprintengine_pdf_p.h +--- qt4-x11-4.3.0~/src/gui/painting/qprintengine_pdf_p.h 2007-05-25 15:24:13.000000000 +0200 ++++ qt4-x11-4.3.0/src/gui/painting/qprintengine_pdf_p.h 2007-07-30 22:05:17.000000000 +0200 +@@ -148,7 +148,11 @@ + void writePage(); + + int addXrefEntry(int object, bool printostr = true); +- void xprintf(const char* fmt, ...); ++ void xprintf(const char* fmt, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 2, 3))) ++#endif ++ ; + inline void write(const QByteArray &data) { + stream->writeRawData(data.constData(), data.size()); + streampos += data.size(); +diff -urNad qt4-x11-4.3.0~/src/qt3support/tools/q3cstring.h qt4-x11-4.3.0/src/qt3support/tools/q3cstring.h +--- qt4-x11-4.3.0~/src/qt3support/tools/q3cstring.h 2007-05-25 15:24:21.000000000 +0200 ++++ qt4-x11-4.3.0/src/qt3support/tools/q3cstring.h 2007-07-30 22:05:17.000000000 +0200 +@@ -57,7 +57,11 @@ + } + + Q3CString copy() const { return *this; } +- Q3CString &sprintf(const char *format, ...); ++ Q3CString &sprintf(const char *format, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 2, 3))) ++#endif ++ ; + + Q3CString left(uint len) const { return QByteArray::left(len); } + Q3CString right(uint len) const { return QByteArray::right(len); } +diff -urNad qt4-x11-4.3.0~/src/qt3support/tools/q3gcache.cpp qt4-x11-4.3.0/src/qt3support/tools/q3gcache.cpp +--- qt4-x11-4.3.0~/src/qt3support/tools/q3gcache.cpp 2007-05-25 15:24:20.000000000 +0200 ++++ qt4-x11-4.3.0/src/qt3support/tools/q3gcache.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -622,7 +622,7 @@ + #if defined(QT_DEBUG) + QString line; + line.fill(QLatin1Char('*'), 80); +- qDebug(line.ascii()); ++ qDebug("%s", line.ascii()); + qDebug("CACHE STATISTICS:"); + qDebug("cache contains %d item%s, with a total cost of %d", + count(), count() != 1 ? "s" : "", tCost); +@@ -643,7 +643,7 @@ + lruList->dumps != 1 ? "have" : "has", lruList->dumpCosts); + qDebug("Statistics from internal dictionary class:"); + dict->statistics(); +- qDebug(line.ascii()); ++ qDebug("%s", line.ascii()); + #endif + } + +diff -urNad qt4-x11-4.3.0~/src/qt3support/tools/q3gdict.cpp qt4-x11-4.3.0/src/qt3support/tools/q3gdict.cpp +--- qt4-x11-4.3.0~/src/qt3support/tools/q3gdict.cpp 2007-05-25 15:24:20.000000000 +0200 ++++ qt4-x11-4.3.0/src/qt3support/tools/q3gdict.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -828,11 +828,11 @@ + QString line; + line.fill(QLatin1Char('-'), 60); + double real, ideal; +- qDebug(line.ascii()); ++ qDebug("%s", line.ascii()); + qDebug("DICTIONARY STATISTICS:"); + if (count() == 0) { + qDebug("Empty!"); +- qDebug(line.ascii()); ++ qDebug("%s", line.ascii()); + return; + } + real = 0.0; +@@ -853,7 +853,7 @@ + while (b--) + *pbuf++ = '*'; + *pbuf = '\0'; +- qDebug(buf); ++ qDebug("%s", buf); + i++; + } + qDebug("Array size = %d", size()); +@@ -861,7 +861,7 @@ + qDebug("Real dist = %g", real); + qDebug("Rand dist = %g", ideal); + qDebug("Real/Rand = %g", real/ideal); +- qDebug(line.ascii()); ++ qDebug("%s", line.ascii()); + #endif // QT_DEBUG + } + +diff -urNad qt4-x11-4.3.0~/tools/assistant/config.cpp qt4-x11-4.3.0/tools/assistant/config.cpp +--- qt4-x11-4.3.0~/tools/assistant/config.cpp 2007-05-25 15:24:32.000000000 +0200 ++++ qt4-x11-4.3.0/tools/assistant/config.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -73,12 +73,12 @@ + + QFile file(profileFileName); + if (!file.exists()) { +- qWarning( (QLatin1String("File does not exist: ") + profileFileName).toAscii().constData() ); ++ qWarning( "File does not exist: %s", qPrintable(profileFileName) ); + return 0; + } + DocuParser *parser = DocuParser::createParser( profileFileName ); + if (!parser) { +- qWarning( (QLatin1String("Failed to create parser for file: ") + profileFileName).toAscii().constData() ); ++ qWarning( "Failed to create parser for file: %s", qPrintable(profileFileName) ); + return 0; + } + if (parser->parserVersion() < DocuParser::Qt320) { +@@ -89,7 +89,7 @@ + parser->parse(&file); + config->profil = profileParser->profile(); + if (!config->profil) { +- qWarning( (QLatin1String("Config::loadConfig(), no profile in: ") + profileFileName).toAscii().constData() ); ++ qWarning( "Config::loadConfig(), no profile in: %s", qPrintable(profileFileName) ); + return 0; + } + config->profil->setProfileType(Profile::UserProfile); +diff -urNad qt4-x11-4.3.0~/tools/assistant/index.cpp qt4-x11-4.3.0/tools/assistant/index.cpp +--- qt4-x11-4.3.0~/tools/assistant/index.cpp 2007-05-25 15:24:31.000000000 +0200 ++++ qt4-x11-4.3.0/tools/assistant/index.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -180,7 +180,7 @@ + { + QFile file( filename ); + if ( !file.open(QFile::ReadOnly) ) { +- qWarning( (QLatin1String("can not open file ") + filename).toAscii().constData() ); ++ qWarning( "can not open file %s", qPrintable(filename) ); + return; + } + +@@ -352,7 +352,7 @@ + + QFile file( fileName ); + if ( !file.open( QFile::ReadOnly ) ) { +- qWarning( (QLatin1String("cannot open file ") + fileName).toAscii().constData() ); ++ qWarning( "cannot open file %s", qPrintable(fileName) ); + return fileName; + } + QTextStream s( &file ); +@@ -474,7 +474,7 @@ + QString fName = url.toLocalFile(); + QFile file( fName ); + if ( !file.open( QFile::ReadOnly ) ) { +- qWarning( (QLatin1String("cannot open file ") + fName).toAscii().constData() ); ++ qWarning( "cannot open file %s", qPrintable(fName) ); + return false; + } + +diff -urNad qt4-x11-4.3.0~/tools/designer/src/lib/shared/qdesigner_utils.cpp qt4-x11-4.3.0/tools/designer/src/lib/shared/qdesigner_utils.cpp +--- qt4-x11-4.3.0~/tools/designer/src/lib/shared/qdesigner_utils.cpp 2007-05-25 15:25:01.000000000 +0200 ++++ qt4-x11-4.3.0/tools/designer/src/lib/shared/qdesigner_utils.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -40,9 +40,7 @@ + { + QDESIGNER_SHARED_EXPORT void designerWarning(const QString &message) + { +- QString prefixedMessage = QLatin1String("Designer: "); +- prefixedMessage += message; +- qWarning(prefixedMessage.toUtf8().constData()); ++ qWarning("Designer: %s", qPrintable(message)); + } + + QString EnumType::id() const +diff -urNad qt4-x11-4.3.0~/tools/designer/src/lib/uilib/formbuilderextra.cpp qt4-x11-4.3.0/tools/designer/src/lib/uilib/formbuilderextra.cpp +--- qt4-x11-4.3.0~/tools/designer/src/lib/uilib/formbuilderextra.cpp 2007-05-25 15:25:01.000000000 +0200 ++++ qt4-x11-4.3.0/tools/designer/src/lib/uilib/formbuilderextra.cpp 2007-07-30 22:05:17.000000000 +0200 +@@ -33,9 +33,7 @@ + #endif + + void uiLibWarning(const QString &message) { +- QString prefixedMessage = QLatin1String("Designer: "); +- prefixedMessage += message; +- qWarning(prefixedMessage.toUtf8().constData()); ++ qWarning("Designer: %s", qPrintable(message)); + } + + QFormBuilderExtra::QFormBuilderExtra() : +diff -urNad qt4-x11-4.3.0~/tools/linguist/shared/profileevaluator.h qt4-x11-4.3.0/tools/linguist/shared/profileevaluator.h +--- qt4-x11-4.3.0~/tools/linguist/shared/profileevaluator.h 2007-05-25 15:24:24.000000000 +0200 ++++ qt4-x11-4.3.0/tools/linguist/shared/profileevaluator.h 2007-07-30 22:05:17.000000000 +0200 +@@ -88,7 +88,11 @@ + + private: + void logMessage(const QString &msg, MessageType mt = MT_DebugLevel2); +- void logMessage(MessageType mt, const char *msg, ...); ++ void logMessage(MessageType mt, const char *msg, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 3, 4))) ++#endif ++ ; + QString expandVariableReferences(const QString &value); + QString evaluateExpandFunction(const QByteArray &func, const QString &arguments); + +diff -urNad qt4-x11-4.3.0~/tools/qtestlib/src/qtest_global.h qt4-x11-4.3.0/tools/qtestlib/src/qtest_global.h +--- qt4-x11-4.3.0~/tools/qtestlib/src/qtest_global.h 2007-05-25 15:24:23.000000000 +0200 ++++ qt4-x11-4.3.0/tools/qtestlib/src/qtest_global.h 2007-07-30 22:05:17.000000000 +0200 +@@ -59,7 +59,11 @@ + enum SkipMode { SkipSingle = 1, SkipAll = 2 }; + enum TestFailMode { Abort = 1, Continue = 2 }; + +- int Q_TESTLIB_EXPORT qt_snprintf(char *str, int size, const char *format, ...); ++ int Q_TESTLIB_EXPORT qt_snprintf(char *str, int size, const char *format, ...) ++#if defined(Q_CC_GNU) && !defined(__INSURE__) ++ __attribute__ ((format (printf, 3, 4))) ++#endif ++ ; + } + + QT_END_HEADER diff --git a/debian/patches/00_0186-fix-component-alpha-text.dpatch b/debian/patches/00_0186-fix-component-alpha-text.dpatch new file mode 100755 index 0000000..d341908 --- /dev/null +++ b/debian/patches/00_0186-fix-component-alpha-text.dpatch @@ -0,0 +1,48 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 00_0186-fix-component-alpha-text.diff.dpatch by Fathi Boudra <fboudra@free.fr> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad qt4-x11-4.3.0~/src/gui/text/qfontengine_ft.cpp qt4-x11-4.3.0/src/gui/text/qfontengine_ft.cpp +--- qt4-x11-4.3.0~/src/gui/text/qfontengine_ft.cpp 2007-05-25 15:24:14.000000000 +0200 ++++ qt4-x11-4.3.0/src/gui/text/qfontengine_ft.cpp 2007-07-30 21:58:21.000000000 +0200 +@@ -699,7 +699,8 @@ + uint red = src[x]; + uint green = src[x+1]; + uint blue = src[x+2]; +- uint res = (red << 16) + (green << 8) + blue; ++ uint alpha = green; ++ uint res = (alpha << 24) + (red << 16) + (green << 8) + blue; + *dd = res; + ++dd; + } +@@ -713,7 +714,8 @@ + uint blue = src[x]; + uint green = src[x+1]; + uint red = src[x+2]; +- uint res = (red << 16) + (green << 8) + blue; ++ uint alpha = green; ++ uint res = (alpha << 24) + (red << 16) + (green << 8) + blue; + *dd = res; + ++dd; + } +@@ -737,7 +739,7 @@ + uint high = (red*subpixel_filter[0][0] + green*subpixel_filter[0][1] + blue*subpixel_filter[0][2]) >> 8; + uint mid = (red*subpixel_filter[1][0] + green*subpixel_filter[1][1] + blue*subpixel_filter[1][2]) >> 8; + uint low = (red*subpixel_filter[2][0] + green*subpixel_filter[2][1] + blue*subpixel_filter[2][2]) >> 8; +- uint res = (high << 16) + (mid << 8) + low; ++ uint res = (mid << 24) + (high << 16) + (mid << 8) + low; + dst[x] = res; + } + dst += info.width; +@@ -752,7 +754,7 @@ + uint high = (red*subpixel_filter[0][0] + green*subpixel_filter[0][1] + blue*subpixel_filter[0][2]) >> 8; + uint mid = (red*subpixel_filter[1][0] + green*subpixel_filter[1][1] + blue*subpixel_filter[1][2]) >> 8; + uint low = (red*subpixel_filter[2][0] + green*subpixel_filter[2][1] + blue*subpixel_filter[2][2]) >> 8; +- uint res = (high << 16) + (mid << 8) + low; ++ uint res = (mid << 24) + (high << 16) + (mid << 8) + low; + dst[x] = res; + } + dst += info.width; diff --git a/debian/patches/00list b/debian/patches/00list index 031ad20..f21e33e 100644 --- a/debian/patches/00list +++ b/debian/patches/00list @@ -9,6 +9,8 @@ 00_0180-window-role 00_0181-qdnd-x11-fix 00_0183-qprocess-corruption +00_0185-fix-format-strings +00_0186-fix-component-alpha-text 01_qmake_for_debian 02_launch_assistant-qt4 03_launch_moc-qt4 diff --git a/debian/patches/01_qmake_for_debian.dpatch b/debian/patches/01_qmake_for_debian.dpatch index 980f19c..cf57e97 100755 --- a/debian/patches/01_qmake_for_debian.dpatch +++ b/debian/patches/01_qmake_for_debian.dpatch @@ -6,10 +6,10 @@ ## DP: that use recursively link against all indirectly-used libraries. @DPATCH@ -diff -urNad qt4-x11-4.2.1~/mkspecs/common/linux.conf qt4-x11-4.2.1/mkspecs/common/linux.conf ---- qt4-x11-4.2.1~/mkspecs/common/linux.conf 2006-10-20 11:35:09.000000000 -0400 -+++ qt4-x11-4.2.1/mkspecs/common/linux.conf 2006-10-30 22:24:57.000000000 -0500 -@@ -19,8 +19,8 @@ +diff -urNad qt4-x11-4.3.0~/mkspecs/common/linux.conf qt4-x11-4.3.0/mkspecs/common/linux.conf +--- qt4-x11-4.3.0~/mkspecs/common/linux.conf 2007-05-25 15:24:01.000000000 +0200 ++++ qt4-x11-4.3.0/mkspecs/common/linux.conf 2007-07-30 22:18:23.000000000 +0200 +@@ -23,8 +23,8 @@ QMAKE_LIBS_OPENGL_QT = -lGL QMAKE_LIBS_THREAD = -lpthread @@ -20,15 +20,17 @@ diff -urNad qt4-x11-4.2.1~/mkspecs/common/linux.conf qt4-x11-4.2.1/mkspecs/commo QMAKE_AR = ar cqs QMAKE_RANLIB = -diff -urNad qt4-x11-4.2.1~/mkspecs/linux-g++/qmake.conf qt4-x11-4.2.1/mkspecs/linux-g++/qmake.conf ---- qt4-x11-4.2.1~/mkspecs/linux-g++/qmake.conf 2006-10-20 11:35:55.000000000 -0400 -+++ qt4-x11-4.2.1/mkspecs/linux-g++/qmake.conf 2006-10-30 22:25:28.000000000 -0500 -@@ -4,7 +4,7 @@ +diff -urNad qt4-x11-4.3.0~/mkspecs/linux-g++/qmake.conf qt4-x11-4.3.0/mkspecs/linux-g++/qmake.conf +--- qt4-x11-4.3.0~/mkspecs/linux-g++/qmake.conf 2007-05-25 15:24:01.000000000 +0200 ++++ qt4-x11-4.3.0/mkspecs/linux-g++/qmake.conf 2007-07-30 22:19:35.000000000 +0200 +@@ -4,8 +4,9 @@ MAKEFILE_GENERATOR = UNIX TEMPLATE = app -CONFIG += qt warn_on release incremental link_prl +CONFIG += qt warn_on release incremental QT += core gui ++DEFINES += -DQT_SHARED QMAKE_INCREMENTAL_STYLE = sublib + include(../common/g++.conf) |