Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package qt6-base for openSUSE:Factory checked in at 2023-07-26 13:23:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/qt6-base (Old) and /work/SRC/openSUSE:Factory/.qt6-base.new.15225 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-base" Wed Jul 26 13:23:16 2023 rev:36 rq:1100023 version:6.5.2 Changes: -------- --- /work/SRC/openSUSE:Factory/qt6-base/qt6-base.changes 2023-07-08 22:47:05.263103344 +0200 +++ /work/SRC/openSUSE:Factory/.qt6-base.new.15225/qt6-base.changes 2023-07-26 13:23:54.555987113 +0200 @@ -1,0 +2,14 @@ +Thu Jul 20 08:34:44 UTC 2023 - Christophe Marin <christo...@krop.fr> + +- Use a mirror to download sources for all Qt packages. Upstream + servers are very slow since a couple weeks. +- Update to 6.5.2 + * https://www.qt.io/blog/qt-6.5.2-released-1 +- Drop patches, merged upstream: + * 0001-Schannel-Reject-certificate-not-signed-by-a-configur.patch + * 0001-Ssl-Copy-the-on-demand-cert-loading-bool-from-defaul.patch + * 0001-tabbar-fix.patch +- Add patch: + * CVE-2023-38197-qtbase-6.5.diff (boo#1213326, CVE-2023-38197) + +------------------------------------------------------------------- Old: ---- 0001-Schannel-Reject-certificate-not-signed-by-a-configur.patch 0001-Ssl-Copy-the-on-demand-cert-loading-bool-from-defaul.patch 0001-tabbar-fix.patch qtbase-everywhere-src-6.5.1.tar.xz New: ---- CVE-2023-38197-qtbase-6.5.diff qtbase-everywhere-src-6.5.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qt6-base.spec ++++++ --- /var/tmp/diff_new_pack.7dcZQj/_old 2023-07-26 13:23:57.428004446 +0200 +++ /var/tmp/diff_new_pack.7dcZQj/_new 2023-07-26 13:23:57.460004639 +0200 @@ -16,7 +16,7 @@ # -%define real_version 6.5.1 +%define real_version 6.5.2 %define short_version 6.5 %define tar_name qtbase-everywhere-src %define tar_suffix %{nil} @@ -30,18 +30,16 @@ %global with_gles 1 %endif Name: qt6-base%{?pkg_suffix} -Version: 6.5.1 +Version: 6.5.2 Release: 0 Summary: Qt 6 core components (Core, Gui, Widgets, Network...) # Legal: qtpaths is BSD-3-Clause License: LGPL-2.1-with-Qt-Company-Qt-exception-1.1 OR LGPL-3.0-only URL: https://www.qt.io -Source: https://download.qt.io/official_releases/qt/%{short_version}/%{real_version}%{tar_suffix}/submodules/%{tar_name}-%{real_version}%{tar_suffix}.tar.xz +Source: https://www.nic.funet.fi/pub/mirrors/download.qt-project.org/official_releases/qt/%{short_version}/%{real_version}%{tar_suffix}/submodules/%{tar_name}-%{real_version}%{tar_suffix}.tar.xz Source99: qt6-base-rpmlintrc # Patches 0-100 are upstream patches # -Patch0: 0001-Schannel-Reject-certificate-not-signed-by-a-configur.patch -Patch1: 0001-Ssl-Copy-the-on-demand-cert-loading-bool-from-defaul.patch -Patch2: 0001-tabbar-fix.patch +Patch0: CVE-2023-38197-qtbase-6.5.diff # Patches 100-200 are openSUSE and/or non-upstream(able) patches # Patch100: 0001-Tell-the-truth-about-private-API.patch # No need to pollute the library dir with object files, install them in the qt6 subfolder ++++++ CVE-2023-38197-qtbase-6.5.diff ++++++ >From c216c3d9859a20b3aeec985512e89316423fc3a8 Mon Sep 17 00:00:00 2001 From: Axel Spoerl <axel.spo...@qt.io> Date: Fri, 30 Jun 2023 12:43:59 +0200 Subject: [PATCH] QXmlStreamReader: Raise error on unexpected tokens QXmlStreamReader accepted multiple DOCTYPE elements, containing DTD fragments in the XML prolog, and in the XML body. Well-formed but invalid XML files - with multiple DTD fragments in prolog and body, combined with recursive entity expansions - have caused infinite loops in QXmlStreamReader. This patch implements a token check in QXmlStreamReader. A stream is allowed to start with an XML prolog. StartDocument and DOCTYPE elements are only allowed in this prolog, which may also contain ProcessingInstruction and Comment elements. As soon as anything else is seen, the prolog ends. After that, the prolog-specific elements are treated as unexpected. Furthermore, the prolog can contain at most one DOCTYPE element. Update the documentation to reflect the new behavior. Add an autotest that checks the new error cases are correctly detected, and no error is raised for legitimate input. The original OSS-Fuzz files (see bug reports) are not included in this patch for file size reasons. They have been tested manually. Each of them has more than one DOCTYPE element, causing infinite loops in recursive entity expansions. The newly implemented functionality detects those invalid DTD fragments. By raising an error, it aborts stream reading before an infinite loop occurs. Thanks to OSS-Fuzz for finding this. Fixes: QTBUG-92113 Fixes: QTBUG-95188 Change-Id: I0a082b9188b2eee50b396c4d5b1c9e1fd237bbdd Reviewed-by: Volker Hilsheimer <volker.hilshei...@qt.io> (cherry picked from commit c4301be7d5f94852e1b17f2c2989d5ca807855d4) --- diff --git a/src/corelib/serialization/qxmlstream.cpp b/src/corelib/serialization/qxmlstream.cpp index 6e34d4d..cf46d69 100644 --- a/src/corelib/serialization/qxmlstream.cpp +++ b/src/corelib/serialization/qxmlstream.cpp @@ -185,7 +185,7 @@ addData() or by waiting for it to arrive on the device(). \value UnexpectedElementError The parser encountered an element - that was different to those it expected. + or token that was different to those it expected. */ @@ -322,13 +322,34 @@ QXmlStreamReader is a well-formed XML 1.0 parser that does \e not include external parsed entities. As long as no error occurs, the - application code can thus be assured that the data provided by the - stream reader satisfies the W3C's criteria for well-formed XML. For - example, you can be certain that all tags are indeed nested and - closed properly, that references to internal entities have been - replaced with the correct replacement text, and that attributes have - been normalized or added according to the internal subset of the - DTD. + application code can thus be assured, that + \list + \li the data provided by the stream reader satisfies the W3C's + criteria for well-formed XML, + \li tokens are provided in a valid order. + \endlist + + Unless QXmlStreamReader raises an error, it guarantees the following: + \list + \li All tags are nested and closed properly. + \li References to internal entities have been replaced with the + correct replacement text. + \li Attributes have been normalized or added according to the + internal subset of the \l DTD. + \li Tokens of type \l StartDocument happen before all others, + aside from comments and processing instructions. + \li At most one DOCTYPE element (a token of type \l DTD) is present. + \li If present, the DOCTYPE appears before all other elements, + aside from StartDocument, comments and processing instructions. + \endlist + + In particular, once any token of type \l StartElement, \l EndElement, + \l Characters, \l EntityReference or \l EndDocument is seen, no + tokens of type StartDocument or DTD will be seen. If one is present in + the input stream, out of order, an error is raised. + + \note The token types \l Comment and \l ProcessingInstruction may appear + anywhere in the stream. If an error occurs while parsing, atEnd() and hasError() return true, and error() returns the error that occurred. The functions @@ -659,6 +680,7 @@ d->token = -1; return readNext(); } + d->checkToken(); return d->type; } @@ -743,6 +765,11 @@ "ProcessingInstruction" ); +static constexpr auto QXmlStreamReader_XmlContextString = qOffsetStringArray( + "Prolog", + "Body" +); + /*! \property QXmlStreamReader::namespaceProcessing \brief the namespace-processing flag of the stream reader. @@ -777,6 +804,15 @@ return QLatin1StringView(QXmlStreamReader_tokenTypeString.at(d->type)); } +/*! + \internal + \return \param loc (Prolog/Body) as a string. + */ +static constexpr QLatin1StringView contextString(QXmlStreamReaderPrivate::XmlContext ctxt) +{ + return QLatin1StringView(QXmlStreamReader_XmlContextString.at(static_cast<int>(ctxt))); +} + #endif // QT_NO_XMLSTREAMREADER QXmlStreamPrivateTagStack::QXmlStreamPrivateTagStack() @@ -864,6 +900,8 @@ type = QXmlStreamReader::NoToken; error = QXmlStreamReader::NoError; + currentContext = XmlContext::Prolog; + foundDTD = false; } /* @@ -3838,6 +3876,97 @@ } } +static constexpr bool isTokenAllowedInContext(QXmlStreamReader::TokenType type, + QXmlStreamReaderPrivate::XmlContext loc) +{ + switch (type) { + case QXmlStreamReader::StartDocument: + case QXmlStreamReader::DTD: + return loc == QXmlStreamReaderPrivate::XmlContext::Prolog; + + case QXmlStreamReader::StartElement: + case QXmlStreamReader::EndElement: + case QXmlStreamReader::Characters: + case QXmlStreamReader::EntityReference: + case QXmlStreamReader::EndDocument: + return loc == QXmlStreamReaderPrivate::XmlContext::Body; + + case QXmlStreamReader::Comment: + case QXmlStreamReader::ProcessingInstruction: + return true; + + case QXmlStreamReader::NoToken: + case QXmlStreamReader::Invalid: + return false; + } + + // GCC 8.x does not treat __builtin_unreachable() as constexpr +#if !defined(Q_CC_GNU_ONLY) || (Q_CC_GNU >= 900) + Q_UNREACHABLE_RETURN(false); +#else + return false; +#endif +} + +/*! + \internal + \brief QXmlStreamReader::isValidToken + \return \c true if \param type is a valid token type. + \return \c false if \param type is an unexpected token, + which indicates a non-well-formed or invalid XML stream. + */ +bool QXmlStreamReaderPrivate::isValidToken(QXmlStreamReader::TokenType type) +{ + // Don't change currentContext, if Invalid or NoToken occur in the prolog + if (type == QXmlStreamReader::Invalid || type == QXmlStreamReader::NoToken) + return false; + + // If a token type gets rejected in the body, there is no recovery + const bool result = isTokenAllowedInContext(type, currentContext); + if (result || currentContext == XmlContext::Body) + return result; + + // First non-Prolog token observed => switch context to body and check again. + currentContext = XmlContext::Body; + return isTokenAllowedInContext(type, currentContext); +} + +/*! + \internal + Checks token type and raises an error, if it is invalid + in the current context (prolog/body). + */ +void QXmlStreamReaderPrivate::checkToken() +{ + Q_Q(QXmlStreamReader); + + // The token type must be consumed, to keep track if the body has been reached. + const XmlContext context = currentContext; + const bool ok = isValidToken(type); + + // Do nothing if an error has been raised already (going along with an unexpected token) + if (error != QXmlStreamReader::Error::NoError) + return; + + if (!ok) { + raiseError(QXmlStreamReader::UnexpectedElementError, + QObject::tr("Unexpected token type %1 in %2.") + .arg(q->tokenString(), contextString(context))); + return; + } + + if (type != QXmlStreamReader::DTD) + return; + + // Raise error on multiple DTD tokens + if (foundDTD) { + raiseError(QXmlStreamReader::UnexpectedElementError, + QObject::tr("Found second DTD token in %1.").arg(contextString(context))); + } else { + foundDTD = true; + } +} + /*! \fn bool QXmlStreamAttributes::hasAttribute(QAnyStringView qualifiedName) const diff --git a/src/corelib/serialization/qxmlstream_p.h b/src/corelib/serialization/qxmlstream_p.h index 070424a..f09adaa 100644 --- a/src/corelib/serialization/qxmlstream_p.h +++ b/src/corelib/serialization/qxmlstream_p.h @@ -297,6 +297,17 @@ QStringDecoder decoder; bool atEnd; + enum class XmlContext + { + Prolog, + Body, + }; + + XmlContext currentContext = XmlContext::Prolog; + bool foundDTD = false; + bool isValidToken(QXmlStreamReader::TokenType type); + void checkToken(); + /*! \sa setType() */ diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml new file mode 100644 index 0000000..1c3ca4e --- /dev/null +++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/dtdInBody.xml @@ -0,0 +1,20 @@ +<!DOCTYPE TEST [ + <!ELEMENT TESTATTRIBUTE (CASE+)> + <!ELEMENT CASE (CLASS, FUNCTION)> + <!ELEMENT CLASS (#PCDATA)> + + <!-- adding random ENTITY statement, as this is typical DTD content --> + <!ENTITY unite "∪"> + + <!ATTLIST CASE CLASS CDATA #REQUIRED> +]> +<TEST> + <CASE> + <CLASS>tst_QXmlStream</CLASS> + </CASE> + <!-- invalid DTD in XML body follows --> + <!DOCTYPE DTDTEST [ + <!ELEMENT RESULT (CASE+)> + <!ATTLIST RESULT OUTPUT CDATA #REQUIRED> + ]> +</TEST> diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml new file mode 100644 index 0000000..cd398c0 --- /dev/null +++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/multipleDtd.xml @@ -0,0 +1,20 @@ +<!DOCTYPE TEST [ + <!ELEMENT TESTATTRIBUTE (CASE+)> + <!ELEMENT CASE (CLASS, FUNCTION, DATASET, COMMENTS)> + <!ELEMENT CLASS (#PCDATA)> + + <!-- adding random ENTITY statements, as this is typical DTD content --> + <!ENTITY iff "⇔"> + + <!ATTLIST CASE CLASS CDATA #REQUIRED> +]> +<!-- invalid second DTD follows --> +<!DOCTYPE SECOND [ + <!ELEMENT SECONDATTRIBUTE (#PCDATA)> + <!ENTITY on "∘"> +]> +<TEST> + <CASE> + <CLASS>tst_QXmlStream</CLASS> + </CASE> +</TEST> diff --git a/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml b/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml new file mode 100644 index 0000000..1b61a3f --- /dev/null +++ b/tests/auto/corelib/serialization/qxmlstream/tokenError/wellFormed.xml @@ -0,0 +1,15 @@ +<!DOCTYPE TEST [ + <!ELEMENT TESTATTRIBUTE (CASE+)> + <!ELEMENT CASE (CLASS, FUNCTION, DATASET, COMMENTS)> + <!ELEMENT CLASS (#PCDATA)> + + <!-- adding random ENTITY statements, as this is typical DTD content --> + <!ENTITY unite "∪"> + + <!ATTLIST CASE CLASS CDATA #REQUIRED> +]> +<TEST> + <CASE> + <CLASS>tst_QXmlStream</CLASS> + </CASE> +</TEST> diff --git a/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp b/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp index 2a340e1..30f5499 100644 --- a/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp +++ b/tests/auto/corelib/serialization/qxmlstream/tst_qxmlstream.cpp @@ -590,6 +590,9 @@ void entityExpansionLimit() const; + void tokenErrorHandling_data() const; + void tokenErrorHandling() const; + private: static QByteArray readFile(const QString &filename); @@ -1855,5 +1858,41 @@ QCOMPARE(reader.error(), errorType); } +void tst_QXmlStream::tokenErrorHandling_data() const +{ + QTest::addColumn<QString>("fileName"); + QTest::addColumn<QXmlStreamReader::Error>("expectedError"); + QTest::addColumn<QString>("errorKeyWord"); + + constexpr auto invalid = QXmlStreamReader::Error::UnexpectedElementError; + constexpr auto valid = QXmlStreamReader::Error::NoError; + QTest::newRow("DtdInBody") << "dtdInBody.xml" << invalid << "DTD"; + QTest::newRow("multipleDTD") << "multipleDtd.xml" << invalid << "second DTD"; + QTest::newRow("wellFormed") << "wellFormed.xml" << valid << ""; +} + +void tst_QXmlStream::tokenErrorHandling() const +{ + QFETCH(const QString, fileName); + QFETCH(const QXmlStreamReader::Error, expectedError); + QFETCH(const QString, errorKeyWord); + + const QDir dir(QFINDTESTDATA("tokenError")); + QFile file(dir.absoluteFilePath(fileName)); + + // Cross-compiling: File will be on host only + if (!file.exists()) + QSKIP("Testfile not found."); + + file.open(QIODevice::ReadOnly); + QXmlStreamReader reader(&file); + while (!reader.atEnd()) + reader.readNext(); + + QCOMPARE(reader.error(), expectedError); + if (expectedError != QXmlStreamReader::Error::NoError) + QVERIFY(reader.errorString().contains(errorKeyWord)); +} + #include "tst_qxmlstream.moc" // vim: et:ts=4:sw=4:sts=4 ++++++ qtbase-everywhere-src-6.5.1.tar.xz -> qtbase-everywhere-src-6.5.2.tar.xz ++++++ /work/SRC/openSUSE:Factory/qt6-base/qtbase-everywhere-src-6.5.1.tar.xz /work/SRC/openSUSE:Factory/.qt6-base.new.15225/qtbase-everywhere-src-6.5.2.tar.xz differ: char 26, line 1
