# ChangeLog for x11-libs/qt-webkit
# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/ChangeLog,v 1.84 2010/04/02 10:01:25 hwoarang Exp $
+# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/ChangeLog,v 1.85 2010/04/09 22:26:07 yngwin Exp $
+
+*qt-webkit-4.6.2-r1 (09 Apr 2010)
+*qt-webkit-4.5.3-r3 (09 Apr 2010)
+
+ 09 Apr 2010; Ben de Groot <yngwin@gentoo.org> +qt-webkit-4.5.3-r3.ebuild,
+ +files/qt-webkit-4.5.3-cve-2010-0046-css-format-mem-corruption.patch,
+ +files/qt-webkit-4.5.3-cve-2010-0049-freed-line-boxes-ltr-rtl.patch,
+ +files/qt-webkit-4.5.3-cve-2010-0050-crash-misnested-style-tags.patch,
+ +files/qt-webkit-4.5.3-cve-2010-0052-destroyed-input-cached.patch,
+ +qt-webkit-4.6.2-r1.ebuild,
+ +files/qt-webkit-4.6.2-cve-2010-0051-lax-css-parsing-cross-domain-theft.pa
+ tch,
+ +files/qt-webkit-4.6.2-cve-2010-0054-image-element-pointer-name-getter.pat
+ ch:
+ Adding security patches for bug #314193. Make dbus optional, fixes bug
+ #292337.
02 Apr 2010; Markos Chandras <hwoarang@gentoo.org> qt-webkit-4.6.2.ebuild:
Adjust phonon dependencies
AUX 30_webkit_unaligned_access.diff 4390 RMD160 2fbf2c94d140c180b33a8cf938a1add5d922e63f SHA1 4cb4fcb90d929a2e4a7484bc50a6bc7b3852a812 SHA256 2661c5c5b1811d085c5da39a6b8b107e6d0d053f24869bf8c2431b5a7fe9e0e6
+AUX qt-webkit-4.5.3-cve-2010-0046-css-format-mem-corruption.patch 1538 RMD160 68a6f90191a40bc8e96d47954fc887179fe2533f SHA1 21fea858a629dc3b8dd9980a01450a78afccedec SHA256 8a483fc7211a4f0efbd800301114a3e7a463c750c0ad36356de1a37f0af188e0
+AUX qt-webkit-4.5.3-cve-2010-0049-freed-line-boxes-ltr-rtl.patch 1462 RMD160 c603c73c693d318ecee96f7a320e7175e497f2b0 SHA1 5b2ceae1f8207db5d4b991c4f26b1bc2ee503926 SHA256 f27df3afe3cdc4aa4d84ad9be2b0eba1114d8df89f8862f2d45c387e489029d6
+AUX qt-webkit-4.5.3-cve-2010-0050-crash-misnested-style-tags.patch 827 RMD160 4d3f1db9731c924052f259c898ff7f15426cafdf SHA1 2135bcbcbd33a4a2e79501cfcfb797f9ad3f8fd4 SHA256 06e8ac92a27e89690a677c32ae136451837b14fe6b7a0ac51489543c23924feb
+AUX qt-webkit-4.5.3-cve-2010-0052-destroyed-input-cached.patch 1154 RMD160 3c5a852b465586bc2949a6ffecefeeb434410b45 SHA1 421c19382b8151a98fa2bcbb340f9b6439f5e8b4 SHA256 55cc7429ba48f1325468d60ee09adab30f902767eff6ec9eac5035f0135c5f56
AUX qt-webkit-4.5.3-no-javascript-crash.patch 845 RMD160 2026a6990409b331d6ab495c7d9bacde26f40c8d SHA1 bd5776b379d0abc486efef1e23cbd5dbfb841f03 SHA256 b48fb83915a3f75ad9cedacc06accb6e0832d21cb0762bbd3494a21be85f581b
AUX qt-webkit-4.6.0-solaris-strnstr.patch 820 RMD160 7303234fc296e5af2aa3a5e10b501776de3383b8 SHA1 e43d209055e7de4fc295a0334ac51054cd19983f SHA256 7ecb2f6317c0da2b0e986678f76f0908b0001e9fab694d5e16df922af75ec82c
+AUX qt-webkit-4.6.2-cve-2010-0051-lax-css-parsing-cross-domain-theft.patch 14652 RMD160 f2a687a2ca50c4dd6af2ebc10ab2a7fac37ab8ee SHA1 427372101ab228232340f8f9f2a1419debc33f08 SHA256 8f42ef94e4de8330874c9bde59a1c6195bb745ab737670294f2c1b391681651a
+AUX qt-webkit-4.6.2-cve-2010-0054-image-element-pointer-name-getter.patch 3911 RMD160 88c9cb5e35ef8681233ea1f21e4737cca13ff3f0 SHA1 0f0e1b6bff2870acad92f4afb46212faba76770c SHA256 c8110c0492634c1c71e0f1482f828762c75bc4f375b9571c77db919521c2f0dd
DIST qt-everywhere-opensource-src-4.6.1.tar.gz 160197277 RMD160 7365dfe3c688df36002d2c9aaef6b79ba8175402 SHA1 d3b44ae6d9bc9c44fc57f32e545b92daf0b54775 SHA256 4c84b39b8a2546854ce9c0c9f761dd55da76dab2c33eeb876e3d17db1d2ea0c5
DIST qt-everywhere-opensource-src-4.6.2.tar.gz 160601949 RMD160 5f3fea120f2dba274c4150b02162bba40b65a872 SHA1 977c10b88a2230e96868edc78a9e3789c0fcbf70 SHA256 176f51ddb06dce67ab4b2efc6b327dc21ed8f764c5d97acc15ff1f907c2affae
DIST qt-x11-opensource-src-4.5.3.tar.gz 125384668 RMD160 93d765ecf89ed15668a4eedc7d77c2a2e41424a2 SHA1 78620ffd03c83c4d86f5039ccf7b09e5c709ed25 SHA256 0c87fc42825d3556970db4412257c6874e716ac3bc45e6f273924d5d6a089aa6
EBUILD qt-webkit-4.5.3-r1.ebuild 1198 RMD160 d813f3dfcca35aa1a1d631b59d8c3917fb273a94 SHA1 41495ef0dd3f3a21d7ffcfdf84075aa36d2fc00c SHA256 423eb875cb723bff43bfb0466fb4044c1c489ad9bf39949e5868dd6437b5676f
EBUILD qt-webkit-4.5.3-r2.ebuild 1262 RMD160 6db2a597f89a4ac9fe3a7cd6ba562babd3c3ad2d SHA1 764dd726c46c670e5610f98c8889823df885daf3 SHA256 1dda47b7789640ff2a160ca327875b6dd6531d013e64d666ce09c1ff30778ff7
+EBUILD qt-webkit-4.5.3-r3.ebuild 1702 RMD160 0ff1e680dbe899795a30822d597a85347e524f67 SHA1 b9d2398418c22b76a50a18868a9002f8695e0a82 SHA256 ee4598cd1edc3b04fc0f9d65e423f0a18705e716636d3a444c449e1d831bd544
EBUILD qt-webkit-4.5.3.ebuild 1119 RMD160 9336c62e21710ef858974b33625358ec0ae367fe SHA1 1700657ca5e4e1a53d0fd0c36abb2708a433d6a5 SHA256 138038e54bdf1ca0c75a3573f5a132088ae2739402e8a06f8bca07127d338fe4
EBUILD qt-webkit-4.6.1.ebuild 1255 RMD160 298c759a15a13a9ebffe03278d5ed684bd2e7699 SHA1 561b8cfcd31ac5cf433dcfbb8fb659d1841ab641 SHA256 3159b0b4a7c3f8e7b184e8ea22ee9cb1e9f3512f09d78c19f248058bdabc73dd
+EBUILD qt-webkit-4.6.2-r1.ebuild 1848 RMD160 f2524062215537f941c3c9c4cef92d38519c331e SHA1 46a3ded32794ed13c6138581531de1f4c29c741d SHA256 e018940a5c140d7d8b830097cfae3af49e074f7c07077387a395a8bdecbc0241
EBUILD qt-webkit-4.6.2.ebuild 1316 RMD160 152bfdf60637e904d4f1f232cc27997188b88497 SHA1 205370628a1a32554da44367681da923f9c291a3 SHA256 e455f2f3d34a5d24ca37e928e31d86113865bdfe52ea172856f3e2f8d3172f7f
-MISC ChangeLog 11637 RMD160 e9f381e64c814c6399aa5d8620a90042c67e6dcf SHA1 629f02d9e7161644eaec08f43d3c4a55af056a21 SHA256 67fa3642415033bf28753d743b7a8192b9bbd4a40e4a74426030ececc614485d
+MISC ChangeLog 12347 RMD160 f19ea060fd7c9a60e875e22734f19ebd8d0b4984 SHA1 e16a7f85eb5e82506e3cf9d45209ceb8a4b3b051 SHA256 3b7d2b2c6197b8dfffc958709480e53759ff88f11df05aa80f64185c064e9c1f
MISC metadata.xml 403 RMD160 2afea624f8c9b3dba9cd2aa884ce53cbe0df67de SHA1 e34dce4d6fae80aa1e5fecdcd5e039efa36992fb SHA256 e514fc0725be75bedd69c2115c22d6562a1a889594d736c0f708103e80d6ff57
--- /dev/null
+diff -up qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/css/CSSParser.cpp.cve-2010-0046-css-format-mem-corruption qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+--- qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/css/CSSParser.cpp.cve-2010-0046-css-format-mem-corruption 2009-09-29 13:01:35.000000000 +0200
++++ qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/css/CSSParser.cpp 2010-02-04 15:00:24.778776273 +0100
+@@ -3085,6 +3085,12 @@ bool CSSParser::parseFontWeight(bool imp
+ return false;
+ }
+
++static bool isValidFormatFunction(CSSParserValue* val)
++{
++ CSSParserValueList* args = val->function->args;
++ return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
++}
++
+ bool CSSParser::parseFontFaceSrc()
+ {
+ RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
+@@ -3111,7 +3117,7 @@ bool CSSParser::parseFontFaceSrc()
+ CSSParserValue* a = args->current();
+ uriValue.clear();
+ parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
+- } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
++ } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
+ expectComma = true;
+ allowFormat = false;
+ uriValue->setFormat(args->current()->string);
--- /dev/null
+diff -up qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp.cve-2010-0049-freed-line-boxes-ltr-rtl qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+--- qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp.cve-2010-0049-freed-line-boxes-ltr-rtl 2009-09-29 13:01:36.000000000 +0200
++++ qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp 2010-02-04 15:43:15.707711730 +0100
+@@ -1025,8 +1025,15 @@ void RenderText::position(InlineBox* box
+ if (!s->m_len) {
+ // We want the box to be destroyed.
+ s->remove();
++ if (m_firstTextBox == s)
++ m_firstTextBox = s->nextTextBox();
++ else
++ s->prevTextBox()->setNextLineBox(s->nextTextBox());
++ if (m_lastTextBox == s)
++ m_lastTextBox = s->prevTextBox();
++ else
++ s->nextTextBox()->setPreviousLineBox(s->prevTextBox());
+ s->destroy(renderArena());
+- m_firstTextBox = m_lastTextBox = 0;
+ return;
+ }
+
+@@ -1203,7 +1210,7 @@ void RenderText::checkConsistency() cons
+ #ifdef CHECK_CONSISTENCY
+ const InlineTextBox* prev = 0;
+ for (const InlineTextBox* child = m_firstTextBox; child != 0; child = child->nextTextBox()) {
+- ASSERT(child->object() == this);
++ ASSERT(child->renderer() == this);
+ ASSERT(child->prevTextBox() == prev);
+ prev = child;
+ }
--- /dev/null
+diff -up qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp.cve-2010-0050-crash-misnested-style-tags qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+--- qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp.cve-2010-0050-crash-misnested-style-tags 2009-09-29 13:01:36.000000000 +0200
++++ qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp 2010-02-04 15:54:25.399651321 +0100
+@@ -1208,7 +1208,8 @@ void HTMLParser::handleResidualStyleClos
+ prevMaxElem->next = elem;
+ ASSERT(newNodePtr);
+ prevMaxElem->node = newNodePtr;
+- prevMaxElem->didRefNode = false;
++ newNodePtr->ref();
++ prevMaxElem->didRefNode = true;
+ } else
+ delete elem;
+ }
--- /dev/null
+diff -up qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp.cve-2010-0052-destroyed-input-cached qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+--- qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp.cve-2010-0052-destroyed-input-cached 2009-09-29 13:01:36.000000000 +0200
++++ qt-x11-opensource-src-4.5.3/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp 2010-02-04 17:50:07.931656712 +0100
+@@ -616,12 +616,15 @@ void HTMLInputElement::parseMappedAttrib
+ m_autocomplete = Off;
+ registerForActivationCallbackIfNeeded();
+ } else {
+- if (m_autocomplete == Off)
+- unregisterForActivationCallbackIfNeeded();
++ bool needsToUnregister = m_autocomplete == Off;
++
+ if (attr->isEmpty())
+ m_autocomplete = Uninitialized;
+ else
+ m_autocomplete = On;
++
++ if (needsToUnregister)
++ unregisterForActivationCallbackIfNeeded();
+ }
+ } else if (attr->name() == typeAttr) {
+ setInputType(attr->value());
--- /dev/null
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSGrammar.y.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSGrammar.y.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:20.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSGrammar.y 2010-02-25 17:07:29.114742034 +0100
+@@ -416,7 +416,9 @@ valid_rule:
+ ;
+
+ rule:
+- valid_rule
++ valid_rule {
++ static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
++ }
+ | invalid_rule
+ | invalid_at
+ | invalid_import
+@@ -1517,8 +1519,12 @@ invalid_rule:
+ ;
+
+ invalid_block:
+- '{' error invalid_block_list error closing_brace
+- | '{' error closing_brace
++ '{' error invalid_block_list error closing_brace {
++ static_cast<CSSParser*>(parser)->invalidBlockHit();
++ }
++ | '{' error closing_brace {
++ static_cast<CSSParser*>(parser)->invalidBlockHit();
++ }
+ ;
+
+ invalid_block_list:
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:20.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp 2010-02-25 17:13:34.292803953 +0100
+@@ -25,6 +25,7 @@
+ #include "CachedCSSStyleSheet.h"
+ #include "DocLoader.h"
+ #include "Document.h"
++#include "SecurityOrigin.h"
+ #include "MediaList.h"
+ #include "Settings.h"
+ #include <wtf/StdLibExtras.h>
+@@ -60,11 +61,21 @@ void CSSImportRule::setCSSStyleSheet(con
+ m_styleSheet->setParent(0);
+ m_styleSheet = CSSStyleSheet::create(this, url, charset);
+
++ bool crossOriginCSS = false;
++ bool validMIMEType = false;
+ CSSStyleSheet* parent = parentStyleSheet();
+ bool strict = !parent || parent->useStrictParsing();
+- String sheetText = sheet->sheetText(strict);
++ bool enforceMIMEType = strict;
++
++ String sheetText = sheet->sheetText(enforceMIMEType, &validMIMEType);
+ m_styleSheet->parseString(sheetText, strict);
+
++ if (!parent || !parent->doc() || !parent->doc()->securityOrigin()->canRequest(KURL(ParsedURLString, url)))
++ crossOriginCSS = true;
++
++ if (crossOriginCSS && !validMIMEType && !m_styleSheet->hasSyntacticallyValidCSSHeader())
++ m_styleSheet = CSSStyleSheet::create(this, url, charset);
++
+ if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+ // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+ DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-25 17:07:29.101741771 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.cpp 2010-02-25 17:07:29.117741744 +0100
+@@ -139,6 +139,7 @@ CSSParser::CSSParser(bool strictParsing)
+ , m_currentShorthand(0)
+ , m_implicitShorthand(false)
+ , m_hasFontFaceOnlyValues(false)
++ , m_hadSyntacticallyValidCSSRule(false)
+ , m_defaultNamespace(starAtom)
+ , m_data(0)
+ , yy_start(1)
+@@ -5175,6 +5176,12 @@ WebKitCSSKeyframeRule* CSSParser::create
+ return keyframePtr;
+ }
+
++void CSSParser::invalidBlockHit()
++{
++ if (m_styleSheet && !m_hadSyntacticallyValidCSSRule)
++ m_styleSheet->setHasSyntacticallyValidCSSHeader(false);
++}
++
+ static int cssPropertyID(const UChar* propertyName, unsigned length)
+ {
+ if (!length)
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.h.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.h
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.h.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:20.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSParser.h 2010-02-25 17:07:29.117741744 +0100
+@@ -191,6 +191,7 @@ namespace WebCore {
+ bool addVariableDeclarationBlock(const CSSParserString&);
+ bool checkForVariables(CSSParserValueList*);
+ void addUnresolvedProperty(int propId, bool important);
++ void invalidBlockHit();
+
+ Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
+
+@@ -212,6 +213,7 @@ namespace WebCore {
+ bool m_implicitShorthand;
+
+ bool m_hasFontFaceOnlyValues;
++ bool m_hadSyntacticallyValidCSSRule;
+
+ Vector<String> m_variableNames;
+ Vector<RefPtr<CSSValue> > m_variableValues;
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:19.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp 2010-02-25 17:07:29.118741824 +0100
+@@ -41,6 +41,7 @@ CSSStyleSheet::CSSStyleSheet(CSSStyleShe
+ , m_loadCompleted(false)
+ , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
+ , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
++ , m_hasSyntacticallyValidCSSHeader(true)
+ {
+ }
+
+@@ -52,6 +53,7 @@ CSSStyleSheet::CSSStyleSheet(Node* paren
+ , m_loadCompleted(false)
+ , m_strictParsing(false)
+ , m_isUserStyleSheet(false)
++ , m_hasSyntacticallyValidCSSHeader(true)
+ {
+ }
+
+@@ -61,6 +63,7 @@ CSSStyleSheet::CSSStyleSheet(CSSRule* ow
+ , m_charset(charset)
+ , m_loadCompleted(false)
+ , m_strictParsing(!ownerRule || ownerRule->useStrictParsing())
++ , m_hasSyntacticallyValidCSSHeader(true)
+ {
+ CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
+ m_doc = parentSheet ? parentSheet->doc() : 0;
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:20.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h 2010-02-25 17:07:29.118741824 +0100
+@@ -95,6 +95,8 @@ public:
+
+ void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
+ bool isUserStyleSheet() const { return m_isUserStyleSheet; }
++ void setHasSyntacticallyValidCSSHeader(bool b) { m_hasSyntacticallyValidCSSHeader = b; }
++ bool hasSyntacticallyValidCSSHeader() const { return m_hasSyntacticallyValidCSSHeader; }
+
+ private:
+ CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
+@@ -110,6 +112,7 @@ private:
+ bool m_loadCompleted : 1;
+ bool m_strictParsing : 1;
+ bool m_isUserStyleSheet : 1;
++ bool m_hasSyntacticallyValidCSSHeader : 1;
+ };
+
+ } // namespace
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:19.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp 2010-02-25 17:07:29.118741824 +0100
+@@ -203,7 +203,10 @@ void ProcessingInstruction::setCSSStyleS
+ #endif
+ RefPtr<CSSStyleSheet> newSheet = CSSStyleSheet::create(this, url, charset);
+ m_sheet = newSheet;
+- parseStyleSheet(sheet->sheetText());
++ // We don't need the cross-origin security check here because we are
++ // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
++ // type.
++ parseStyleSheet(sheet->sheetText(true));
+ newSheet->setTitle(m_title);
+ newSheet->setMedia(MediaList::create(newSheet.get(), m_media));
+ newSheet->setDisabled(m_alternate);
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:17.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp 2010-02-25 17:07:29.119741915 +0100
+@@ -260,14 +260,27 @@ void HTMLLinkElement::setCSSStyleSheet(c
+ bool strictParsing = !document()->inCompatMode();
+ bool enforceMIMEType = strictParsing;
+
++ bool crossOriginCSS = false;
++ bool validMIMEType = false;
+ // Check to see if we should enforce the MIME type of the CSS resource in strict mode.
+ // Running in iWeb 2 is one example of where we don't want to - <rdar://problem/6099748>
+ if (enforceMIMEType && document()->page() && !document()->page()->settings()->enforceCSSMIMETypeInStrictMode())
+ enforceMIMEType = false;
+
+- String sheetText = sheet->sheetText(enforceMIMEType);
++ String sheetText = sheet->sheetText(enforceMIMEType, &validMIMEType);
+ m_sheet->parseString(sheetText, strictParsing);
+
++ // If we're loading a stylesheet cross-origin, and the MIME type is not
++ // standard, require the CSS to at least start with a syntactically
++ // valid CSS rule.
++ // This prevents an attacker playing games by injecting CSS strings into
++ // HTML, XML, JSON, etc. etc.
++ if (!document()->securityOrigin()->canRequest(KURL(ParsedURLString, url)))
++ crossOriginCSS = true;
++
++ if (crossOriginCSS && !validMIMEType && !m_sheet->hasSyntacticallyValidCSSHeader())
++ m_sheet = CSSStyleSheet::create(this, url, charset);
++
+ if (strictParsing && document()->settings() && document()->settings()->needsSiteSpecificQuirks()) {
+ // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+ DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:19.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp 2010-02-25 17:07:29.119741915 +0100
+@@ -71,11 +71,11 @@ String CachedCSSStyleSheet::encoding() c
+ return m_decoder->encoding().name();
+ }
+
+-const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType) const
++const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType, bool* hasValidMIMEType) const
+ {
+ ASSERT(!isPurgeable());
+
+- if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType))
++ if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType, hasValidMIMEType))
+ return String();
+
+ if (!m_decodedSheetText.isNull())
+@@ -122,12 +122,12 @@ void CachedCSSStyleSheet::error()
+ checkNotify();
+ }
+
+-bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
++bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const
+ {
+ if (errorOccurred())
+ return false;
+
+- if (!enforceMIMEType)
++ if (!enforceMIMEType && !hasValidMIMEType)
+ return true;
+
+ // This check exactly matches Firefox. Note that we grab the Content-Type
+@@ -138,7 +138,12 @@ bool CachedCSSStyleSheet::canUseSheet(bo
+ // This code defaults to allowing the stylesheet for non-HTTP protocols so
+ // folks can use standards mode for local HTML documents.
+ String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
+- return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
++ bool typeOK = mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
++ if (hasValidMIMEType)
++ *hasValidMIMEType = typeOK;
++ if (!enforceMIMEType)
++ return true;
++ return typeOK;
+ }
+
+ }
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h.cve-2010-0051-lax-css-parsing-cross-domain-theft qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h.cve-2010-0051-lax-css-parsing-cross-domain-theft 2010-02-11 16:55:19.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h 2010-02-25 17:07:29.120741848 +0100
+@@ -40,7 +40,7 @@ namespace WebCore {
+ CachedCSSStyleSheet(const String& URL, const String& charset);
+ virtual ~CachedCSSStyleSheet();
+
+- const String sheetText(bool enforceMIMEType = true) const;
++ const String sheetText(bool enforceMIMEType = true, bool* hasValidMIMEType = 0) const;
+
+ virtual void didAddClient(CachedResourceClient*);
+
+@@ -56,7 +56,7 @@ namespace WebCore {
+ void checkNotify();
+
+ private:
+- bool canUseSheet(bool enforceMIMEType) const;
++ bool canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const;
+
+ protected:
+ RefPtr<TextResourceDecoder> m_decoder;
--- /dev/null
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp 2010-02-25 15:50:05.987741463 +0100
+@@ -515,11 +515,13 @@ bool HTMLFormElement::isURLAttribute(Att
+
+ void HTMLFormElement::registerImgElement(HTMLImageElement* e)
+ {
++ ASSERT(imgElements.find(e) == notFound);
+ imgElements.append(e);
+ }
+
+ void HTMLFormElement::removeImgElement(HTMLImageElement* e)
+ {
++ ASSERT(imgElements.find(e) == notFound);
+ removeFromVector(imgElements, e);
+ }
+
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp 2010-02-25 15:43:45.016742027 +0100
+@@ -209,6 +209,40 @@ void HTMLImageElement::removedFromDocume
+ HTMLElement::removedFromDocument();
+ }
+
++void HTMLImageElement::insertedIntoTree(bool deep)
++{
++ if (m_form) {
++ // m_form was set by constructor. In debug builds, check that it's an ancestor indeed.
++#ifndef NDEBUG
++ for (Node* ancestor = parentNode(); /* no end condition - there must be a form ancestor */; ancestor = ancestor->parentNode()) {
++ ASSERT(ancestor);
++ if (ancestor->hasTagName(formTag)) {
++ ASSERT(m_form == static_cast<HTMLFormElement*>(ancestor));
++ break;
++ }
++ }
++#endif
++ } else {
++ for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
++ if (ancestor->hasTagName(formTag)) {
++ m_form = static_cast<HTMLFormElement*>(ancestor);
++ m_form->registerImgElement(this);
++ break;
++ }
++ }
++ }
++
++ HTMLElement::insertedIntoTree(deep);
++}
++
++void HTMLImageElement::removedFromTree(bool deep)
++{
++ if (m_form)
++ m_form->removeImgElement(this);
++ m_form = 0;
++ HTMLElement::removedFromTree(deep);
++}
++
+ int HTMLImageElement::width(bool ignorePendingStylesheets) const
+ {
+ if (!renderer()) {
+diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h.cve-2010-0054-image-element-pointer-name-getter qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
+--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h.cve-2010-0054-image-element-pointer-name-getter 2010-02-11 16:55:17.000000000 +0100
++++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h 2010-02-25 15:41:18.340929598 +0100
+@@ -45,8 +45,6 @@ public:
+
+ virtual void attach();
+ virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+- virtual void insertedIntoDocument();
+- virtual void removedFromDocument();
+
+ virtual bool canStartSelection() const { return false; }
+
+@@ -105,6 +103,11 @@ public:
+ virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
+
+ private:
++ virtual void insertedIntoDocument();
++ virtual void removedFromDocument();
++ virtual void insertedIntoTree(bool deep);
++ virtual void removedFromTree(bool deep);
++
+ HTMLImageLoader m_imageLoader;
+ String usemap;
+ bool ismap;
--- /dev/null
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/qt-webkit-4.5.3-r3.ebuild,v 1.1 2010/04/09 22:26:07 yngwin Exp $
+
+EAPI="2"
+inherit eutils qt4-build flag-o-matic
+
+DESCRIPTION="The Webkit module for the Qt toolkit"
+SLOT="4"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="dbus kde"
+
+DEPEND="~x11-libs/qt-core-${PV}[debug=,ssl]
+ ~x11-libs/qt-gui-${PV}[dbus?,debug=]
+ dbus? ( ~x11-libs/qt-dbus-${PV}[debug=] )
+ !kde? ( || ( ~x11-libs/qt-phonon-${PV}:${SLOT}[dbus=,debug=]
+ media-sound/phonon ) )
+ kde? ( media-sound/phonon )"
+RDEPEND="${DEPEND}"
+
+pkg_setup() {
+ QT4_TARGET_DIRECTORIES="
+ src/3rdparty/webkit/WebCore
+ tools/designer/src/plugins/qwebview"
+ QT4_EXTRACT_DIRECTORIES="
+ include/
+ src/
+ tools/"
+ QCONFIG_ADD="webkit"
+ QCONFIG_DEFINE="QT_WEBKIT"
+
+ qt4-build_pkg_setup
+}
+
+src_prepare() {
+ [[ $(tc-arch) == "ppc64" ]] && append-flags -mminimal-toc #241900
+ epatch "${FILESDIR}"/30_webkit_unaligned_access.diff #235685
+ epatch "${FILESDIR}"/${P}-no-javascript-crash.patch #295573
+
+ # patches graciously borrowed from Fedora for bug #314193
+ epatch "${FILESDIR}"/${P}-cve-2010-0046-css-format-mem-corruption.patch
+ epatch "${FILESDIR}"/${P}-cve-2010-0049-freed-line-boxes-ltr-rtl.patch
+ epatch "${FILESDIR}"/${P}-cve-2010-0050-crash-misnested-style-tags.patch
+ epatch "${FILESDIR}"/${P}-cve-2010-0052-destroyed-input-cached.patch
+
+ qt4-build_src_prepare
+}
+
+src_configure() {
+ # This fixes relocation overflows on alpha
+ use alpha && append-ldflags "-Wl,--no-relax"
+ myconf="${myconf} -webkit $(qt_use dbus qdbus)"
+ qt4-build_src_configure
+}
--- /dev/null
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-webkit/qt-webkit-4.6.2-r1.ebuild,v 1.1 2010/04/09 22:26:07 yngwin Exp $
+
+EAPI="2"
+inherit qt4-build
+
+DESCRIPTION="The Webkit module for the Qt toolkit"
+SLOT="4"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 -sparc ~x86 ~x86-fbsd ~x86-freebsd ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~x64-solaris ~x86-solaris"
+IUSE="dbus kde"
+
+DEPEND="~x11-libs/qt-core-${PV}[aqua=,debug=,ssl]
+ ~x11-libs/qt-gui-${PV}[aqua=,dbus?,debug=]
+ ~x11-libs/qt-xmlpatterns-${PV}[aqua=,debug=]
+ dbus? ( ~x11-libs/qt-dbus-${PV}[aqua=,debug=] )
+ !kde? ( || ( ~x11-libs/qt-phonon-${PV}:${SLOT}[aqua=,dbus=,debug=]
+ media-sound/phonon[aqua=] ) )
+ kde? ( || ( media-sound/phonon[aqua=] ~x11-libs/qt-phonon-${PV}:${SLOT}[aqua=,dbus=,debug] ) )"
+RDEPEND="${DEPEND}"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.6.0-solaris-strnstr.patch
+ "${FILESDIR}"/${PN}-4.5.3-cve-2010-0046-css-format-mem-corruption.patch
+ "${FILESDIR}"/${PN}-4.5.3-cve-2010-0049-freed-line-boxes-ltr-rtl.patch
+ "${FILESDIR}"/${PN}-4.5.3-cve-2010-0050-crash-misnested-style-tags.patch
+ "${FILESDIR}"/${PN}-4.5.3-cve-2010-0052-destroyed-input-cached.patch
+ "${FILESDIR}"/${P}-cve-2010-0051-lax-css-parsing-cross-domain-theft.patch
+ "${FILESDIR}"/${P}-cve-2010-0054-image-element-pointer-name-getter.patch
+)
+
+pkg_setup() {
+ QT4_TARGET_DIRECTORIES="
+ src/3rdparty/webkit/WebCore
+ tools/designer/src/plugins/qwebview"
+ QT4_EXTRACT_DIRECTORIES="
+ include/
+ src/
+ tools/"
+ QCONFIG_ADD="webkit"
+ QCONFIG_DEFINE="QT_WEBKIT"
+
+ qt4-build_pkg_setup
+}
+
+src_prepare() {
+ [[ $(tc-arch) == "ppc64" ]] && append-flags -mminimal-toc #241900
+ qt4-build_src_prepare
+}
+
+src_configure() {
+ myconf="${myconf} -webkit $(qt_use dbus qdbus)"
+ qt4-build_src_configure
+}
projects / gentoo.git / commitdiff