summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Fix broken bundled zlib for cross compilation90-basedMichal Klocek2022-06-221-2/+3
| | | | | | | | | | | | | | | | | | Bundled zlib when cross compiling with neon support assumes armv8 and requires built-in intrinsics for the ARMv8-A CRC32. However qt supports armv7 with neon support, which will end up in false armv8 outcome architecture for final library and will end up in unusable binaries for armv7 platform. Disable neon optimization for crc32, we should use system zlib anyway which is fixed in other patches. Task-number: QTBUG-103149 Change-Id: Ibfb5caa67cfea53b4c6a1bc1ed4948816c05ca38 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 88398c89a7b34606120ff919f873cb59ce3bcf2f) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* Make sure we do not compile minizip from 3rdpartyMichal Klocek2022-06-022-1/+4
| | | | | | | | | | | | | | There are two minizips in chromium src tree, minizip from third_party/zlib and separate third_party/minizip. Remove minizip used for fuzzers. Sources could be removed with next adaptation. Task-number: QTBUG-103149 Change-Id: I30a9828dece43bf82e0be8d20ab8f2ccb2baab1d Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 0547533a515c4a1641f51800fd771c65b255e04b) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* [Backport] CVE-2022-0976: Heap buffer overflow in GPUJamie Madill2022-05-241-3/+17
| | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3513754: Vulkan: Fix issue with redefining a layered attachment. The fix ensures we complete level redefinition before we get the layer render target in TextureVk::getAttachmentRenderTarget. Bug: chromium:1296866 Change-Id: I3ebe38f477fbb3eb4f0ad81634ccfb716f1699ca Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1312563Eugene Zemtsov2022-05-241-4/+8
| | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3575680: Only destroy successfully created compression session in VT encoder This is a defensive change, since we don't have a repro on hand. My guess is that VTCompressionSessionCreate() might fail to create a compression session, but still write a value to compressionSessionOut. It makes VTCompressionSessionInvalidate() access uninitialized memory. That's why this CL makes sure that we only destroy a compression session if VTCompressionSessionCreate() reports success. Bug: 1312563 Change-Id: I468ce0e10bad251ca0b62b568607dbc5c32ba8bc Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Eugene Zemtsov <eugene@chromium.org> Cr-Commit-Position: refs/heads/main@{#990654} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1298867Geoff Lang2022-05-241-1/+1
| | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3563515: Fix CheckedNumeric using the wrong type. Validation for glBufferSubData checks that the buffer is large enough for size+offset but verifies they fit in a size_t which is a different type than the deduced type for size+offset on 32-bit systems. Use decltype to ensure that we always verify there is no overflow on the correct type. Bug: chromium:1298867 Change-Id: I82f534b2d227d3273a763e626ebeae068dc918dc Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Jonah Ryan-Davis <jonahr@google.com> Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1636: Use after free in Performance APIsCorentin Pescheloche2022-05-242-4/+42
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3620956: Cleanup profiler group detached profilers ProfilerGroup keeps track of detached profilers to be able to gracefully stop leaked profilers when the corresponding ExecutionContext is destroyed. (cherry picked from commit 9f9d5fd2f3085414fc8776bf556fb5c4fa2dac2c) Change-Id: I4fdbbc3a5208819397d742c9ecbff117f839691c Bug: chromium:1297283 Commit-Queue: Corentin Pescheloche <cpescheloche@fb.com> Cr-Original-Commit-Position: refs/heads/main@{#994316} Reviewed-by: Oleh Lamzin <lamzin@google.com> Owners-Override: Oleh Lamzin <lamzin@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Auto-Submit: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1629} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1639: Use after free in ANGLEJamie Madill2022-05-241-4/+1
| | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3594250: Fix validate state cache after XFB buffer deleted. Bug: chromium:1317650 Change-Id: Iec9f1167c3b2957091dd0f4ef3efcfcd7c4bf3c0 Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Auto-Submit: Jamie Madill <jmadill@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1492: Insufficient data validation in Blink EditingXiaocheng Hu2022-05-231-2/+2
| | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3589799: Sanitize DragData markup before inserting it into document (cherry picked from commit 5164a0fe3391283663e1196cf4576ec233985e89) Fixed: 1315040 Change-Id: I8a0ddfb983d12c185f7e943d3d5277788199b011 Quick-Run: Xiaocheng Hu <xiaochengh@chromium.org> Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#991324} Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1602} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Disable alternate window station of Windows sandboxPeter Varga2022-05-231-0/+5
| | | | | | | | | | | | This is necessary after upstream change: 5129a5e714d67 Win: Initialize alternate desktop earlier. https://chromium-review.googlesource.com/c/chromium/src/+/2656961 Change-Id: Icdca68666b32c84a6335ca7f044a77cb6061cf69 Fixes: QTBUG-102738 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 72d76568fe90b072c0199391b5b5b47c3052e79f) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* [Backport] CVE-2022-1493: Use after free in Dev ToolsJaroslav Sevcik2022-05-201-7/+7
| | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3510307: Use weak pointers for devtools http server handlers This makes sure that we do not call HttpServer message handlers on a deallocated HttpServer instance. Interestingly, the weak pointer factory was already there, but it was unused. Bug: chromium:1275414 Change-Id: Ic0c33319bb3e67e3c15349d07acbaad64a7f62e3 Reviewed-by: Robbie McElrath <rmcelrath@chromium.org> Reviewed-by: Danil Somsikov <dsv@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/main@{#979140} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1487: Use after free in OzoneKramer Ge2022-05-201-0/+3
| | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3517354: WaylandWindow's parent_window use-after-free To insure the child_window access after parent's destruct doesn't have UAF, clear the parent_window of the child in dtor. Change-Id: I18ea65a76e715e98747588fbe75e1a37cbbe199c Bug: 1304368 Reviewed-by: Maksim Sisov <msisov@igalia.com> Commit-Queue: Kramer Ge <fangzhoug@chromium.org> Cr-Commit-Position: refs/heads/main@{#980391} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1296334Xinghui Lu2022-05-201-3/+2
| | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3483595: Replace RawPtr with WeakPtr when posting task to cache_manager When RealTimeUrlLookupServiceBase post a task to cache a verdict, it uses base::Unretained. This is not safe because when the task is run, the cache manager may no longer be valid. Replace base::Unretained with WeakPtr() to avoid this issue. Bug: 1296334 Change-Id: If4e70951b949d349ab35aa52410f044595ababb6 Reviewed-by: Daniel Rubery <drubery@chromium.org> Commit-Queue: Xinghui Lu <xinghuilu@chromium.org> Cr-Commit-Position: refs/heads/main@{#974832} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1497: Inappropriate implementation in InputGarrett Tanzer2022-05-203-20/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3481666: Reland "Fix noopener case for user activation consumption" This is a reland of e9828a82b5c182dc9a7fb0ae7226c35ba1726e7d The MSAN error is from checking status before err in content/renderer/render_view_impl.cc . https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/b8821495655905086193/overview The fix is to split the check for err and kIgnore into two checks, and put the err check before kBlocked. It is probably possible for the browser to consume user activation but then eventually mojo returns an error and the renderer doesn't consume activation, but that seems pretty marginal. Original change's description: > Fix noopener case for user activation consumption > > > The flow for user activation consumption in window.open was as follows: > > Renderer: ask the browser to create a new window > Browser: consume transient user activation (in the browser, and via RPC > to remote frames only) > Browser: return success for opener, return ignore for noopener > Renderer: consume transient user activation upon success > > So in the noopener case, the renderer with the local frame where the > window.open originated didn't have its transient user activation > consumed. > > > The new behavior is to consume user activation in the calling renderer > whenever it is consumed in the browser. We accomplish this by returning > a distinct value kBlocked to represent failure before the browser > consumes user activation. > > Bug: 1264543, 1291210 > Change-Id: Iffb6e3fd772bef625d3d28e600e6fb73d70ab29f > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3468171 > Reviewed-by: Dominic Farolino <dom@chromium.org> > Reviewed-by: Ken Buchanan <kenrb@chromium.org> > Reviewed-by: Mustaq Ahmed <mustaq@chromium.org> > Reviewed-by: Charles Reis <creis@chromium.org> > Reviewed-by: Jonathan Ross <jonross@chromium.org> > Reviewed-by: Daniel Cheng <dcheng@chromium.org> > Commit-Queue: Garrett Tanzer <gtanzer@chromium.org> > Cr-Commit-Position: refs/heads/main@{#973876} Bug: 1264543, 1291210 Change-Id: Ie27c4d68db34dfd98adee7cc5c743953dad59834 Reviewed-by: Jonathan Ross <jonross@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Mustaq Ahmed <mustaq@chromium.org> Reviewed-by: Ken Buchanan <kenrb@chromium.org> Reviewed-by: Charles Reis <creis@chromium.org> Commit-Queue: Garrett Tanzer <gtanzer@chromium.org> Cr-Commit-Position: refs/heads/main@{#976745} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1638: Heap buffer overflow in V8 InternationalizationFrank Tang2022-05-201-17/+38
| | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/deps/icu/+/3614280: CP PR 2070 fix int32 overflow https://github.com/unicode-org/icu/pull/2070 https://unicode-org.atlassian.net/browse/ICU-22005 Bug: chromium:1316946 Change-Id: I6cd7d687a55b6cc157b1afa52365908be2992fa6 Reviewed-by: Jungshik Shin <jshin@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1306507Scott Violet2022-05-202-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3538001: history: don't handle db error during destruction Handling of db errors is delayed using a posttask. ~HistoryBackend closes all the dbs. If closing the db results in an error, then a PostTask() is scheduled with a HistoryBackend that is part way through deletion. When the PostTask() runs, we get a uaf. This patch resets the error callback in ~HistoryBackend to ensure this doesn't happen. This means a db error is effectively ignored during shutdown. Presumably if the error is fatal, it'll be handled when the HistoryBackend is created again. BUG=1306507 TEST=none Change-Id: Ic158589a43e7bc2fd1f602fb2798ab500dc8d6d7 Reviewed-by: Victor Costan <pwnall@chromium.org> Commit-Queue: Victor Costan <pwnall@chromium.org> Commit-Queue: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/main@{#983478} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Find fontconfig using pkg-configAllan Sandfeld Jensen2022-05-112-2/+4
| | | | | | | | | | We already verify that it can be found like that during configure Task-number: QTBUG-61158 Change-Id: I569590e96a490c4ed6e6dc560fbd110d86d77956 Reviewed-by: Michal Klocek <michal.klocek@qt.io> (cherry picked from commit 357dcbf7d9510b5282a18e8211e2494f353b4e5e) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* Bump V8_PATCH_LEVELMichael Brüning2022-05-091-1/+1
| | | | | Change-Id: I01b987cc5744a639210a7ed745e5714e713e2ac5 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fix mac toolchain python linker script callMichal Klocek2022-05-051-1/+1
| | | | | | | | | | | | | Do not call script directly as it has shabang with just 'python' and we want use same python interpreter as configured for gn. It fixes the issue when mac machine has only 'python3' interpreter installed and no 'python' symlink. Change-Id: If656453ade7c49d61edc90763a0b07f49483d129 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 85721d41676ea7a05a7701b7574103212cacc87e) Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix angle build after 4faa15cf23Michal Klocek2022-05-051-1/+1
| | | | | | | This amends 4faa15cf23bcee983a9a211ac12efee802f01315. Change-Id: Ie7abfaa93721bfbf7284d96e23f0458f501c0ff1 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix angle build with vulkan backend after 8c2f6fadMichal Klocek2022-05-051-1/+1
| | | | | | | This amends 8c2f6fadc10e61b019d8d104de3355dd15b74233 Change-Id: I77e60c04c56f19453ce2b71e66e2c2ced1ac6b70 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2022-1483: Heap buffer overflow in WebGPUAustin Eng2022-05-031-3/+4
| | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3589810: [M96-LTS] Add bounds check to WebGPUDecoderImpl::DoRequestDevice (cherry picked from commit bee4701c99cbbbb25c0bd6c5c79a40f63f1b1e47) Fixed: chromium:1314754 Change-Id: Id23af9cc3df08cca3ce7d627e3761c9a65a2c802 Commit-Queue: Austin Eng <enga@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#991510} Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1603} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1482: Inappropriate implementation in WebGL.Gregg Tavares2022-05-031-2/+4
| | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3556686: Check for error when calling ComputeImageSizeInBytes Bug: chromium:1304987 Change-Id: I8311231156fca3200ce74d79db59d910a1a0e33a Reviewed-by: Kenneth Russell <kbr@chromium.org> Commit-Queue: Gregg Tavares <gman@chromium.org> Cr-Commit-Position: refs/heads/main@{#986304} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1479: Use after free in ANGLEJamie Madill2022-05-031-1/+1
| | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3522283: Fix crash when pausing XFB then deleting a buffer. Fix is to validate XFB buffer bindings even if we're paused. This is undefined behaviour so we can use any non-crashing solution. Bug: chromium:1305190 Change-Id: Ib95404cdb13adbde7f34d6cc77473a8b3cbf1de7 Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1477: Use after free in VulkanJamie Madill2022-05-031-0/+7
| | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3578378: Add error check on resuming XFB with deleted buffer. Bug: chromium:1305190 Change-Id: I22c6f6400b05ca32c922fba9a3b9d4b5841ca8b8 Auto-Submit: Jamie Madill <jmadill@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1292905Anders Hartvoll Ruud2022-05-031-2/+4
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3551609: Disallow CSS-wide keywords for StylePropertyMap.set We don't support this properly, and the spec does not handle CSS-keywords either. Disallow it until we can add proper support for this. Fixed: 1292905 Bug: 1310761 Change-Id: Ieb3d20edfea72c2ccb0928536fdfd86d10aad1a9 Reviewed-by: Rune Lillesveen <futhark@chromium.org> Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org> Cr-Commit-Position: refs/heads/main@{#986411} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1314: Type Confusion in V8Nico Hartmann2022-05-031-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3541919: Fix NumberConstant used with Word32 rep in ISel Bug: chromium:1304658 (cherry picked from commit bbea5909c797dec7c620b9fee43d80a1420c2e08) No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I6a82603a7c5de5ae8f5a895990c1a904bbdd39b2 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79526} Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#58} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1310: Use after free in regular expressionsBrendon Tiszka2022-05-031-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3548819: Update write barrier when storing HeapNumber to last index. (cherry picked from commit bdc4f54a50293507d9ef51573bab537883560cc8) Bug: chromium:1307610 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79538} Reviewed-by: Artem Sumaneev <asumaneev@google.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#64} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1305: Use after free in storageMarijn Kruisselbrink2022-05-034-78/+87
| | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3553304: Change ownership of BlobBytesProvider. Rather than immediately passing ownership to a cross-thread SelfOwnedReceiver while retaining a raw pointer, instead maintain ownership in a unique_ptr as long as it is needed, only transferring ownership to a SelfOwnedReceiver when BlobData is done with the BlobBytesProvider. Also clean-up/tighten down sequence checks for BlobBytesProvider a bit. Bug: 1285234 Change-Id: I7273e886a0bab2ae489b680d786991c9e4ff1dbb Reviewed-by: Austin Sullivan <asully@chromium.org> Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Cr-Commit-Position: refs/heads/main@{#986111} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1138: Inappropriate implementation in Web Cursor.Mike Wasserman2022-05-032-5/+7
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3413912: Make web cursor size limits match on browser and renderer Use NSCursor arrowCursor on Mac for ui::mojom::CursorType::kNull. (i.e. when WebCursor is constructed with an overly large custom cursor) Bug: 1246188 Test: Automated unit tests and WPTs Change-Id: I89627fa13cba96b755b8f80adbc91cfc865b6b1b Reviewed-by: Henrique Ferreiro <hferreiro@igalia.com> Reviewed-by: Charlie Harrison <csharrison@chromium.org> Commit-Queue: Mike Wasserman <msw@chromium.org> Auto-Submit: Mike Wasserman <msw@chromium.org> Cr-Commit-Position: refs/heads/main@{#964378} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-0797: Out of bounds memory access in MojoKen Rockot2022-05-034-10/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3483815: Validate message headers sooner M96 merge issues: - multiplex_router.h: conflict in removed lines because of differences in comments above header_validator_ - connector.h: conflicting includes Message header validation has been tied to interface message dispatch, but not all mojo::Message consumers are interface bindings. mojo::Connector is a more general-purpose entry point through which incoming messages are received and transformed into mojo::Message objects. Blink's MessagePort implementation uses Connector directly to transmit and receive raw serialized object data. This change moves MessageHeaderValidator ownership into Connector and always applies its validation immediately after reading a message from the pipe, thereby ensuring that all mojo::Message objects used in production have validated headers before use. (cherry picked from commit 8d5bc69146505785ce299c490e35e3f3ef19f69c) Fixed: 1281908 Change-Id: Ie0e251ab04681a4fd4b849d82c247e0ed800dc04 Commit-Queue: Ken Rockot <rockot@google.com> Cr-Original-Commit-Position: refs/heads/main@{#971263} Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1505} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-0789: Heap buffer overflow in ANGLEShahbaz Youssefi2022-05-031-3/+16
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3441309: M99: Vulkan: Fix texture array level redefinition When a level of a texture is redefined, all staged updates to that level should be removed, not the ones specific to the new layers. The bug fixed was that if the texture was redefined to have its number of layers changed, the staged higher-layer-count update to the image was not removed. Bug: chromium:1289383 Change-Id: Iab79c38d846d1abbdd92e11b1b60a3adf0fbde4c Reviewed-by: Lingfeng Yang <lfy@google.com> Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-0796: Use after free in MediaTed Meyer2022-05-032-29/+28
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3451494: Guard BatchingMediaLog::event_handlers_ with lock It seems that despite MediaLog::OnWebMediaPlayerDestroyed and MediaLog::AddLogRecord both grabbing a lock, BatchingMediaLog::AddLogRecordLocked can escape the lock handle by posting BatchingMediaLog::SendQueuedMediaEvents, causing a race. When the addition of an event is interrupted by the deletion of a player due to player culling in MediaInspectorContextImpl, a UAF can occur. R=dalecurtis Bug: 1295786 Change-Id: I77df94988f806e4d98924669d27860e50455299d Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Ted (Chromium) Meyer <tmathmeyer@chromium.org> Cr-Commit-Position: refs/heads/main@{#970815} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fix linking when cross-compiling arm64->x86_64Michal Klocek2022-05-031-1/+1
| | | | | | | | | | | | | | For some unknown reason linker fails on 90-based due to unresolved symbols for libaom for its internal objects. Set final linkage to use object files instead of archive. Note this is not an issue with 94-based and it is not related to source code of libaom. Also universal builds are not affected as we do 'intermediate' object file before final linkage. Change-Id: Icf7110cbe5af11d6ab27bf921f512beca7afa9fd Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1305234Ben Wagner2022-05-033-12/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Roll src/third_party/expat/src/ a28238bde..65a21f2b2 (96 commits) https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git/+log/a28238bdeebc..65a21f2b2a30 $ git log a28238bde..65a21f2b2 --date=short --no-merges --format='%ad %ae %s' 2022-02-20 sebastian Set expected release date for 2.4.6 2022-02-20 sebastian Bump version to 2.4.6 2022-02-20 sebastian Bump version info from 9:5:8 to 9:6:8 2022-02-20 sebastian Changes: Finalize entry on #566 2022-02-20 sebastian Changes: Document regression from CVE-2022-25313 fix 2022-02-20 sebastian tests: Protect against nested element declaration model regressions 2022-02-19 ferivoz Fix build_model regression. 2022-02-18 sebastian Set expected release date for 2.4.5 2022-02-18 sebastian Sync file headers 2022-02-18 sebastian Bump version to 2.4.5 2022-02-18 sebastian Bump version info from 9:4:8 to 9:5:8 2022-02-17 sebastian Changes: Document #558 #559 #560 2022-02-08 sebastian Changes: Document CVE-2022-25235 2022-02-08 sebastian tests: Cover missing validation of encoding (CVE-2022-25235) 2022-02-09 sebastian lib: Add comments to BT_LEAD* cases where encoding has already been validated 2022-02-08 sebastian lib: Add missing validation of encoding (CVE-2022-25235) 2022-02-08 sebastian lib: Drop unused macro UTF8_GET_NAMING 2022-02-12 sebastian Changes: Document CVE-2022-25236 2022-02-12 sebastian tests: Cover CVE-2022-25236 2022-02-12 sebastian lib: Protect against malicious namespace declarations (CVE-2022-25236) 2022-02-12 sebastian lib: Fix (harmless) use of uninitialized memory 2022-02-15 sebastian Sync file headers 2022-02-15 sebastian Extend .mailmap 2022-02-15 ferivoz Prevent integer overflow in storeRawNames 2022-02-15 ferivoz Prevent integer overflow in copyString 2022-02-15 ferivoz Prevent stack exhaustion in build_model 2022-01-29 sebastian win32: Add missing files to the installer 2022-01-29 sebastian doc: Drop unused file valid-xhtml10.png 2022-01-29 sebastian .gitignore: Add missing 2022-01-29 sebastian xmlwf.xml: Adapt note to current practice 2022-01-29 sebastian Set expected release date for 2.4.4 2022-01-29 sebastian Sync file headers 2022-01-29 sebastian Bump version to 2.4.4 2022-01-29 sebastian Bump version info from 9:3:8 to 9:4:8 2022-01-29 sebastian Changes: Document #546 2022-01-28 82243552+czentgr Stop casting void* results from calls to .malloc_fcn (#553) 2022-01-26 sebastian Changes: Document CVE-2022-23990 2022-01-26 sebastian lib: Prevent integer overflow in doProlog (CVE-2022-23990) 2022-01-20 sebastian xmlwf: Fix a memory leak on output file opening error 2022-01-22 sebastian Changes: Document CVE-2022-23852 2022-01-23 sebastian tests: Cover integer overflow in XML_GetBuffer (CVE-2022-23852) 2022-01-22 ferivoz lib: Detect and prevent integer overflow in XML_GetBuffer (CVE-2022-23852) 2022-01-22 ferivoz Fix typos 2022-01-20 30959007+carlo-bramini [>=2.3.0] Autotools: Fix broken CMake support under Cygwin (#546) 2022-01-13 sebastian Set expected release date for 2.4.3 2022-01-13 sebastian Changes: Streamline item order for 2.4.3 2022-01-13 sebastian Changes: Document #528 and #529 2022-01-13 sebastian Sync years in file headers 2022-01-13 sebastian Bump version to 2.4.3 2022-01-13 sebastian Bump version info from 9:2:8 to 9:3:8 2022-01-07 sebastian Changes: Document CVE-2022-22822 to CVE-2022-22827 2021-12-30 sebastian lib: Prevent integer overflow at multiple places (CVE-2022-22822 to CVE-2022-22827) 2022-01-07 sebastian linux.yml: Add some -m32 coverage to -DEXPAT_ATTR_INFO=ON 2022-01-05 sebastian Changes: Document integer overflow CVE-2021-46143 2021-12-25 sebastian lib: Prevent integer overflow on m_groupSize in function doProlog (CVE-2021-46143) 2022-01-09 sebastian run.sh.in: Do not use Wine with Cygwin and MSYS2 2022-01-05 sebastian Changes: Document CVE-2021-45960 2021-12-27 sebastian lib: Detect and prevent troublesome left shifts in function storeAtts (CVE-2021-45960) 2022-01-01 sebastian Actions: Check for realistic minimum CMake version requirement 2021-12-31 sebastian CMake: Make call to file(GENERATE [..]) work for CMake <3.19 2021-12-27 sebastian coverage.yml: Store coverage .info and HTML report 2021-12-27 sebastian linux.yml: Add some coverage to -m32 32bit mode 2021-12-27 sebastian coverage.sh: Simplify directory naming scheme 2021-12-26 sebastian coverage.sh: Start coveraging -m32 2021-12-27 sebastian CMake: Add unofficial flag for passing 32bit compile flag -m32 2021-12-26 sebastian Actions: Upgrade Clang from 11 to 13 2021-12-26 sebastian xmlwf: Address Clang 13 warning -Wunused-but-set-variable 2021-12-25 sebastian lib: Address GCC 11.2.1 compiler warning 2021-12-19 sebastian .gitignore: Fully cover ./distribute.sh output 2021-12-17 sebastian Set expected release date for 2.4.2 2021-12-17 sebastian Bump version to 2.4.2 2021-12-17 sebastian Bump version info from 9:1:8 to 9:2:8 2021-12-17 sebastian Changes: Document #502 #503 #507 #519 + fix reference to #498 2021-12-15 sebastian CMake: Ensure libexpat*.lib filenames with MSVC 2021-12-14 sebastian doc: Fix return value docs on XML_SetBillionLaughs[..] functions (#522) 2021-11-26 sebastian autotools: Sync expat.cmake to agree with CI 2021-11-08 49699333+dependabot[bot] Actions(deps): Bump actions/checkout from 2.3.5 to 2.4.0 2021-10-18 49699333+dependabot[bot] Actions(deps): Bump actions/checkout from 2.3.4 to 2.3.5 2021-10-17 sebastian Get attribution headers back in sync 2021-10-17 sebastian Changes: Document #513 and #514 2021-10-17 sebastian Apply #514 to attribution headers 2021-10-16 donghee.na Reorder the location of including expat_config.h 2021-09-08 sebastian Autotools|CMake: Link against libm for function "isnan" 2021-09-10 sebastian autotools-cmake.yml: Add missing full stop 2021-07-23 sebastian Autotools: Get CMake templates back in sync with ubuntu-20.04 2021-06-23 sebastian CMake: Improve summary output for multi-config builds 2021-06-23 sebastian CMake: Report on effective CMake generator 2021-06-23 sebastian Autotools: Simplify expat.pc templating (now that we can) 2021-06-23 sebastian CMake: Fix pkg-config section "Libs" for multi-config CMake generators 2021-06-03 dg0yt Update URL in pc file 2021-06-03 sebastian CMake: Fix pkg-config section "Libs" for non-release MinGW builds 2021-06-23 sebastian CMake: Apply -DEXPAT_MSVC_STATIC_CRT=ON to off-grid built types 2021-06-05 sebastian CMake: Avoid empty CMAKE_BUILD_TYPE 2021-06-03 sebastian CMake: Move _EXPAT_BUILD_TYPE_UPPER up for upcoming re-use 2021-07-05 nicolas.cavallari doc/reference.html: Docmument that XML_GetBuffers(parser, 0) may be NULL 2021-06-05 sebastian Makefile.am: Include buildconf.sh and fuzz/*.c with release archives Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3481360 Bug: chromium:1305234 Change-Id: I6015115f9b5e1015cdb30d948dd6032d795d9c19 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix cross-compilation arm64->x86_64Michal Klocek2022-05-032-6/+10
| | | | | | Task-number: QTBUG-100672 Change-Id: Ibb29c7caf19315956762d9528a6b56a833488e75 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix python callsMichal Klocek2022-04-261-2/+2
| | | | | | | Used python configured with gn. Change-Id: Id9190818a85c052238a7cda846b67a606a685a5e Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Workaround MSVC2022 ICE in constexpr functionsPeter Varga2022-04-261-7/+55
| | | | | | | | | | | | | | | | It happens around initialization of STL containers in a constexpr function. In this case, aggregate initialization of std::array with double braces seems to cause the crash. For some reason it doesn't seem to happen in 98-based. This workaround can be reverted after Microsoft fixes the issue: https://developercommunity.visualstudio.com/t/fatal-error-C1001:-Internal-compiler-err/1669485 Change-Id: I6bc2c71d328691cc74bc53c6d62f3d5df519b81e Fixes: QTBUG-101917 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 0ce5e91bdfa2cd7cac247911b9e8c4404c114937) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* [Backport] CVE-2022-1364: Type Confusion in V8Tobias Tebbi2022-04-201-1/+24
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3584531: mark receiver and function as escaping (cherry picked from commit 8081a5ffa7ebdb0e5b35cf63aa0490ad3578b940) Bug: chromium:1315901 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: Ic44bfcae32aba202ba25c5f59fe579214a444584 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79968} Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#62} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll src/third_party/expat/src/ e976867fb..a28238bde (182 commits)Ben Wagner2022-04-144-10/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git/+log/e976867fb57a..a28238bdeebc $ git log e976867fb..a28238bde --date=short --no-merges --format='%ad %ae %s' 2021-05-23 sebastian Set expected release date for 2.4.1 2021-05-23 sebastian Bump version info from 9:0:8 to 9:1:8 2021-05-23 sebastian Bump version to 2.4.1 2021-05-23 sebastian Keep macro SIZEOF_VOID_P out of expat_config.h(.in) for multilib support 2021-05-23 sebastian Actions: Avoid error "would clobber existing tag" when pushing new tags 2021-05-11 sebastian Set expected release date for 2.4.0 2021-05-11 sebastian Bump version info from 8:0:7 to 9:0:8 2021-05-11 sebastian Bump version to 2.4.0 2021-05-11 sebastian Changes: Extend section on upcoming release 2.4.0 2021-05-21 sebastian Changes: Document new XML_FEATURE_ constants 2021-05-21 sebastian Changes: Combine notes on billion laughs attack protection 2021-05-22 sebastian README.md: Mention Windos binaries zip download option 2021-05-22 sebastian README.md: Fix a URL for some markdown interpreters 2021-05-22 sebastian README.md: Document where generated CMake files need >=2.4.0 to work 2021-05-22 sebastian README.md: Make CMake config mode example more clear 2021-05-20 sebastian Changes: Document Autotools CMake file fixes 2021-05-20 sebastian autotools-cmake.yml: Cover macOS and MinGW 2021-05-20 sebastian cmake/autotools: Fix generated expat-noconfig.cmake for macOS and MinGW 2021-05-20 sebastian cmake/autotools: Use AC_CHECK_SIZEOF to fix 32bit support 2021-05-14 sebastian expat.iss: Use URLs with SSL 2021-05-13 sebastian Increase precision in existing MIT headers based on Git history 2021-05-13 sebastian doc/xmlwf.xml: Drop two XML comments of little value 2021-05-13 sebastian doc/xmlwf.xml: Add GNU FDL 1.1 copyright header 2021-05-14 sebastian expat.iss: Add MIT header 2021-05-13 sebastian CMake: Streamline existing copyright header 2021-05-14 sebastian tests: Cover accounting of CDATA sections inside of general entities 2021-05-14 sebastian lib: Fix accounting of CDATA sections inside of general entities 2021-05-13 sebastian README.md: Add total download count badges 2021-05-13 sebastian Revert ".github/workflows: Re-add repo ppa:ondrej/php(!) to fix wine32 installation" 2021-05-12 sebastian Changes: Document support for CMake variable BUILD_SHARED_LIBS 2021-05-12 sebastian CMake: Support standard variable BUILD_SHARED_LIBS 2021-05-08 sebastian doc/reference.html: Upgrade to OK.css 1.0.3 2021-04-19 sebastian Changes: Document protection against billion laughs attacks 2021-04-26 sebastian tests: Cover helper unsignedCharToPrintable 2021-04-26 sebastian tests: Cover billion laughs attack protection API 2021-04-25 sebastian doc/reference.html: Document billion laughs attack protection API 2021-04-25 sebastian xmlwf.1: Document arguments -a and -b 2021-04-17 sebastian xmlwf: Add support for custom attack protection parameters 2021-04-18 sebastian xmlwf: Include expat_config.h so we can check for macro XML_DTD 2021-04-21 sebastian tests: Cover accounting 2021-04-19 sebastian lib: Make EXPAT_ENTROPY_DEBUG consistent with other EXPAT_*_DEBUG variables 2021-04-14 sebastian lib: Add prefix "expat: " to EXPAT_ENTROPY_DEBUG=1 stderr output 2021-04-19 sebastian lib: Allow test suite to access raw accounting values 2021-04-20 sebastian lib: Address Cppcheck 2.4.1 warning "uninitvar" 2021-04-19 sebastian lib: Protect against billion laughs attacks (approach 3.0.21) 2021-04-20 sebastian Autotools|CMake: Suppress -Wpedantic-ms-format false positives 2021-04-20 sebastian mass-cppcheck.sh: Suppress warning "unknownMacro" 2021-05-07 sebastian Actions: Ensure well-formed and valid XML 2021-05-07 sebastian doc/reference.html: Fix XML validity 2021-05-07 sebastian xmlwf.1: Fix DocBook validity (...) 2021-03-16 Alexander.Richardson CMake: Only set CMAKE_CXX_FLAGS after enable_language(CXX) 2021-03-10 sebastian fuzzers: Address Clang warning -Wunused-parameter 2021-02-24 sebastian .travis.yml: Install llvm-11 for llvm-symbolizer 2021-02-23 sebastian .travis.yml: Upgrade to Ubuntu Bionic 18.04.x LTS and Clang 11 2021-02-23 sebastian apply-clang-format.sh: Report on clang-format version 2021-02-24 sebastian xmlparse.c: Reject missing call to XML_GetBuffer in XML_ParseBuffer 2020-12-29 sebastian configure.ac: Drop obsolescent macro AC_HEADER_STDC (#436) 2020-12-29 sebastian Actions: Cover list of symbols exported by installed expat_config.h 2020-12-27 sebastian Use GitHub Actions to run current macOS Travis CI tasks 2020-12-27 tc Detect unsupported VS at configure time (and not at compile time) 2020-12-17 tim.gates docs: fix simple typo, wtihout -> without 2020-10-30 sebastian Changes: Document #382 and #428 2020-10-25 sebastian tests: Show failure location for normal mode output as well 2020-10-25 sebastian Travis: Add CTEST_OUTPUT_ON_FAILURE=1 where missing 2020-10-25 sebastian tests: Make argument -v more useful 2020-10-25 sebastian tests: Report actual failure location 2020-10-25 sebastian tests: Make check for silence explain itself better 2020-10-03 sebastian Drop remaining support for Visual Studio 2008, 2010, 2012 (#422) 2020-10-03 sebastian Revert "AppVeyor: Be explicit about build script to support msbuild 3.5" 2020-10-03 sebastian Revert "AppVeyor: Cover 32bit Visual Studio 9 2008 using MSBuild 3.5" 2020-10-03 sebastian CMake: Remove unused variable 2020-10-03 sebastian Set release date for 2.2.10 2020-10-02 sebastian Bump version info from 7:11:6 to 7:12:6 2020-10-02 sebastian Bump version from 2.2.9 to 2.2.10 2020-10-02 sebastian Changes: Document #405 #356 #359 #394 #366 #412 #368 #369 2020-10-02 sebastian CMake: Turn endif(..) into endif(), and else(..) into else() 2020-10-03 sebastian tests: Add missing static to address compiler warning 2020-10-01 sebastian Changes: Document #424 2020-09-30 sebastian CMake: Support "make package" based on CPack 2020-09-26 sebastian Changes: Document #419 2019-08-03 sebastian qa.sh: Enable LeakSanitizer 2020-09-15 sebastian AppVeyor: Cover Visual Studio 16 2019 2020-09-18 gulliver added "new" behaviour for Policy CMP0077 which allows to control the build options by variables if lib is used by FetchContent of a super project 2020-09-09 sebastian installer: Add missing file to fix build from installed sources (#409) 2020-08-20 sebastian readme: Sync list of CMake options 2020-08-20 sebastian CMake: Introduce option EXPAT_BUILD_PKGCONFIG (#413) 2020-08-12 boris Get rid of unsigned integer overflow in column calculation 2020-07-16 sebastian CMake: Consider use of CMAKE_{EXE,MODULE,SHARED}_LINKER_FLAGS 2020-07-16 sebastian Be more correct about const correctness on the inside 2020-07-15 sebastian Changes: Document #408 2020-07-10 sebastian CMake: Get expat target name back to constant "expat" 2020-06-22 sebastian Changes: Document #406 2020-06-22 klebertarcisio xmlwf: Checks value after calling malloc 2020-05-28 sebastian Travis: Limit Cppcheck to macOS 2020-05-27 sebastian xmlparse.c: Fix reading uninitialized variable (#404) 2020-05-12 sebastian Travis: Improve call to cppcheck 2020-05-12 sebastian Travis: Install a find(1) better than that of macOS 2020-05-13 sebastian Changes: Document #403 2020-05-13 jorton Update xmlwf to exit with 3 if an output file could not be opened. Update xmlwf exit code docs per review. 2020-05-12 jorton Document the exit codes for xmlwf. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2915493 Bug: chromium:1212733 Change-Id: Ie33cd8b4663eb8461650e082549f3058e142df96 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1304659Joey Arhar2022-04-1492-39182/+1132
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Roll libxml from eab86522 to 37ebf8a8 This patch also updates the roll.py script to be python3 compatible. 2021-05-31 damjan.jov@gmail.com Document support for the non-standard escape sequences. Support non-BMP code points in surrogate pairs of '\uXXXX\uXXXX'. 2021-05-30 damjan.jov@gmail.com Use strtoul() instead of sscanf, and correct data types that break GCC. 2021-05-29 damjan.jov@gmail.com Add support for some non-standard escapes in regular expressions. 2021-07-17 mike.dalessio@gmail.com htmlParseComment: handle abruptly-closed comments 2021-07-17 mike.dalessio@gmail.com test coverage for abruptly-closed comments 2021-08-21 damjan.jov@gmail.com Properly fold whitespace around the QName value when validating an XSD schema. 2021-08-19 damjan.jov@gmail.com Add whitespace folding for some atomic data types that it's missing on. 2022-01-12 oliver.diehl@nxp.com Add let variable tag support 2022-01-11 oliver.diehl@nxp.com Add value-of tag support 2022-01-11 oliver.diehl@nxp.com Replaced tabs by 4 spaces 2022-03-02 wellnhofer@aevum.de Remove obsolete AC_HEADER checks 2022-03-02 wellnhofer@aevum.de Don't check for standard C89 library functions 2022-03-02 wellnhofer@aevum.de Don't check for standard C89 headers 2022-03-01 wellnhofer@aevum.de Remove broken VxWorks support 2022-03-01 wellnhofer@aevum.de Remove broken Mac OS 9 support 2022-03-01 wellnhofer@aevum.de Remove useless call to xmlRelaxNGCleanupTypes 2022-03-01 wellnhofer@aevum.de Reset last error in xmlCleanupGlobals 2022-03-01 wellnhofer@aevum.de Warn when using deprecated functions from Python bindings 2022-03-01 wellnhofer@aevum.de Don't include ICU headers in public headers 2022-03-01 wellnhofer@aevum.de Remove broken bakefile support 2022-03-01 wellnhofer@aevum.de Remove broken Visual Studio 2010 support 2022-03-01 wellnhofer@aevum.de Remove broken Windows CE support 2022-02-28 wellnhofer@aevum.de Always fopen files with "rb" 2022-02-28 wellnhofer@aevum.de Remove __DJGPP__ checks 2022-02-28 wellnhofer@aevum.de Remove useless __CYGWIN__ checks 2021-12-20 wellnhofer@aevum.de Fix certain combinations of regex range quantifiers 2021-12-20 wellnhofer@aevum.de Fix range quantifier on subregex 2022-02-21 mike.dalessio@gmail.com Update `xmlStrlen()` to use POSIX / ISO C `strlen()` 2022-02-24 wellnhofer@aevum.de Fix build with older Python versions 2022-02-22 wellnhofer@aevum.de Fix unused variable warnings with disabled features 2022-02-22 wellnhofer@aevum.de Fix recovery from invalid HTML start tags 2022-02-22 wellnhofer@aevum.de More fixes to --without-valid build 2022-02-22 wellnhofer@aevum.de Fix --without-valid build 2022-02-20 wellnhofer@aevum.de Fix documentation in entities.c 2022-02-20 wellnhofer@aevum.de Add note about optimization flags 2022-02-20 wellnhofer@aevum.de Remove special configuration for certain maintainers 2022-02-20 wellnhofer@aevum.de Deprecate IDREF-related functions in valid.h 2022-02-20 wellnhofer@aevum.de Deprecate all functions in DOCBparser.h 2022-02-20 wellnhofer@aevum.de Disable docbook support by default 2022-02-20 wellnhofer@aevum.de Deprecate legacy functions 2022-02-20 wellnhofer@aevum.de Disable legacy support by default 2022-02-20 wellnhofer@aevum.de Deprecate all functions in nanoftp.h 2022-02-20 wellnhofer@aevum.de Disable FTP support by default 2022-02-20 wellnhofer@aevum.de Add XML_DEPRECATED macro 2022-02-20 wellnhofer@aevum.de Remove elfgcchack.h 2022-02-20 wellnhofer@aevum.de Only warn on invalid redeclarations of predefined entities 2022-02-08 wellnhofer@aevum.de Don't add IDs containing unexpanded entity references 2022-02-20 wellnhofer@aevum.de Remove unneeded code in xmlreader.c 2022-01-13 wellnhofer@aevum.de Rework validation context flags 2022-02-19 wellnhofer@aevum.de Release v2.9.13 2022-02-19 wellnhofer@aevum.de Update news and rebuild documentation 2022-02-08 wellnhofer@aevum.de [CVE-2022-23308] Use-after-free of ID and IDREF attributes 2022-02-19 wellnhofer@aevum.de Fix fuzz/.gitignore after fixing VPATH build 2022-02-17 wellnhofer@aevum.de Remove SVN keyword anchors 2022-02-16 wellnhofer@aevum.de Remove xmlwin32version.h 2022-02-14 wellnhofer@aevum.de Fix source URL in libxml.spec.in 2022-02-14 wellnhofer@aevum.de Fix fuzzer test with VPATH build 2022-02-14 wellnhofer@aevum.de Support custom prefix when installing Python module 2022-02-14 wellnhofer@aevum.de Remove Makefile.win 2022-02-14 wellnhofer@aevum.de Fix distribution after README change 2022-02-14 wellnhofer@aevum.de Rework README 2022-02-14 wellnhofer@aevum.de Remove README.cvs-commits 2022-02-14 wellnhofer@aevum.de Remove outdated ChangeLog code 2022-02-13 wellnhofer@aevum.de Remove CVS and SVN-related code 2022-02-13 wellnhofer@aevum.de Redirect links to xmlsoft.org 2022-02-13 wellnhofer@aevum.de Remove README.docs 2022-02-13 wellnhofer@aevum.de Remove MAINTAINERS 2022-02-13 wellnhofer@aevum.de Remove xmltutorial.pdf 2022-02-08 wellnhofer@aevum.de Fix regression in RelaxNG pattern matching 2022-02-12 wellnhofer@aevum.de Remove .travis.yml 2022-02-12 wellnhofer@aevum.de Try again to only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Try again to only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Upload documentation to GitLab pages 2022-01-26 wellnhofer@aevum.de Make xmlFuzzReadString return a zero size in error case 2022-02-07 wellnhofer@aevum.de Fix xmlSetTreeDoc with entity references 2022-02-07 wellnhofer@aevum.de Fix "xmllint -" 2022-02-07 wellnhofer@aevum.de Fix double counting of CRLF in comments 2022-02-07 wellnhofer@aevum.de Remove old ChangeLog 2022-02-07 wellnhofer@aevum.de Document how to escape XML_CATALOG_FILES 2022-02-07 wellnhofer@aevum.de Properly handle nested documents in xmlFreeNode 2022-02-07 wellnhofer@aevum.de Make sure to grow input buffer in xmlParseMisc 2022-02-04 wellnhofer@aevum.de Fix unused function warning in testapi.c 2022-02-04 wellnhofer@aevum.de Don't ignore xmllint options after "-" 2022-02-04 wellnhofer@aevum.de Don't normalize namespace URIs in XPointer xmlns() scheme 2022-02-03 wellnhofer@aevum.de Fix handling of XSD with empty namespace 2022-02-03 wellnhofer@aevum.de Update NewsML DTD in test suite 2022-02-01 wellnhofer@aevum.de Fix parsing of xmllint --maxmem option 2022-02-01 wellnhofer@aevum.de Also register HTML document nodes 2022-02-01 wellnhofer@aevum.de Add more checks for malloc failures in xmllint.c Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3528473 Bug: 934413 Change-Id: I7b8716b17d84a6c0a8c140996968db8cfab08735 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1269999Michael Brüning2022-04-1428-284/+304
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual update of libxml following upstream patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3422595: Roll libxml from dea91c97 to eab86522 2022-01-31 wellnhofer@aevum.de Make xmllint return an error if arguments are missing 2022-01-28 wellnhofer@aevum.de Avoid potential integer overflow in xmlstring.c 2021-07-07 ddkilzer@apple.com xmlAddChild() and xmlAddNextSibling() may not attach their second argument 2022-01-25 wellnhofer@aevum.de Run CI tests with UBSan implicit-conversion checks 2022-01-25 wellnhofer@aevum.de Fix casting of line numbers in SAX2.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warnings in hash.c 2022-01-25 wellnhofer@aevum.de Add explicit casts in runtest.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warning in xmlIconvWrapper 2022-01-25 wellnhofer@aevum.de Add suffix to unsigned constant in xmlmemory.c 2022-01-25 wellnhofer@aevum.de Add explicit casts in testchar.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warnings in xmlstring.c 2022-01-25 wellnhofer@aevum.de Add explicit cast in xmlURIUnescapeString 2022-01-25 wellnhofer@aevum.de Fix handling of ctxt->base in xmlXPtrEvalXPtrPart 2022-01-20 wellnhofer@aevum.de Remove wrong tarname from AC_INIT 2022-01-17 wellnhofer@aevum.de Remove old devhelp format 2022-01-16 wellnhofer@aevum.de Fix regression with PEs in external DTD 2022-01-16 wellnhofer@aevum.de Fix xmllint --maxmem 2021-11-03 huangduirong@huawei.com Fix Null-deref-in-xmlSchemaGetComponentTargetNs 2022-01-16 wellnhofer@aevum.de Fix libxml2.doap 2021-08-26 finnbarber@protonmail.com Added regression tests for xmlReadFd() and htmlReadFd() 2021-07-27 finnbarber@protonmail.com Fix htmlReadFd, which was using a mix of xml and html context functions 2022-01-16 wellnhofer@aevum.de Fix memory leak in xmlXPathCompNodeTest 2021-07-22 fanchunwei@src.gnome.org setup.py.in: Try to import setuptools 2021-07-22 fanchunwei@src.gnome.org Python distutils: Make DLL packaging more flexible 2021-07-22 fanchunwei@src.gnome.org tstmem.py: Try importing from libxmlmods.libxml2mod if needed 2021-03-30 fanchunwei@src.gnome.org python: Port python 3.x module to Windows 2021-11-03 mrazavi64@gmail.com Fix random dropping of characters on dumping ASCII encoded XML 2021-10-14 kjellahlstedt@gmail.com Update URL for libxml++ C++ binding 2022-01-16 wellnhofer@aevum.de Fix null pointer deref in xmlStringGetNodeList 2021-08-06 liyulin@pku.edu.cn move current position before possible calling of ctxt->sax->characters. 2021-07-29 mattia@mapreri.org Correctly install the HTML examples into their subdirectory. 2021-07-29 mattia@mapreri.org Refactor the settings of $docdir 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for functions 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for libraries 2021-07-26 ben.boeckel@kitware.com cmake: remove unused checks 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for headers 2021-07-26 ben.boeckel@kitware.com cmake: fix `ATTRIBUTE_DESTRUCTOR` definition 2021-07-23 ebassi@gnome.org Generate devhelp2 index file 2021-07-14 amigadave@amigadave.com Remove duplicated code in xmlcatalog 2021-07-14 amigadave@amigadave.com Fix leak in __xmlOutputBufferCreateFilename 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlRelaxNGNewDocParserCtxt 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlRelaxNGParseData 2021-07-14 amigadave@amigadave.com Fix memory leak in libxml_C14NDocSaveTo 2021-07-14 amigadave@amigadave.com Fix memory leak in libxml_saveNodeTo 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlNewInputFromFile 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlCreateIOParserCtxt 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlParseSGMLCatalog 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlParseCatalogFile 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlSAX2AttributeDecl 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlFreeParserInputBuffer 2021-07-07 ddkilzer@apple.com Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk 2021-07-05 jtojnar@gmail.com man: Mention XML_CATALOG_FILES is space-separated 2021-07-05 rainer.canavan@avenga.com add documentaiton for xmllint exit code 10 2021-06-28 sam@gentoo.org python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS 2022-01-16 wellnhofer@aevum.de Fix check for libtool in autogen.sh 2022-01-16 wellnhofer@aevum.de Add myself to maintainers 2022-01-15 wellnhofer@aevum.de Revert "Make schema validation fail with multiple top-level elements" 2022-01-10 wellnhofer@aevum.de Different approach to fix quadratic behavior in HTML push parser 2022-01-10 wellnhofer@aevum.de Fix regression when parsing invalid HTML tags in push mode 2022-01-10 wellnhofer@aevum.de Fix regression parsing public IDs literals in HTML Fixed: 1269999 Bug: 934413 Change-Id: I602a086b91d514cb80859237c48729d4c10cf83e Reviewed-by: Stephen Chenney <schenney@chromium.org> Commit-Queue: Joey Arhar <jarhar@chromium.org> Cr-Commit-Position: refs/heads/main@{#965736} Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml from a46e85f6 to dea91c97Joey Arhar2022-04-147-25/+46
| | | | | | | | | Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3069724 Bug: 934413 Change-Id: I04f0e89ae14359062a595326bb9e569fe49691d7 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml from bfd2f430 to a46e85f6Joey Arhar2022-04-1416-73/+122
| | | | | | | | | | | | | | | | | | | | | 2021-05-22 rickert@fortiss.org Update CMake project version 2021-05-22 rickert@fortiss.org Add CMake alias targets for embedded projects 2021-05-18 dking@redhat.com Fix some validation errors in the FAQ 2021-05-19 dking@redhat.com Remove unused variable in xmlCharEncOutFunc 2021-05-16 rickert@fortiss.org Add missing file xmlwin32version.h.in to EXTRA_DIST 2021-05-16 rickert@fortiss.org Add instructions on how to use CMake to compile libxml 2021-05-18 wellnhofer@aevum.de Work around lxml API abuse 2021-05-20 mike.dalessio@gmail.com fix: avoid segfault at exit when using custom memory functions 2021-05-13 veillard@redhat.com Release of libxml2-2.9.12 2021-05-13 veillard@redhat.com Release of libxml2-2.9.11 2021-05-13 veillard@redhat.com Patch for security issue CVE-2021-3541 Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2915101 Bug: 934413 Change-Id: I5b37109c0043fe16730b91d0eb032332b615c33a Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml to bfd2f430Joey Arhar2022-04-146-378/+141
| | | | | | | | | | | | | | | | | revert-non-recursive-xml-parsing.patch was fixed upstream, so this also removes the revert patch. The new test baselines are more correct than they used to be. One of the new libxml patches fixes line numbers, and you can see that's the only difference in the new baselines, and that the new line numbers are more correct than the old ones. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2878399 Bug: 934413 Change-Id: I7c2d239bdf12b055938868782852114aac586ee3 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml to 7279d236Joey Arhar2022-04-1418-286/+536
| | | | | | | | | | | | | This patch also adds --allow-empty to the git commit command for windows in the roll.py script since there are usually no changes for windows. libxslt's roll.py already does this for windows. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2866731 Bug: 934413 Change-Id: If055dabe61e5be77e4cf649f285f9b20c91ec3c6 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1280852Henrik Lundin2022-04-141-1/+6
| | | | | | | | | | | Adding fuzzer for PCM16b decoder and fixing a fuzzer problem Backport review link: https://webrtc-review.googlesource.com/c/src/+/251580 Bug: chromium:1280852 Change-Id: I732d44ddcd7b4c25c9c09932254820ab6cc85c46 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Add missing current_os for new cross compile toolchainsMichal Klocek2022-04-131-0/+2
| | | | | | | | | Fix arm64 build on 90-based. This amends ec4a16dc944302bdb87382e31c99e5b4be94fa0d Change-Id: Ie06d95827f2a8f03e747da873366bc2a0d5f1de9 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1125Adithya Srinivasan2022-04-061-0/+5
| | | | | | | | | | | | | Fix UAF in JavaScriptTabModalDialogManagerDelegateDesktop See bug for more details. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3465258 Bug: 1292261 Change-Id: Iebe499b4eda76b1b190f5f7b97a0938eb22dc405 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Secuirity Bug 1296876Clemens Backes2022-04-064-35/+26
| | | | | | | | | | | | | | | | | | | | | Fix bug in i32.atomic.sub32 {AtomicSub} on x64 first negates the {value} register, then does an atomic addition. For that reason, {value} should be a unique register. So far, we only checked that it's not used in the value stack, but we should also check for overlap with the destination address or the offset register. Drive-by: Remove unneeded handling of non-unique register index on arm, as that cannot happen (LiftoffCompiler ensures that the result register is unique). Backport review link: https://chromium-review.googlesource.com/c/v8/v8/+/3487987 Bug: chromium:1296876 Change-Id: Ie8299d320657e9e038a278eae46d4540cbe09662 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-0978Jamie Madill2022-04-062-2/+10
| | | | | | | | | | | | | | | | | | | | | Fix base level changes not updating FBO completeness check. M96 merge issues: - RendererVk.cpp: conflicting kSkippedSyncvalMessages entries - vk_helpers.cpp getRenderPassWriteCommandCount() not present in M96 - capture_replay_expectations.txt: conflicting skipped test entries - src/tests/gl_tests/FramebufferTest.cpp RedefineLayerAttachment not present in M96 Backport review link:: https://chromium-review.googlesource.com/c/angle/angle/+/3498282 Bug: chromium:1299264 Change-Id: I663f9e02364d3d716acfa615f8c30e1cca7ece1c Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
View Lorry Controller Status