Skip to content

Commit 9bd52ec

Browse files
Patch qtsvg for CVE-2025-10728
1 parent 792cfc1 commit 9bd52ec

File tree

2 files changed

+61
-1
lines changed

2 files changed

+61
-1
lines changed

SPECS/qtsvg/CVE-2025-10728.patch

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
From 17878e6b10471dd28af590d9733ee9b996e86258 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Tue, 14 Oct 2025 09:58:40 +0000
4+
Subject: [PATCH] Replace check for endless recursion when loading
5+
6+
The old check parsed the tree of SvgNodes again and again which lead to
7+
quadratic complexity. Instead, set and check a bool where the recursion
8+
may actually happen which is faster and only has linear complexity.
9+
10+
Partially reverts 0332df304f013ded362537c1f61556098b875352
11+
12+
I chose to have the check in QSvgPattern::renderPattern() because:
13+
14+
- It not only appears in the recursive backtrace of the stack-overflow
15+
which was fixed using the qudratic check, but also in the backtrace
16+
of another, still unfixed stack overflow. That way, both can be fixed
17+
by the same patch. Credit to OSS-Fuzz for finding them.
18+
- The function already had some error checking and returns a default
19+
value when it cannot render the content. In the same way, I can return
20+
a QImage of the right size but without any content when the endless
21+
recursion is about to happen.
22+
23+
[ChangeLog] Speed up loading by replacing check for cyclic elements
24+
[ChangeLog] Fix stack overflow when an element references its child
25+
element using url()
26+
27+
Fixes: QTBUG-137553
28+
Pick-to: 6.8
29+
Change-Id: If011c15fde50dcefeb653d1d5995ff1347e7b5ac
30+
Reviewed-by: Hatem ElKharashy <[email protected]>
31+
(cherry picked from commit 9e5bed9584ab65d56cd5fbac0471e06e37a54412)
32+
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
33+
(cherry picked from commit 90a5331640bb760b0114a7ea4e08b9e42b03e082)
34+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
35+
Upstream-reference: AI Backport of https://github.com/qt/qtsvg/commit/ea44b50c6e61104cadd6b7c8ede92a4108634232.patch
36+
---
37+
src/svg/qsvghandler.cpp | 3 +++
38+
1 file changed, 3 insertions(+)
39+
40+
diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
41+
index 335500a..fb0f131 100644
42+
--- a/src/svg/qsvghandler.cpp
43+
+++ b/src/svg/qsvghandler.cpp
44+
@@ -3663,6 +3663,9 @@ void QSvgHandler::parse()
45+
// namespaceUri is empty. The only possible strategy at
46+
// this point is to do what everyone else seems to do and
47+
// ignore the reported namespaceUri completely.
48+
+ // NOTE: Previously, a quadratic cycle-detection check was performed here.
49+
+ // It has been removed to improve performance; cycle detection now occurs
50+
+ // after parsing and resolution, which is linear overall.
51+
if (remainingUnfinishedElements
52+
&& startElement(xml->name().toString(), xml->attributes())) {
53+
--remainingUnfinishedElements;
54+
--
55+
2.45.4
56+

SPECS/qtsvg/qtsvg.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@
44
Summary: Qt6 - Support for rendering and displaying SVG
55
Name: qtsvg
66
Version: 6.6.1
7-
Release: 2%{?dist}
7+
Release: 3%{?dist}
88
# See LICENSE.GPL3-EXCEPT.txt, for exception details
99
License: GFDL AND GPLv2+ WITH exceptions AND LGPLv2.1+
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
1212
URL: https://www.qt.io
1313
Source0: https://download.qt.io/archive/qt/%{majmin}/%{version}/submodules/qtsvg-everywhere-src-%{version}.tar.xz
14+
Patch0: CVE-2025-10728.patch
1415
%{?_qt5:Requires: %{_qt}%{?_isa} = %{_qt_version}}
1516
BuildRequires: qtbase-devel >= %{version}
1617
BuildRequires: qtbase-private-devel
@@ -89,6 +90,9 @@ popd
8990

9091

9192
%changelog
93+
* Tue Oct 14 2025 Azure Linux Security Servicing Account <[email protected]> - 6.6.1-3
94+
- Patch for CVE-2025-10728
95+
9296
* Mon Apr 07 2025 Andrew Phelps <[email protected]> - 6.6.1-2
9397
- Bump release to recompile with qtbase-devel-6.6.3
9498

0 commit comments

Comments
 (0)