|
| 1 | +From 926c72f641cd122e1e8fc9f92f0fea885d3c8ede Mon Sep 17 00:00:00 2001 |
| 2 | +From: Mykhailo Bykhovtsev < [email protected]> |
| 3 | +Date: Wed, 23 Oct 2024 16:13:23 -0700 |
| 4 | +Subject: [PATCH] patch CVE-2022-25255 |
| 5 | +Patch taken from https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff |
| 6 | + |
| 7 | +--- |
| 8 | + src/corelib/io/qprocess_unix.cpp | 28 +++++++++++++++------------- |
| 9 | + 1 file changed, 15 insertions(+), 13 deletions(-) |
| 10 | + |
| 11 | +diff --git a/src/corelib/io/qprocess_unix.cpp b/src/corelib/io/qprocess_unix.cpp |
| 12 | +index 7a2daa2a..29b771a1 100644 |
| 13 | +--- a/src/corelib/io/qprocess_unix.cpp |
| 14 | ++++ b/src/corelib/io/qprocess_unix.cpp |
| 15 | +@@ -1,7 +1,7 @@ |
| 16 | + /**************************************************************************** |
| 17 | + ** |
| 18 | + ** Copyright (C) 2016 The Qt Company Ltd. |
| 19 | +-** Copyright (C) 2016 Intel Corporation. |
| 20 | ++** Copyright (C) 2022 Intel Corporation. |
| 21 | + ** Contact: https://www.qt.io/licensing/ |
| 22 | + ** |
| 23 | + ** This file is part of the QtCore module of the Qt Toolkit. |
| 24 | +@@ -422,14 +422,15 @@ void QProcessPrivate::startProcess() |
| 25 | + // Add the program name to the argument list. |
| 26 | + argv[0] = nullptr; |
| 27 | + if (!program.contains(QLatin1Char('/'))) { |
| 28 | ++ // findExecutable() returns its argument if it's an absolute path, |
| 29 | ++ // otherwise it searches $PATH; returns empty if not found (we handle |
| 30 | ++ // that case much later) |
| 31 | + const QString &exeFilePath = QStandardPaths::findExecutable(program); |
| 32 | +- if (!exeFilePath.isEmpty()) { |
| 33 | +- const QByteArray &tmp = QFile::encodeName(exeFilePath); |
| 34 | +- argv[0] = ::strdup(tmp.constData()); |
| 35 | +- } |
| 36 | +- } |
| 37 | +- if (!argv[0]) |
| 38 | ++ const QByteArray &tmp = QFile::encodeName(exeFilePath); |
| 39 | ++ argv[0] = ::strdup(tmp.constData()); |
| 40 | ++ } else { |
| 41 | + argv[0] = ::strdup(encodedProgramName.constData()); |
| 42 | ++ } |
| 43 | + |
| 44 | + // Add every argument to the list |
| 45 | + for (int i = 0; i < arguments.count(); ++i) |
| 46 | +@@ -975,15 +976,16 @@ bool QProcessPrivate::startDetached(qint64 *pid) |
| 47 | + envp = _q_dupEnvironment(environment.d.constData()->vars, &envc); |
| 48 | + } |
| 49 | + |
| 50 | +- QByteArray tmp; |
| 51 | + if (!program.contains(QLatin1Char('/'))) { |
| 52 | ++ // findExecutable() returns its argument if it's an absolute path, |
| 53 | ++ // otherwise it searches $PATH; returns empty if not found (we handle |
| 54 | ++ // that case much later) |
| 55 | + const QString &exeFilePath = QStandardPaths::findExecutable(program); |
| 56 | +- if (!exeFilePath.isEmpty()) |
| 57 | +- tmp = QFile::encodeName(exeFilePath); |
| 58 | ++ const QByteArray &tmp = QFile::encodeName(exeFilePath); |
| 59 | ++ argv[0] = ::strdup(tmp.constData()); |
| 60 | ++ } else { |
| 61 | ++ argv[0] = ::strdup(QFile::encodeName(program)); |
| 62 | + } |
| 63 | +- if (tmp.isEmpty()) |
| 64 | +- tmp = QFile::encodeName(program); |
| 65 | +- argv[0] = tmp.data(); |
| 66 | + |
| 67 | + if (envp) |
| 68 | + qt_safe_execve(argv[0], argv, envp); |
| 69 | +-- |
| 70 | +2.34.1 |
| 71 | + |
0 commit comments