Pino Toscano [Sun, 2 Aug 2020 08:49:03 +0000 (09:49 +0100)]
Limit Linux-only code with Q_OS_LINUX
Forwarded: no
Last-Update: 2020-04-19
The QStorageInfo/QStorageIterator implementation used for Linux is used also
on Hurd, as it uses an interface provided by GNU libc.
QStorageIterator::device() tries to use PATH_MAX (unavailable on the Hurd)
to lookup a /dev/block/ path, which exists on Linux only; hence, perform that
check within a Q_OS_LINUX block.
This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.
When including files, moc inserts a MOC_INCLUDE_BEGIN and
MOC_INCLUDE_END token into the token stream. Those are already handled
in the toplevel Moc::parse function, but parseEnum lacked support so
far.
Commit ae6f73e8566fa76470937aca737141183929a5ec inserted a mutex around
the entire load_sys(). We had reasoned that deadlocks would only occur if
the object creation in instance() recursed into its own instance(),
which was already a bug. But we had forgotten that dlopen()/
LoadLibrary() executes initialization code from the module being loaded,
which could cause a recursion back into the same QPluginLoader or
QLibrary object. This recursion is benign because the module *is* loaded
and dlopen()/LoadLibrary() returns the same handle.
Otherwise accessibility would only work when Orca is set to be started
in the session preference, and it would not work when running Orca or
compiz' zoom by hand.
The existing comment said that it was always true since gnome 3.6, but at
least in Debian 8's gnome 3.14, Debian 9's gnome 3.22, and Debian 10's
3.30 it is not always true, it is Orca which sets it on startup. Compiz's
focuspoll module also does so for people with low vision using zoom with
focus tracking.
Recursively defined entities can easily exhaust all available
memory. Limit entity expansion to a default of 4096 characters to
avoid DoS attacks when a user loads untrusted content.
Added a setter and getter to allow modifying the expansion limit.
QXmlStreamReader does now by default limit the expansion of entities
to 4096 characters. Documents where a single entity expands to more
characters than the limit are not considered well formed. The limit
is there to avoid DoS attacks through recursively expanding entities
when loading untrusted content. The limit can be changed through the
QXmlStreamReader::setEntityExpansionLimit() method.
* Backport upstream patch for moc to handle include directives in enums
(closes: #963955).
* Stop using -isystem flag in qmake (closes: #958479).
* Clarify warning message about PIC/PIE, thanks Daniel Kahn Gillmor
(closes: #879014).
* Update symbols files for GCC 10.
* Update libqt5gui5.lintian-overrides for tag renames in Lintian 2.79.
Pino Toscano [Fri, 26 Jun 2020 16:47:18 +0000 (17:47 +0100)]
Limit Linux-only code with Q_OS_LINUX
Forwarded: no
Last-Update: 2020-04-19
The QStorageInfo/QStorageIterator implementation used for Linux is used also
on Hurd, as it uses an interface provided by GNU libc.
QStorageIterator::device() tries to use PATH_MAX (unavailable on the Hurd)
to lookup a /dev/block/ path, which exists on Linux only; hence, perform that
check within a Q_OS_LINUX block.
This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.
Commit ae6f73e8566fa76470937aca737141183929a5ec inserted a mutex around
the entire load_sys(). We had reasoned that deadlocks would only occur if
the object creation in instance() recursed into its own instance(),
which was already a bug. But we had forgotten that dlopen()/
LoadLibrary() executes initialization code from the module being loaded,
which could cause a recursion back into the same QPluginLoader or
QLibrary object. This recursion is benign because the module *is* loaded
and dlopen()/LoadLibrary() returns the same handle.
Otherwise accessibility would only work when Orca is set to be started
in the session preference, and it would not work when running Orca or
compiz' zoom by hand.
The existing comment said that it was always true since gnome 3.6, but at
least in Debian 8's gnome 3.14, Debian 9's gnome 3.22, and Debian 10's
3.30 it is not always true, it is Orca which sets it on startup. Compiz's
focuspoll module also does so for people with low vision using zoom with
focus tracking.
Recursively defined entities can easily exhaust all available
memory. Limit entity expansion to a default of 4096 characters to
avoid DoS attacks when a user loads untrusted content.
Added a setter and getter to allow modifying the expansion limit.
QXmlStreamReader does now by default limit the expansion of entities
to 4096 characters. Documents where a single entity expands to more
characters than the limit are not considered well formed. The limit
is there to avoid DoS attacks through recursively expanding entities
when loading untrusted content. The limit can be changed through the
QXmlStreamReader::setEntityExpansionLimit() method.
This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.
Otherwise accessibility would only work when Orca is set to be started
in the session preference, and it would not work when running Orca or
compiz' zoom by hand.
The existing comment said that it was always true since gnome 3.6, but at
least in Debian 8's gnome 3.14, Debian 9's gnome 3.22, and Debian 10's
3.30 it is not always true, it is Orca which sets it on startup. Compiz's
focuspoll module also does so for people with low vision using zoom with
focus tracking.
Recursively defined entities can easily exhaust all available
memory. Limit entity expansion to a default of 4096 characters to
avoid DoS attacks when a user loads untrusted content.
Added a setter and getter to allow modifying the expansion limit.
QXmlStreamReader does now by default limit the expansion of entities
to 4096 characters. Documents where a single entity expands to more
characters than the limit are not considered well formed. The limit
is there to avoid DoS attacks through recursively expanding entities
when loading untrusted content. The limit can be changed through the
QXmlStreamReader::setEntityExpansionLimit() method.
I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to
find libraries in a haswell/ subdir of the main path, but we only need
to do that transformation if the library is contains at least one
directory separator. That is, if the user asks to load "lib/foo", then we
should try "lib/haswell/foo" (often, the path prefix will be absolute).
When the library name the user requested has no directory separators, we
let dlopen() do the transformation for us. Testing on Linux confirms
glibc does so:
Commit 80dea664 broke .ui files with global includes that are not part
of the project, because we blindly added every file path that falls
out of 'uic -d' as dependency.
Introduce the extra compiler CONFIG flag dep_existing_only to bring
back the old behavior that ignores non-existent dependencies and set
it for uic.
backport some fixes related to documentation building
Origin: upstream, this is a backport of four commits:
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=0014d81b1907621e
doc: Revert to documenting the actual functions
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=81d8319276f26d39
doc: Fix all clang parse errors in QtBase during PCH build
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=c306663990ba8681
Fix qdoc errors in QProcess header
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=98cb9275d064d8b9
doc: clang reported two fake declarations to be the same
Last-Update: 2019-06-15
These changes help us to eliminate most of the warnings like this:
(qdoc) warning: No documentation for 'QRect::bottom() const'
There were 3603 such warnings without this patch, with it only 76
are left.
Daniel Vrátil [Sat, 1 Dec 2018 16:56:41 +0000 (17:56 +0100)]
[PATCH] MySQL: Free the results when QSqlQuery::finished() is called
Calling mysql_stmt_free_result() frees the results of the last
executed query while keeping the prepared statement valid. This
allows one to keep around prepared QSqlQueries without the overhead
of keeping all the results in memory.
Change-Id: I4589e90857cc4e9a6f9612799bfca967a67e2ab2 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Gbp-Pq: Name mysql_free_results_when_qsqlquery_finished_is_called.patch
* Enable accessibility on Linux when org.a11y.Status IsEnabled is true.
Thanks to Samuel Thibault (closes: #948676).
* Backport upstream patch to fix use-after-free in GLib event dispatcher
(closes: #953401).
This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.
Recursively defined entities can easily exhaust all available
memory. Limit entity expansion to a default of 4096 characters to
avoid DoS attacks when a user loads untrusted content.
Added a setter and getter to allow modifying the expansion limit.
QXmlStreamReader does now by default limit the expansion of entities
to 4096 characters. Documents where a single entity expands to more
characters than the limit are not considered well formed. The limit
is there to avoid DoS attacks through recursively expanding entities
when loading untrusted content. The limit can be changed through the
QXmlStreamReader::setEntityExpansionLimit() method.
I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to
find libraries in a haswell/ subdir of the main path, but we only need
to do that transformation if the library is contains at least one
directory separator. That is, if the user asks to load "lib/foo", then we
should try "lib/haswell/foo" (often, the path prefix will be absolute).
When the library name the user requested has no directory separators, we
let dlopen() do the transformation for us. Testing on Linux confirms
glibc does so:
Commit 80dea664 broke .ui files with global includes that are not part
of the project, because we blindly added every file path that falls
out of 'uic -d' as dependency.
Introduce the extra compiler CONFIG flag dep_existing_only to bring
back the old behavior that ignores non-existent dependencies and set
it for uic.
backport some fixes related to documentation building
Origin: upstream, this is a backport of four commits:
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=0014d81b1907621e
doc: Revert to documenting the actual functions
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=81d8319276f26d39
doc: Fix all clang parse errors in QtBase during PCH build
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=c306663990ba8681
Fix qdoc errors in QProcess header
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=98cb9275d064d8b9
doc: clang reported two fake declarations to be the same
Last-Update: 2019-06-15
These changes help us to eliminate most of the warnings like this:
(qdoc) warning: No documentation for 'QRect::bottom() const'
There were 3603 such warnings without this patch, with it only 76
are left.
Daniel Vrátil [Sat, 1 Dec 2018 16:56:41 +0000 (17:56 +0100)]
[PATCH] MySQL: Free the results when QSqlQuery::finished() is called
Calling mysql_stmt_free_result() frees the results of the last
executed query while keeping the prepared statement valid. This
allows one to keep around prepared QSqlQueries without the overhead
of keeping all the results in memory.
Change-Id: I4589e90857cc4e9a6f9612799bfca967a67e2ab2 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Gbp-Pq: Name mysql_free_results_when_qsqlquery_finished_is_called.patch
[ Dmitry Shachnev ]
* Backport upstream patch to add an expansion limit for XML entities
(CVE-2015-9541, closes: #951066).
- Add two new symbols to debian/libqt5core5a.symbols.
[ Helmut Grohne ]
* qmake cross wrapper should pass QMAKE_STRIP. (Closes: #950507)
This code makes Lintian unhappy. But we are really not using it, it only
gets inserted when building the online doc.
Anyways the best way to calm down Lintian is to simply remove it.
I added the code in commit 5219c37f7c98f37f078fee00fe8ca35d83ff4f5d to
find libraries in a haswell/ subdir of the main path, but we only need
to do that transformation if the library is contains at least one
directory separator. That is, if the user asks to load "lib/foo", then we
should try "lib/haswell/foo" (often, the path prefix will be absolute).
When the library name the user requested has no directory separators, we
let dlopen() do the transformation for us. Testing on Linux confirms
glibc does so:
Commit 80dea664 broke .ui files with global includes that are not part
of the project, because we blindly added every file path that falls
out of 'uic -d' as dependency.
Introduce the extra compiler CONFIG flag dep_existing_only to bring
back the old behavior that ignores non-existent dependencies and set
it for uic.
backport some fixes related to documentation building
Origin: upstream, this is a backport of four commits:
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=0014d81b1907621e
doc: Revert to documenting the actual functions
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=81d8319276f26d39
doc: Fix all clang parse errors in QtBase during PCH build
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=c306663990ba8681
Fix qdoc errors in QProcess header
- https://code.qt.io/cgit/qt/qtbase.git/commit/?id=98cb9275d064d8b9
doc: clang reported two fake declarations to be the same
Last-Update: 2019-06-15
These changes help us to eliminate most of the warnings like this:
(qdoc) warning: No documentation for 'QRect::bottom() const'
There were 3603 such warnings without this patch, with it only 76
are left.
Daniel Vrátil [Sat, 1 Dec 2018 16:56:41 +0000 (17:56 +0100)]
[PATCH] MySQL: Free the results when QSqlQuery::finished() is called
Calling mysql_stmt_free_result() frees the results of the last
executed query while keeping the prepared statement valid. This
allows one to keep around prepared QSqlQueries without the overhead
of keeping all the results in memory.
Change-Id: I4589e90857cc4e9a6f9612799bfca967a67e2ab2 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com> Reviewed-by: Andy Shaw <andy.shaw@qt.io>
Gbp-Pq: Name mysql_free_results_when_qsqlquery_finished_is_called.patch
* Revert adding alternative qtbase5-gles-dev dependencies:
- For qtbase5-private-dev: it is wrong, those who need private headers
and OpenGL ES specific API should use qtbase5-private-gles-dev, not
qtbase5-private-dev.
- For libqt5opengl5-dev: it does not help, libqt5opengl5 uses desktop
OpenGL specific symbols, so it is not installable with libqt5gui5-gles.
* Remove explicit libqt5gui5 | libqt5gui5-gles dependencies from the
platformtheme packages. Rely on ${shlibs:Depends} instead.
* Override the remaining version-substvar-for-external-package error.
* Backport fixes for two vulnerabilities:
- CVE-2020-0569: Do not load plugin from the CWD.
- CVE-2020-0570: Qt tries to load invalid library from CWD.
* Make Qt 5 the default configuration in qtchooser, by installing the
qt-default/qtchooser/default.conf symlink in libqt5core5a package.
* Bump Standards-Version to 4.5.0, no changes needed.
projects / qtbase-opensource-src.git / log