CVE-2011-1168, Konqueror Partially Universal XSS in Error Pages

Conflicts:
	.gitignore

.gitignore

@@ -1,2 +1 @@
-/kdelibs-4.5.2.tar.bz2
-/kdelibs-4.5.3.tar.bz2
+/kdelibs-4.5.5.tar.bz2

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: kdelibs
-# $Id$
-NAME := kdelibs
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attempt a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

import.log

@@ -1 +0,0 @@
-kdelibs-4_1_69-1_fc10:HEAD:kdelibs-4.1.69-1.fc10.src.rpm:1224265644

kdelibs-4.4.2-kpixmapcache.patch

@@ -0,0 +1,168 @@
+--- branches/KDE/4.4/kdelibs/kdeui/util/kpixmapcache.cpp	2010/01/24 02:37:20	1079318
++++ branches/KDE/4.4/kdelibs/kdeui/util/kpixmapcache.cpp	2010/03/25 02:24:54	1107210
+@@ -40,6 +40,7 @@
+ #include <kstandarddirs.h>
+ #include <kdebug.h>
+ #include <klockfile.h>
++#include <ksavefile.h>
+ #include <ksvgrenderer.h>
+ #include <kdefakes.h>
+ 
+@@ -633,6 +634,10 @@
+     qint32 leftchild, rightchild;
+     stream >> fkey >> foffset >> timesused >> lastused >> leftchild >> rightchild;
+ 
++    if (fkey.isEmpty()) {
++        return start;
++    }
++
+     if (key < fkey) {
+         if (leftchild) {
+             return binarySearchKey(stream, key, leftchild);
+@@ -660,12 +665,23 @@
+     //  exist yet and there are no entries. Otherwise, do a binary search
+     //  starting from the root node.
+     if (!stream.atEnd()) {
++        // One exception is that the root node may exist but be invalid,
++        // which can happen when the cache data is discarded. This is
++        // represented by an empty fkey
++        QString fkey;
++        stream >> fkey;
++
++        if (fkey.isEmpty()) {
++            delete device;
++            return -1;
++        }
++
+         int nodeoffset = binarySearchKey(stream, key, mIndexRootOffset);
+ 
+         // Load the found entry and check if it's the one we're looking for.
+         device->seek(nodeoffset);
+-        QString fkey;
+         stream >> fkey;
++
+         if (fkey == key) {
+             // Read offset and statistics
+             qint32 foffset;
+@@ -814,7 +830,9 @@
+         QString fkey;
+         stream.device()->seek(parentoffset);
+         stream >> fkey;
+-        if (key == fkey) {
++
++        // The key would be empty if the cache had been discarded.
++        if (key == fkey || fkey.isEmpty()) {
+             // We're overwriting an existing entry
+             offset = parentoffset;
+         }
+@@ -1195,16 +1213,14 @@
+         return false;
+     }
+ 
+-    d->invalidateMmapFiles();
+-    d->unmmapFiles();
+-
+-    d->mEnabled = false;
+-
+     KPCLockFile lock(d->mLockFileName);
+     // Hope we got the lock...
+ 
++    d->invalidateMmapFiles();
++    d->mEnabled = false;
++
+     // Create index file
+-    QFile indexfile(d->mIndexFile);
++    KSaveFile indexfile(d->mIndexFile);
+     if (!indexfile.open(QIODevice::WriteOnly)) {
+         kError() << "Couldn't create index file" << d->mIndexFile;
+         return false;
+@@ -1212,7 +1228,7 @@
+ 
+     d->mCacheId = ::time(0);
+     d->mTimestamp = ::time(0);
+-    
++
+     // We can't know the full size until custom headers written.
+     // mmapFiles() will take care of correcting the size.
+     KPixmapCacheIndexHeader indexHeader = { {0}, KPIXMAPCACHE_VERSION, 0, d->mCacheId, d->mTimestamp };
+@@ -1221,7 +1237,7 @@
+     indexfile.write(reinterpret_cast<char*>(&indexHeader), sizeof indexHeader);
+ 
+     // Create data file
+-    QFile datafile(d->mDataFile);
++    KSaveFile datafile(d->mDataFile);
+     if (!datafile.open(QIODevice::WriteOnly)) {
+         kError() << "Couldn't create data file" << d->mDataFile;
+         return false;
+@@ -1243,40 +1259,54 @@
+     // Close the files and mmap them (if mmapping is used)
+     indexfile.close();
+     datafile.close();
++    indexfile.finalize();
++    datafile.finalize();
++
+     d->mEnabled = true;
+     d->mmapFiles();
++
+     return true;
+ }
+ 
+ void KPixmapCache::deleteCache(const QString& name)
+ {
+-    foreach (KPixmapCache::Private *d, Private::mCaches) {
+-        if (d->mName == name && d->mInited) {
+-            d->q->discard();
+-        }
+-    }
++    QString indexFile = KGlobal::dirs()->locateLocal("cache", "kpc/" + name + ".index");
++    QString dataFile  = KGlobal::dirs()->locateLocal("cache", "kpc/" + name + ".data");
++
++    QFile::remove(indexFile);
++    QFile::remove(dataFile);
+ }
+ 
+ void KPixmapCache::discard()
+ {
+-    d->invalidateMmapFiles();
+-    d->unmmapFiles();
+-    d->mInited = false;
++    // To "discard" the cache we simply have to make sure that every that
++    // was in there before is no longer present when we search for them.
++    // Easiest way to do *that* is to simply delete the index.
++
++    KPCLockFile lock(d->mLockFileName);
++    if(!lock.isValid()) {
++        kError(264) << "Unable to lock pixmap cache when trying to discard it";
++        return;
++    }
++
++    QIODevice *device = d->indexDevice();
++    if (!device) {
++        kError(264) << "Unable to access index when trying to discard cache";
++        return;
++    }
++
++    device->seek(d->mIndexRootOffset);
++    QDataStream stream(device);
++
++    // Stream an empty QString as the hash key to signify that the cache
++    // has been discarded.
++    stream << QString();
+ 
+     if (d->mUseQPixmapCache) {
+         // TODO: This is broken, it removes every cached QPixmap in the whole
+         // process, not just this KPixmapCache.
+         QPixmapCache::clear();
+     }
+-
+-    QString indexFile = KGlobal::dirs()->locateLocal("cache", "kpc/" + d->mName + ".index");
+-    QString dataFile  = KGlobal::dirs()->locateLocal("cache", "kpc/" + d->mName + ".data");
+-
+-    QFile::remove(indexFile);
+-    QFile::remove(dataFile);
+-
+-    // No need to remove the lockfile
+-    d->init();
+ }
+ 
+ void KPixmapCache::removeEntries(int newsize)

kdelibs-4.5.3-kde246652.patch

@@ -1,46 +0,0 @@
---- branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguiclient.cpp	2010/11/16 00:37:04	1197481
-+++ branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguiclient.cpp	2010/11/16 00:37:17	1197482
-@@ -97,10 +97,12 @@
-   }
- 
-   if ( d->m_factory ) {
--    d->m_factory->removeClient ( this );
-+    d->m_factory->forgetClient(this);
-   }
-- 
-+
-   foreach (KXMLGUIClient* client, d->m_children) {
-+      if (d->m_factory)
-+          d->m_factory->forgetClient(client);
-       assert( client->d->m_parent == this );
-       client->d->m_parent = 0;
-   }
---- branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguifactory.cpp	2010/11/16 00:37:04	1197481
-+++ branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguifactory.cpp	2010/11/16 00:37:17	1197482
-@@ -388,6 +388,11 @@
-     refreshActionProperties();
- }
- 
-+void KXMLGUIFactory::forgetClient( KXMLGUIClient *client )
-+{
-+    d->m_clients.removeAll( client );
-+}
-+
- void KXMLGUIFactory::removeClient( KXMLGUIClient *client )
- {
-     //kDebug(260) << client;
---- branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguifactory.h	2010/11/16 00:37:04	1197481
-+++ branches/KDE/4.5/kdelibs/kdeui/xmlgui/kxmlguifactory.h	2010/11/16 00:37:17	1197482
-@@ -216,7 +216,11 @@
-     void makingChanges(bool);
- 
- private:
--  KXMLGUIFactoryPrivate *const d;
-+    friend class KXMLGUIClient;
-+    /// Internal, called by KXMLGUIClient destructor
-+    void forgetClient(KXMLGUIClient *client);
-+
-+    KXMLGUIFactoryPrivate *const d;
- };
- 
- #endif

kdelibs-4.5.5-CVE-2011-1168.patch

@@ -0,0 +1,15 @@
+diff -up kdelibs-4.5.5/khtml/khtml_part.cpp.me kdelibs-4.5.5/khtml/khtml_part.cpp
+--- kdelibs-4.5.5/khtml/khtml_part.cpp.me	2011-04-11 16:48:49.000000000 +0200
++++ kdelibs-4.5.5/khtml/khtml_part.cpp	2011-04-11 16:50:27.000000000 +0200
+@@ -1803,7 +1803,10 @@ void KHTMLPart::htmlError( int errorCode
+   stream >> errorName >> techName >> description >> causes >> solutions;
+ 
+   QString url, protocol, datetime;
+-  url = Qt::escape( reqUrl.prettyUrl() );
++
++  // This is somewhat confusing, but we have to escape the externally-
++  // controlled URL twice: once for i18n, and once for HTML.
++  url = Qt::escape( Qt::escape( reqUrl.prettyUrl() ) );
+   protocol = reqUrl.protocol();
+   datetime = KGlobal::locale()->formatDateTime( QDateTime::currentDateTime(),
+                                                 KLocale::LongDate );

kdelibs.spec

@@ -1,18 +1,22 @@
-
-%define attica_ver 0.1.4
-%define dbusmenu_qt_ver 0.5.2
-%define phonon_ver 4.4.2
-%define qt4_ver 4.6.2
-%define soprano_ver 2.5.0
-%define strigi_ver 0.7.2
+%global attica_ver 0.1.4
+%global dbusmenu_qt_ver 0.5.2
+%global phonon_ver 4.4.2
+%global qt4_ver 4.6.2
+%global soprano_ver 2.5.0
+%global strigi_ver 0.7.2
 # to build/include apidocs or not
-%define apidocs 1
+#global apidocs 1
 # to build/include QCH apidocs or not (currently broken)
 #define apidocs_qch 1
 
+%global dbusmenu_qt_version %(pkg-config --modversion dbusmenu-qt 2>/dev/null || echo %{dbusmenu_qt_ver})
+%global phonon_version %(pkg-config --modversion phonon 2>/dev/null || echo %{phonon_ver})
+%global soprano_version %(pkg-config --modversion soprano 2>/dev/null || echo %{soprano_ver})
+%global strigi_version %(pkg-config --modversion libstreams 2>/dev/null || echo %{strigi_ver})
+
 Summary: KDE Libraries
-Version: 4.5.3
-Release: 3%{?dist}
+Version: 4.5.5
+Release: 2%{?dist}
 
 Name: kdelibs
 Epoch: 6
@@ -30,8 +34,8 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: kde4-macros(api) >= 2
 BuildRequires: kde-filesystem >= 4-23
 BuildRequires: docbook-dtds docbook-style-xsl
+
 Requires: ca-certificates
-%global dbusmenu_qt_version %(pkg-config --modversion dbusmenu-qt 2>/dev/null || echo %{dbusmenu_qt_ver})
 Requires: dbusmenu-qt%{?_isa} >= %{dbusmenu_qt_version}
 Requires: docbook-dtds docbook-style-xsl
 Requires: hicolor-icon-theme
@@ -44,39 +48,47 @@ Requires: hal
 Requires: hunspell
 # beware of possible bootstrapping problems -- Rex
 Requires: oxygen-icon-theme >= %{version}
-%global phonon_version %(pkg-config --modversion phonon 2>/dev/null || echo %{phonon_ver})
 Requires: phonon%{?_isa} >= %{phonon_version} 
-Requires: shared-desktop-ontologies
+Requires: shared-desktop-ontologies >= 0.4
 Requires: shared-mime-info
-%global soprano_version %(pkg-config --modversion soprano 2>/dev/null || echo %{soprano_ver})
 Requires: soprano%{?_isa} >= %{soprano_version} 
-%global strigi_version %(pkg-config --modversion libstreams 2>/dev/null || echo %{strigi_ver})
 Requires: strigi-libs%{?_isa} >= %{strigi_version} 
 
 # make -devel packages parallel-installable
 Patch0: kdelibs-4.4.85-parallel_devel.patch
+
 # fix kde#149705
 Patch2: kdelibs-4.2.85-kde149705.patch
+
 # install all .css files and Doxyfile.global in kdelibs-common to build
 # kdepimlibs-apidocs against
 Patch8: kdelibs-4.3.90-install_all_css.patch
+
 # add Fedora/V-R to KHTML UA string
 Patch9: kdelibs-4.0.2-branding.patch
+
 # don't cache kdeglobals paths because they change after profile directories
 # are loaded from kde4rc
 Patch10: kdelibs-4.1.72-no-cache-kdeglobals-paths.patch
+
 # workaround for policykit
 Patch11: kdelibs-4.4.80-policykit-workaround.patch
-# COMMENT ME PLEASE 
+
+# fedora/rhel applications menu
 Patch12: kdelibs-4.1.0-xdg-menu.patch
+
 # patch KStandardDirs to use %{_libexecdir}/kde4 instead of %{_libdir}/kde4/libexec
 Patch14: kdelibs-4.4.80-libexecdir.patch
+
 # kstandarddirs changes: search /etc/kde, find %{_kde4_libexecdir}
 Patch18: kdelibs-4.1.72-kstandarddirs.patch
-# COMMENT ME PLEASE
+
+# set correct build type
 Patch20: kdelibs-4.1.70-cmake.patch
+
 # disable drkonqi by default, RHEL prefers/wants abrt
 Patch24: kdelibs-4.3.1-drkonq.patch
+
 # die rpath die, since we're using standard paths, we can avoid
 # this extra hassle (even though cmake is *supposed* to not add standard
 # paths (like /usr/lib64) already! With this, we can drop
@@ -89,9 +101,7 @@ Patch27: kdelibs-4.4.80-no_rpath.patch
 # TODO: try to use either gpg or gpg2, whichever is available
 Patch50: kdelibs-4.5.1-knewstuff_gpg2.patch
 
-## 4.5 upstream
-# http://websvn.kde.org/?view=revision&revision=1197482
-Patch100: kdelibs-4.5.3-kde246652.patch
+## 4.5 upstream, stable branch
 
 ## trunk upstream
 # http://websvn.kde.org/?view=revision&revision=1185912
@@ -100,6 +110,9 @@ Patch151: kdelibs-4.5.2-plasma_wallpaper_configchanged.patch
 ## security fix
 # Not Upstreamed? why not ? -- Rex
 Patch200: kdelibs-4.3.1-CVE-2009-2702.patch
+# Konqueror Partially Universal XSS in Error Pages
+# http://www.kde.org/info/security/advisory-20110411-1.txt
+Patch201: kdelibs-4.5.5-CVE-2011-1168.patch
 
 %if 0%{?fedora} && 0%{?fedora} < 13
 Conflicts: kdebase-workspace-libs < 4.3.80
@@ -138,7 +151,7 @@ BuildRequires: pcre-devel
 BuildRequires: phonon-devel >= %{phonon_ver} 
 BuildRequires: polkit-qt-devel
 BuildRequires: qca2-devel
-BuildRequires: shared-desktop-ontologies-devel
+BuildRequires: shared-desktop-ontologies-devel >= 0.4
 BuildRequires: shared-mime-info
 BuildRequires: soprano-devel >= %{soprano_ver} 
 BuildRequires: strigi-devel >= %{strigi_ver} 
@@ -246,8 +259,6 @@ format for use with the Qt 4 Assistant or KDevelop 4.
 %patch2 -p1 -b .kde149705
 %patch8 -p1 -b .install_all_css
 %patch9 -p1 -b .branding
-# add release version as part of branding (suggested by cailon)
-sed -i -e "s|@@VERSION_RELEASE@@|%{version}-%{release}|" kio/kio/kprotocolmanager.cpp
 %patch11 -p1 -b .policykit-workaround
 %patch12 -p1 -b .Administration-menu
 %patch14 -p1 -b .libexecdir
@@ -261,16 +272,19 @@ sed -i -e "s|@@VERSION_RELEASE@@|%{version}-%{release}|" kio/kio/kprotocolmanage
 # upstreamable patches
 %patch50 -p1 -b .knewstuff_gpg2
 
-# upstream patches
-%patch100 -p4 -b .kde246652
+# upstream patches, stable branch
+
+# upstream patches, trunk
 %patch151 -p3 -b .plasma_wallpaper_configchanged
 
 # security fix
 %patch200 -p1 -b .CVE-2009-2702
+%patch201 -p1 -b .CVE-2011-1168
 
+# add release version as part of branding (suggested by cailon)
+sed -i -e "s|@@VERSION_RELEASE@@|%{version}-%{release}|" kio/kio/kprotocolmanager.cpp
 
 %build
-
 mkdir -p %{_target_platform}
 pushd %{_target_platform}
 %{cmake_kde4} -DKDE_DISTRIBUTION_TEXT="%{version}-%{release} Fedora" ..
@@ -508,6 +522,18 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Mon Apr 11 2011 Than Ngo <than@redhat.com> - 4.5.5-2
+- CVE-2011-1168, Konqueror Partially Universal XSS in Error Pages
+
+* Wed Jan 05 2011 Rex Dieter <rdieter@fedoraproject.org> 4.5.5-1
+- 4.5.5
+
+* Sat Dec 04 2010 Rex Dieter <rdieter@fedoraproject.org> - 4.5.4-2
+- update kdoctools/el from branch (kde-l10n entities)
+
+* Mon Nov 29 2010 Than Ngo <than@redhat.com> - 4.5.4-1
+- 4.5.4
+
 * Mon Nov 15 2010 Rex Dieter <rdieter@fedoraproject.org> -  4.5.3-3
 - Closing a konsolepart shell crashes (kde#256652)
 

sources

@@ -1 +1 @@
-f412739c8e9bdb7b92487ee79ba3b5bd  kdelibs-4.5.3.tar.bz2
+a6037c53d34fe28f8a135181fe7c923b  kdelibs-4.5.5.tar.bz2