Skip to content

Commit 08cc0fe

Browse files
CBL-Mariner-Botjykanase
CBL-Mariner-Bot
and
jykanase
authored
[AUTO-CHERRYPICK] [Medium] patch qtbase to fix CVE-2025-30348 - branch 3.0-dev (#13162)
Co-authored-by: jykanase <v-jykanase@microsoft.com>
1 parent 0c1e3a6 commit 08cc0fe

2 files changed

Lines changed: 119 additions & 1 deletion

File tree

‎SPECS/qtbase/CVE-2025-30348.patch‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
From 5e8236ec5747f3ad038db3b9996e9c73d72fe668 Mon Sep 17 00:00:00 2001
2+
From: jykanase <v-jykanase@microsoft.com>
3+
Date: Wed, 26 Mar 2025 07:01:54 +0000
4+
Subject: [PATCH] CVE-2025-30348
5+
6+
Source Link: https://github.com/qt/qtbase/commit/2ce08e3671b8d18b0284447e5908ce15e6e8f80f#diff-3d82d7c5074d1c9c1b8293c5d904f5c17e1797cc9f8369854c602e9fbc3ff13cL3621-R3596
7+
---
8+
src/xml/dom/qdom.cpp | 88 ++++++++++++++++++++++++--------------------
9+
1 file changed, 49 insertions(+), 39 deletions(-)
10+
11+
diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp
12+
index 721981fd..29145f67 100644
13+
--- a/src/xml/dom/qdom.cpp
14+
+++ b/src/xml/dom/qdom.cpp
15+
@@ -3612,47 +3612,57 @@ static QString encodeText(const QString &str,
16+
const bool performAVN = false,
17+
const bool encodeEOLs = false)
18+
{
19+
- QString retval(str);
20+
- int len = retval.size();
21+
- int i = 0;
22+
-
23+
- while (i < len) {
24+
- const QChar ati(retval.at(i));
25+
-
26+
- if (ati == u'<') {
27+
- retval.replace(i, 1, "&lt;"_L1);
28+
- len += 3;
29+
- i += 4;
30+
- } else if (encodeQuotes && (ati == u'"')) {
31+
- retval.replace(i, 1, "&quot;"_L1);
32+
- len += 5;
33+
- i += 6;
34+
- } else if (ati == u'&') {
35+
- retval.replace(i, 1, "&amp;"_L1);
36+
- len += 4;
37+
- i += 5;
38+
- } else if (ati == u'>' && i >= 2 && retval[i - 1] == u']' && retval[i - 2] == u']') {
39+
- retval.replace(i, 1, "&gt;"_L1);
40+
- len += 3;
41+
- i += 4;
42+
- } else if (performAVN &&
43+
- (ati == QChar(0xA) ||
44+
- ati == QChar(0xD) ||
45+
- ati == QChar(0x9))) {
46+
- const QString replacement(u"&#x"_s + QString::number(ati.unicode(), 16) + u';');
47+
- retval.replace(i, 1, replacement);
48+
- i += replacement.size();
49+
- len += replacement.size() - 1;
50+
- } else if (encodeEOLs && ati == QChar(0xD)) {
51+
- retval.replace(i, 1, "&#xd;"_L1); // Replace a single 0xD with a ref for 0xD
52+
- len += 4;
53+
- i += 5;
54+
- } else {
55+
- ++i;
56+
+ QString retval;
57+
+ qsizetype start = 0;
58+
+ auto appendToOutput = [&](qsizetype cur, const auto &replacement)
59+
+ {
60+
+ if (start < cur) {
61+
+ retval.reserve(str.size() + replacement.size());
62+
+ retval.append(QStringView(str).first(cur).sliced(start));
63+
+ }
64+
+ // Skip over str[cur], replaced by replacement
65+
+ start = cur + 1;
66+
+ retval.append(replacement);
67+
+ };
68+
+
69+
+ const qsizetype len = str.size();
70+
+ for (qsizetype cur = 0; cur < len; ++cur) {
71+
+ switch (str[cur].unicode()) {
72+
+ case u'<':
73+
+ appendToOutput(cur, "&lt;"_L1);
74+
+ break;
75+
+ case u'"':
76+
+ if (encodeQuotes)
77+
+ appendToOutput(cur, "&quot;"_L1);
78+
+ break;
79+
+ case u'&':
80+
+ appendToOutput(cur, "&amp;"_L1);
81+
+ break;
82+
+ case u'>':
83+
+ if (cur >= 2 && str[cur - 1] == u']' && str[cur - 2] == u']')
84+
+ appendToOutput(cur, "&gt;"_L1);
85+
+ break;
86+
+ case u'\r':
87+
+ if (performAVN || encodeEOLs)
88+
+ appendToOutput(cur, "&#xd;"_L1); // \r == 0x0d
89+
+ break;
90+
+ case u'\n':
91+
+ if (performAVN)
92+
+ appendToOutput(cur, "&#xa;"_L1); // \n == 0x0a
93+
+ break;
94+
+ case u'\t':
95+
+ if (performAVN)
96+
+ appendToOutput(cur, "&#x9;"_L1); // \t == 0x09
97+
+ break;
98+
+ default:
99+
+ break;
100+
}
101+
}
102+
-
103+
- return retval;
104+
+ if (start > 0) {
105+
+ retval.append(QStringView(str).first(len).sliced(start));
106+
+ return retval;
107+
+ }
108+
+ return str;
109+
}
110+
111+
void QDomAttrPrivate::save(QTextStream& s, int, int) const
112+
--
113+
2.45.2
114+

‎SPECS/qtbase/qtbase.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
Name: qtbase
3636
Summary: Qt6 - QtBase components
3737
Version: 6.6.3
38-
Release: 2%{?dist}
38+
Release: 3%{?dist}
3939
# See LICENSE.GPL3-EXCEPT.txt, for exception details
4040
License: GFDL AND LGPLv3 AND GPLv2 AND GPLv3 with exceptions AND QT License Agreement 4.0
4141
Vendor: Microsoft Corporation
@@ -97,6 +97,7 @@ Patch61: qtbase-cxxflag.patch
9797

9898
# fix for new mariadb
9999
Patch65: qtbase-mysql.patch
100+
Patch66: CVE-2025-30348.patch
100101

101102
# Do not check any files in %%{_qt_plugindir}/platformthemes/ for requires.
102103
# Those themes are there for platform integration. If the required libraries are
@@ -701,6 +702,9 @@ fi
701702
%{_qt_plugindir}/platformthemes/libqxdgdesktopportal.so
702703

703704
%changelog
705+
* Wed Mar 26 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 6.6.3-3
706+
- Fix CVE-2025-30348
707+
704708
* Thu Jan 16 2025 Lanze Liu <lanzeliu@micrsoft.com> - 6.6.3-2
705709
- Added a patch for addressing CVE-2024-56732
706710

0 commit comments

Comments
 (0)