fix CVE-2026-11573-qt5-qtbase-AtomGit

已开启

fix CVE-2026-11573 #226

m0_74032979创建于 9月30日从zhengzongmin/qt5-qtbase： openEuler-22.03-LTS-SP4 合入到 src-openeuler/qt5-qtbase： openEuler-22.03-LTS-SP4

fix CVE-2026-11573 #226

已开启

m0_74032979创建于 9月30日

从zhengzongmin/qt5-qtbase openEuler-22.03-LTS-SP4合入到src-openeuler/qt5-qtbase openEuler-22.03-LTS-SP4

共 2 个文件变更+628-1

ACVE-2026-11573.patch+623-0

@@ -0,0 +1,623 @@
	1	+From 948599e7b71f59fd9c9c0f7f3d1987ec93a23490 Mon Sep 17 00:00:00 2001
	2	+From: Tatiana Borisova <tatiana.borisova@qt.io>
	3	+Date: Tue, 26 Nov 2024 21:18:40 +0100
	4	+Subject: [PATCH] QDomDocument::toByteArray() crashed in case of high XML nesting level
	5	+
	6	+The issue the combination of:
	7	+- 300+ XML nesting level
	8	+- Small stack size, by default on Windows (1 MB)
	9	+- Unexpected and unexplained large stack frames with MSVC (3.5 kB)
	10	+
	11	+The described factors combination leads to the stack overflow on
	12	+Windows + MSVC.
	13	+
	14	+To fix the problem, I got rid of the recursive call from
	15	+QDomElementPrivate::save() and removed QDomNodePrivate::save()
	16	+implementation.
	17	+
	18	+Instead of those I added the method that iterates through the tree not
	19	+using recursion.
	20	+
	21	+[ChangeLog][QtXml] QDomDocument::toByteArray() now iterates the
	22	+nodes of the document instead of recursing into subnodes. This avoids
	23	+a stack-overflow crash that used to arise with deeply-nested document
	24	+structures.
	25	+
	26	+Fixes: QTBUG-131151
	27	+Change-Id: Ib74aaef1422716f2aafcb89dfc8c05ef334e2a54
	28	+Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
	29	+(cherry picked from commit 387633a6069a5e0e9b976971691b1b82725b6132)
	30	+---
	31	+ src/xml/dom/qdom.cpp \| 69 ++-
	32	+ src/xml/dom/qdom_p.h \| 5 +-
	33	+ .../xml/dom/qdom/testdata/deeply-nested.svg \| 396 ++++++++++++++++++
	34	+ tests/auto/xml/dom/qdom/tst_qdom.cpp \| 17 +
	35	+ 4 files changed, 469 insertions(+), 18 deletions(-)
	36	+ create mode 100644 tests/auto/xml/dom/qdom/testdata/deeply-nested.svg
	37	+
	38	+diff --git a/src/xml/dom/qdom.cpp b/src/xml/dom/qdom.cpp
	39	+index e312a92f..c1825b1f 100644
	40	+--- a/src/xml/dom/qdom.cpp
	41	++++ b/src/xml/dom/qdom.cpp
	42	+@@ -1400,16 +1400,40 @@ void QDomNodePrivate::normalize()
	43	+ qNormalizeNode(this);
	44	+ }
	45	+
	46	+-/*! \internal
	47	+- \a depth is used for indentation, it seems.
	48	+- */
	49	+-void QDomNodePrivate::save(QTextStream& s, int depth, int indent) const
	50	++void QDomNodePrivate::saveSubTree(const QDomNodePrivate *n, QTextStream &s,
	51	++ int depth, int indent) const
	52	+ {
	53	+- const QDomNodePrivate* n = first;
	54	+- while (n) {
	55	+- n->save(s, depth, indent);
	56	+- n = n->next;
	57	++ if (!n)
	58	++ return;
	59	++
	60	++ const QDomNodePrivate *root = n->first;
	61	++ n->save(s, depth, indent);
	62	++ if (root) {
	63	++ const int branchDepth = depth + 1;
	64	++ int layerDepth = 0;
	65	++ while (root) {
	66	++ root->save(s, layerDepth + branchDepth, indent);
	67	++ // A flattened (non-recursive) depth-first walk through the node tree.
	68	++ if (root->first) {
	69	++ layerDepth ++;
	70	++ root = root->first;
	71	++ continue;
	72	++ }
	73	++ root->afterSave(s, layerDepth + branchDepth, indent);
	74	++ const QDomNodePrivate *prev = root;
	75	++ root = root->next;
	76	++ // Close QDomElementPrivate groups
	77	++ while (!root && prev && (layerDepth > 0)) {
	78	++ root = prev->parent();
	79	++ layerDepth --;
	80	++ root->afterSave(s, layerDepth + branchDepth, indent);
	81	++ prev = root;
	82	++ root = root->next;
	83	++ }
	84	++ }
	85	++ Q_ASSERT(layerDepth == 0);
	86	+ }
	87	++ n->afterSave(s, depth, indent);
	88	+ }
	89	+
	90	+ void QDomNodePrivate::setLocation(int lineNumber, int columnNumber)
	91	+@@ -2198,7 +2222,7 @@ void QDomNode::save(QTextStream& stream, int indent, EncodingPolicy encodingPoli
	92	+ if(isDocument())
	93	+ static_cast<const QDomDocumentPrivate *>(impl)->saveDocument(stream, indent, encodingPolicy);
	94	+ else
	95	+- IMPL->save(stream, 1, indent);
	96	++ IMPL->saveSubTree(IMPL, stream, 1, indent);
	97	+ }
	98	+
	99	+ /*!
	100	+@@ -3107,11 +3131,11 @@ void QDomDocumentTypePrivate::save(QTextStream& s, int, int indent) const

Mqt5-qtbase.spec+5-1

	@@ -34,7 +34,7 @@ BuildRequires: pkgconfig(libsystemd)
34	Name: qt5-qtbase	34	Name: qt5-qtbase
35	Summary: Qt5 - QtBase components	35	Summary: Qt5 - QtBase components
36	Version: 5.15.2	36	Version: 5.15.2
37	-Release: 21	37	+Release: 22
38		38
39		39
40	# See LGPL_EXCEPTIONS.txt, for exception details	40	# See LGPL_EXCEPTIONS.txt, for exception details
	@@ -139,6 +139,7 @@ Patch1005: CVE-2025-5455-qtbase-5.15.patch
139	Patch1006: CVE-2025-14575-qtbase-6.5.diff	139	Patch1006: CVE-2025-14575-qtbase-6.5.diff
140	Patch1007: CVE-2026-9499-qtbase-5.15.patch	140	Patch1007: CVE-2026-9499-qtbase-5.15.patch
141	Patch1008: CVE-2026-19248.patch	141	Patch1008: CVE-2026-19248.patch
		142	+Patch1009: CVE-2026-11573.patch
142		143
143	# Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires.	144	# Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires.
144	# Those themes are there for platform integration. If the required libraries are	145	# Those themes are there for platform integration. If the required libraries are
	@@ -1010,6 +1011,9 @@ fi
1010		1011
1011		1012
1012	%changelog	1013	%changelog
		1014	+* Wed Sep 30 2026 zhengzongmin <zhengzongmin@xfusion.com> - 5.15.2-22
		1015	+- fix CVE-2026-11573
		1016	+
1013	* Sun Sep 27 2026 Funda Wang <fundawang@yeah.net> - 5.15.2-21	1017	* Sun Sep 27 2026 Funda Wang <fundawang@yeah.net> - 5.15.2-21
1014	- fix CVE-2026-19248	1018	- fix CVE-2026-19248
1015		1019