qt4-CVE-2013-0254.patch

   1 From 20b26bdb3dd5e46b01b9a7e1ce8342074df3c89c Mon Sep 17 00:00:00 2001
   2 From: Thiago Macieira <thiago.macieira@intel.com>
   3 Date: Sat, 22 Dec 2012 08:32:12 -0800
   4 Subject: [PATCH] Change all shmget calls to user-only memory
   5
   6 Drop the read and write permissions for group and other users in the
   7 system.
   8
   9 Change-Id: I8fc753f09126651af3fb82df3049050f0b14e876
  10 (cherry-picked from Qt 5 commit 856f209fb63ae336bfb389a12d2a75fa886dc1c5)
  11 Reviewed-by: Richard J. Moore <rich@kde.org>
  12 ---
  13  src/corelib/kernel/qsharedmemory_unix.cpp          |    6 +++---
  14  src/corelib/kernel/qsystemsemaphore_unix.cpp       |    4 ++--
  15  src/gui/image/qnativeimage.cpp                     |    2 +-
  16  src/gui/image/qpixmap_x11.cpp                      |    2 +-
  17  src/plugins/platforms/xcb/qxcbwindowsurface.cpp    |    2 +-
  18  src/plugins/platforms/xlib/qxlibwindowsurface.cpp  |    2 +-
  19  .../auto/qtipc/qsharedmemory/tst_qsharedmemory.cpp |    2 +-
  20  tools/qvfb/qvfbshmem.cpp                           |    4 ++--
  21  8 files changed, 12 insertions(+), 12 deletions(-)
  22
  23 diff --git a/src/corelib/kernel/qsharedmemory_unix.cpp b/src/corelib/kernel/qsharedmemory_unix.cpp
  24 index 20d76e3..4cf3acf 100644
  25 --- a/src/corelib/kernel/qsharedmemory_unix.cpp
  26 +++ b/src/corelib/kernel/qsharedmemory_unix.cpp
  27 @@ -238,7 +238,7 @@ bool QSharedMemoryPrivate::create(int size)
  28      }
  29
  30      // create
  31 -    if (-1 == shmget(unix_key, size, 0666 | IPC_CREAT | IPC_EXCL)) {
  32 +    if (-1 == shmget(unix_key, size, 0600 | IPC_CREAT | IPC_EXCL)) {
  33          QString function = QLatin1String("QSharedMemory::create");
  34          switch (errno) {
  35          case EINVAL:
  36 @@ -293,7 +293,7 @@ bool QSharedMemoryPrivate::attach(QSharedMemory::AccessMode mode)
  37  {
  38  #ifndef QT_POSIX_IPC
  39      // grab the shared memory segment id
  40 -    int id = shmget(unix_key, 0, (mode == QSharedMemory::ReadOnly ? 0444 : 0660));
  41 +    int id = shmget(unix_key, 0, (mode == QSharedMemory::ReadOnly ? 0400 : 0600));
  42      if (-1 == id) {
  43          setErrorString(QLatin1String("QSharedMemory::attach (shmget)"));
  44          return false;
  45 @@ -381,7 +381,7 @@ bool QSharedMemoryPrivate::detach()
  46      size = 0;
  47
  48      // Get the number of current attachments
  49 -    int id = shmget(unix_key, 0, 0444);
  50 +    int id = shmget(unix_key, 0, 0400);
  51      cleanHandle();
  52
  53      struct shmid_ds shmid_ds;
  54 diff --git a/src/corelib/kernel/qsystemsemaphore_unix.cpp b/src/corelib/kernel/qsystemsemaphore_unix.cpp
  55 index fad9acc..e77456b 100644
  56 --- a/src/corelib/kernel/qsystemsemaphore_unix.cpp
  57 +++ b/src/corelib/kernel/qsystemsemaphore_unix.cpp
  58 @@ -153,10 +153,10 @@ key_t QSystemSemaphorePrivate::handle(QSystemSemaphore::AccessMode mode)
  59      }
  60
  61      // Get semaphore
  62 -    semaphore = semget(unix_key, 1, 0666 | IPC_CREAT | IPC_EXCL);
  63 +    semaphore = semget(unix_key, 1, 0600 | IPC_CREAT | IPC_EXCL);
  64      if (-1 == semaphore) {
  65          if (errno == EEXIST)
  66 -            semaphore = semget(unix_key, 1, 0666 | IPC_CREAT);
  67 +            semaphore = semget(unix_key, 1, 0600 | IPC_CREAT);
  68          if (-1 == semaphore) {
  69              setErrorString(QLatin1String("QSystemSemaphore::handle"));
  70              cleanHandle();
  71 diff --git a/src/gui/image/qnativeimage.cpp b/src/gui/image/qnativeimage.cpp
  72 index 9654afe..fef38c5 100644
  73 --- a/src/gui/image/qnativeimage.cpp
  74 +++ b/src/gui/image/qnativeimage.cpp
  75 @@ -176,7 +176,7 @@ QNativeImage::QNativeImage(int width, int height, QImage::Format format,bool /*
  76
  77      bool ok;
  78      xshminfo.shmid = shmget(IPC_PRIVATE, xshmimg->bytes_per_line * xshmimg->height,
  79 -                            IPC_CREAT | 0777);
  80 +                            IPC_CREAT | 0700);
  81      ok = xshminfo.shmid != -1;
  82      if (ok) {
  83          xshmimg->data = (char*)shmat(xshminfo.shmid, 0, 0);
  84 diff --git a/src/gui/image/qpixmap_x11.cpp b/src/gui/image/qpixmap_x11.cpp
  85 index 280d8bd..88c9b7b 100644
  86 --- a/src/gui/image/qpixmap_x11.cpp
  87 +++ b/src/gui/image/qpixmap_x11.cpp
  88 @@ -193,7 +193,7 @@ static bool qt_create_mitshm_buffer(const QPaintDevice* dev, int w, int h)
  89      bool ok;
  90      xshminfo.shmid = shmget(IPC_PRIVATE,
  91                               xshmimg->bytes_per_line * xshmimg->height,
  92 -                             IPC_CREAT | 0777);
  93 +                             IPC_CREAT | 0700);
  94      ok = xshminfo.shmid != -1;
  95      if (ok) {
  96          xshmimg->data = (char*)shmat(xshminfo.shmid, 0, 0);
  97 diff --git a/src/plugins/platforms/xcb/qxcbwindowsurface.cpp b/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
  98 index b6a42d8..0d56821 100644
  99 --- a/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
 100 +++ b/src/plugins/platforms/xcb/qxcbwindowsurface.cpp
 101 @@ -98,7 +98,7 @@ QXcbShmImage::QXcbShmImage(QXcbScreen *screen, const QSize &size, uint depth, QI
 102                                            0);
 103
 104      m_shm_info.shmid = shmget (IPC_PRIVATE,
 105 -          m_xcb_image->stride * m_xcb_image->height, IPC_CREAT|0777);
 106 +          m_xcb_image->stride * m_xcb_image->height, IPC_CREAT|0600);
 107
 108      m_shm_info.shmaddr = m_xcb_image->data = (quint8 *)shmat (m_shm_info.shmid, 0, 0);
 109      m_shm_info.shmseg = xcb_generate_id(xcb_connection());
 110 diff --git a/src/plugins/platforms/xlib/qxlibwindowsurface.cpp b/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
 111 index bf003eb..46a2f97 100644
 112 --- a/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
 113 +++ b/src/plugins/platforms/xlib/qxlibwindowsurface.cpp
 114 @@ -99,7 +99,7 @@ void QXlibWindowSurface::resizeShmImage(int width, int height)
 115
 116
 117      image_info->shminfo.shmid = shmget (IPC_PRIVATE,
 118 -          image->bytes_per_line * image->height, IPC_CREAT|0777);
 119 +          image->bytes_per_line * image->height, IPC_CREAT|0700);
 120
 121      image_info->shminfo.shmaddr = image->data = (char*)shmat (image_info->shminfo.shmid, 0, 0);
 122      image_info->shminfo.readOnly = False;
 123 diff --git a/tools/qvfb/qvfbshmem.cpp b/tools/qvfb/qvfbshmem.cpp
 124 index 7f9671f..84b6ebe 100644
 125 --- a/tools/qvfb/qvfbshmem.cpp
 126 +++ b/tools/qvfb/qvfbshmem.cpp
 127 @@ -176,13 +176,13 @@ QShMemViewProtocol::QShMemViewProtocol(int displayid, const QSize &s,
 128      uint data_offset_value = sizeof(QVFbHeader);
 129
 130      int dataSize = bpl * h + data_offset_value;
 131 -    shmId = shmget(key, dataSize, IPC_CREAT | 0666);
 132 +    shmId = shmget(key, dataSize, IPC_CREAT | 0600);
 133      if (shmId != -1)
 134         data = (unsigned char *)shmat(shmId, 0, 0);
 135      else {
 136         struct shmid_ds shm;
 137         shmctl(shmId, IPC_RMID, &shm);
 138 -       shmId = shmget(key, dataSize, IPC_CREAT | 0666);
 139 +    shmId = shmget(key, dataSize, IPC_CREAT | 0600);
 140         if (shmId == -1) {
 141              perror("QShMemViewProtocol::QShMemViewProtocol");
 142              qFatal("Cannot get shared memory 0x%08x", key);
 143 --
 144 1.7.1
 145