dev-qt/qtcore: Bounds-check time-zone offsets when parsing

See also: https://bugreports.qt.io/browse/QTBUG-88656

Package-Manager: Portage-3.0.12, Repoman-3.0.2
Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

2 files changed, 193 insertions, 0 deletions

diff --git a/dev-qt/qtcore/files/qtcore-5.15.2-fix-UB-in-QDateTime.patch b/dev-qt/qtcore/files/qtcore-5.15.2-fix-UB-in-QDateTime.patch
new file mode 100644
index 000000000000..b131b7af3657
--- /dev/null
+++ b/dev-qt/qtcore/files/qtcore-5.15.2-fix-UB-in-QDateTime.patch
@@ -0,0 +1,88 @@
+From d2c0fc2b5f1c07c1e0acb1c0127578066b6f9b8e Mon Sep 17 00:00:00 2001
+From: Edward Welbourne <edward.welbourne@qt.io>
+Date: Tue, 24 Nov 2020 12:45:11 +0100
+Subject: [PATCH] Bounds-check time-zone offsets when parsing
+
+Parsing of time-zone offsets should check the offset string conforms
+to the expected format and has valid values in its fields. The
+QDateTime parser, fromOffsetString(), neglected the bounds check on
+hours; the QTzTimeZonePrivate parser, parsePosixTime(), neglected all
+upper bounds checks, only checking against negative valus.
+
+Drive-by - refined phrasing of a comment.
+
+Fixes: QTBUG-88656
+Change-Id: If04cdbe65064108eaa87c42310527783ad21b4c0
+Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+(cherry picked from commit 380d97e1bd15e753907c378a070bdf7f1c1cf06e)
+Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
+---
+ src/corelib/time/qdatetime.cpp           |  2 +-
+ src/corelib/time/qtimezoneprivate_tz.cpp | 27 ++++++++++++++++-----------
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/src/corelib/time/qdatetime.cpp b/src/corelib/time/qdatetime.cpp
+index e824787880c..a2816e87f4a 100644
+--- a/src/corelib/time/qdatetime.cpp
++++ b/src/corelib/time/qdatetime.cpp
+@@ -240,7 +240,7 @@ static int fromOffsetString(QStringView offsetString, bool *valid) noexcept
+     const QStringView hhRef = time.left(qMin(hhLen, time.size()));
+     bool ok = false;
+     const int hour = C.toInt(hhRef, &ok);
+-    if (!ok)
++    if (!ok || hour > 23) // More generous than QTimeZone::MaxUtcOffsetSecs
+         return 0;
+ 
+     const QStringView mmRef = time.mid(qMin(mmIndex, time.size()));
+diff --git a/src/corelib/time/qtimezoneprivate_tz.cpp b/src/corelib/time/qtimezoneprivate_tz.cpp
+index b816b4ecff2..adc590878d7 100644
+--- a/src/corelib/time/qtimezoneprivate_tz.cpp
++++ b/src/corelib/time/qtimezoneprivate_tz.cpp
+@@ -394,29 +394,34 @@ static int parsePosixTime(const char *begin, const char *end)
+     // Format "hh[:mm[:ss]]"
+     int hour, min = 0, sec = 0;
+ 
+-    // Note that the calls to qstrtoll do *not* check the end pointer, which
+-    // means they proceed until they find a non-digit. We check that we're
+-    // still in range at the end, but we may have read from past end. It's the
+-    // caller's responsibility to ensure that begin is part of a
+-    // null-terminated string.
++    // Note that the calls to qstrtoll do *not* check against the end pointer,
++    // which means they proceed until they find a non-digit. We check that we're
++    // still in range at the end, but we may have read past end. It's the
++    // caller's responsibility to ensure that begin is part of a null-terminated
++    // string.
+ 
++    const int maxHour = QTimeZone::MaxUtcOffsetSecs / 3600;
+     bool ok = false;
+-    hour = qstrtoll(begin, &begin, 10, &ok);
+-    if (!ok || hour < 0)
++    const char *cut = begin;
++    hour = qstrtoll(begin, &cut, 10, &ok);
++    if (!ok || hour < 0 || hour > maxHour || cut > begin + 2)
+         return INT_MIN;
++    begin = cut;
+     if (begin < end && *begin == ':') {
+         // minutes
+         ++begin;
+-        min = qstrtoll(begin, &begin, 10, &ok);
+-        if (!ok || min < 0)
++        min = qstrtoll(begin, &cut, 10, &ok);
++        if (!ok || min < 0 || min > 59 || cut > begin + 2)
+             return INT_MIN;
+ 
++        begin = cut;
+         if (begin < end && *begin == ':') {
+             // seconds
+             ++begin;
+-            sec = qstrtoll(begin, &begin, 10, &ok);
+-            if (!ok || sec < 0)
++            sec = qstrtoll(begin, &cut, 10, &ok);
++            if (!ok || sec < 0 || sec > 59 || cut > begin + 2)
+                 return INT_MIN;
++            begin = cut;
+         }
+     }
+ 
+-- 
+2.16.3
diff --git a/dev-qt/qtcore/qtcore-5.15.2-r1.ebuild b/dev-qt/qtcore/qtcore-5.15.2-r1.ebuild
new file mode 100644
index 000000000000..b00b449ee60f
--- /dev/null
+++ b/dev-qt/qtcore/qtcore-5.15.2-r1.ebuild
@@ -0,0 +1,105 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+QT5_MODULE="qtbase"
+inherit linux-info qt5-build
+
+DESCRIPTION="Cross-platform application development framework"
+SLOT=5/$(ver_cut 1-3)
+
+if [[ ${QT5_BUILD_TYPE} == release ]]; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
+fi
+
+IUSE="icu old-kernel systemd"
+
+DEPEND="
+	dev-libs/double-conversion:=
+	dev-libs/glib:2
+	dev-libs/libpcre2[pcre16,unicode]
+	sys-libs/zlib:=
+	icu? ( dev-libs/icu:= )
+	!icu? ( virtual/libiconv )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	!<dev-qt/qtcore-4.8.7-r4:4
+	dev-qt/qtchooser
+"
+
+QT5_TARGET_SUBDIRS=(
+	src/tools/bootstrap
+	src/tools/moc
+	src/tools/rcc
+	src/corelib
+	src/tools/qlalr
+	doc
+)
+
+QT5_GENTOO_PRIVATE_CONFIG=(
+	!:network
+	!:sql
+	!:testlib
+	!:xml
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.14.1-cmake-macro-backward-compat.patch # bug 703306
+	"${FILESDIR}"/${PN}-5.15.1-timezone-{1,2}.patch # bug 737914
+	"${FILESDIR}"/${P}-fix-UB-in-QDateTime.patch # QTBUG-88656
+)
+
+pkg_pretend() {
+	use kernel_linux || return
+	get_running_version
+	if kernel_is -lt 4 11 && ! use old-kernel; then
+		ewarn "The running kernel is older than 4.11. USE=old-kernel is needed for"
+		ewarn "dev-qt/qtcore to function on this kernel properly. Bugs #669994, #672856"
+	fi
+}
+
+src_prepare() {
+	# don't add -O3 to CXXFLAGS, bug 549140
+	sed -i -e '/CONFIG\s*+=/s/optimize_full//' src/corelib/corelib.pro || die
+
+	# fix missing qt_version_tag symbol w/ LTO, bug 674382
+	sed -i -e 's/^gcc:ltcg/gcc/' src/corelib/global/global.pri || die
+
+	qt5-build_src_prepare
+}
+
+src_configure() {
+	local myconf=(
+		$(qt_use icu)
+		$(qt_use !icu iconv)
+		$(qt_use systemd journald)
+	)
+	use old-kernel && myconf+=(
+		-no-feature-renameat2 # needs Linux 3.16, bug 669994
+		-no-feature-getentropy # needs Linux 3.17, bug 669994
+		-no-feature-statx # needs Linux 4.11, bug 672856
+	)
+	qt5-build_src_configure
+}
+
+src_install() {
+	qt5-build_src_install
+
+	local flags=(
+		DBUS FREETYPE IMAGEFORMAT_JPEG IMAGEFORMAT_PNG
+		OPENGL OPENSSL SSL WIDGETS
+	)
+
+	for flag in ${flags[@]}; do
+		cat >> "${D}"/${QT5_HEADERDIR}/QtCore/qconfig.h <<- _EOF_ || die
+
+			#if defined(QT_NO_${flag}) && defined(QT_${flag})
+			# undef QT_NO_${flag}
+			#elif !defined(QT_NO_${flag}) && !defined(QT_${flag})
+			# define QT_NO_${flag}
+			#endif
+		_EOF_
+	done
+}