summaryrefslogtreecommitdiffstats
path: root/chromium
Commit message (Collapse)AuthorAgeFilesLines
* [Backport] Security bug 1343889Henrik Boström2022-08-161-2/+2
| | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://webrtc-review.googlesource.com/c/src/+/268460: Disallow invalid arguments in RestoreEncodingLayers. Changing DCHECK into CHECK for good measure. Bug: chromium:1343889 Change-Id: I2cede85dc2d2a4238739f73afe25275047f4aa50 Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org> Commit-Queue: Henrik Boström <hbos@webrtc.org> Cr-Commit-Position: refs/heads/main@{#37511} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-2610: Insufficient policy enforcement in Background FetchRayan Kanso2022-08-111-0/+2
| | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3693143: [BackgroundFetch] Don't expose URL chain in case of CO redirect Bug: 1278255 Change-Id: If853327b853e29792e5c8d1dfaeecf21d6fec004 Reviewed-by: Susanne Westphal <swestphal@google.com> Commit-Queue: Rayan Kanso <rayankans@chromium.org> Cr-Commit-Position: refs/heads/main@{#1011409} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-2477 : Use after free in Guest ViewKevin McNee2022-08-082-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3726008: Use weak ptr for webview JavaScriptDialogHelper callback M96 merge issues: javascript_dialog_helper.h: Conflicting types for web_view_guest_ This can be called asynchronously, potentially after the associated WebViewGuest is destroyed. (cherry picked from commit 1c09b9292dba7dfdc28b9bd09c61e3a0faf7b302) Bug: 1336266 Change-Id: I8a4ec5ab124a9d5ca2ad45b1915666c8b7c98f79 Auto-Submit: Kevin McNee <mcnee@chromium.org> Commit-Queue: James Maclean <wjmaclean@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1015960} Reviewed-by: Simon Hangl <simonha@google.com> Owners-Override: Simon Hangl <simonha@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1665} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-27406Werner Lemberg2022-08-031-0/+3
| | | | | | | | | | | Cherry-pick of patch originally submitted at https://gitlab.freedesktop.org/freetype/freetype/-/commit/0c2bdb01a2e1d24a3e592377a6d0822856e10df2: * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. Fixes #1140. Change-Id: Ib42e5ec349706091d7cda38237f98022c487e851 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-27405 (2/2)Werner Lemberg2022-08-031-0/+1
| | | | | | | | | Cherry-pick of patch originally submitted at https://gitlab.freedesktop.org/freetype/freetype/-/commit/d014387ad4a5dd04d8e7f99587c7dacb70261924: * src/base/ftobjs.c (ft_open_face_internal): Thinko. Change-Id: Ica18fe6e68a936e4689ffa33e0438ddde05e9e75 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-27405 (1/2)Werner Lemberg2022-08-031-0/+9
| | | | | | | | | | | | | Cherry-pick of patch originally submitted at https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5: * src/base/ftobjs.c (ft_open_face_internal): Properly guard `face_index`. We must ensure that the cast to `FT_Int` doesn't change the sign. Fixes #1139. Change-Id: I3d9b90d00d077eba2e27de4704bfce6e80186815 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-27404Werner Lemberg2022-08-032-2/+2
| | | | | | | | | | | | | | Cherry-pick of patch originally submitted on https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db: Avoid invalid face index. Fixes #1138. * src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): Check `face_index` before decrementing. Change-Id: I8e4d338c0f589f3b4451fc61ffa75fe5c3891f10 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1287804Etienne Bergeron2022-08-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed https://chromium-review.googlesource.com/c/chromium/src/+/3726349: Fix incorrect text itemization for \r codepoint M96 merge issues: render_text_unittest.cc Tests Clusterfuzz_Issue_1298286/1299054 aren't present in M96 and caused a merge conflict. The "\r" codepoint should be split to be rendered in a single harfbuzz run (same as "\n"). We do recognize these sequences as newline: \r \n \r\n Previously, the itemization will leave the "\r" with the previous run. This is leading to incorrect multiline lines splitting. (cherry picked from commit eee0c5ca752ad50df9986c551cb98226ce078893) Bug: 1287804 Change-Id: Idfc00a3cf147eb53258d5da9ea105e2d6dc25f05 Commit-Queue: Etienne Bergeron <etienneb@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1014955} Reviewed-by: Etienne Bergeron <etienneb@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1662} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2294: Heap buffer overflow in WebRTC (2/2)Roger Zanoni2022-07-251-1/+5
| | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://webrtc-review.googlesource.com/c/src/+/267640: [M96-LTS] Ignore RID that appears without an a=simulcast entry RID is defined for multiple usages in RFC 8851, but we only support usage with a=simulcast as specified in RFC 8853. Bug: chromium:1341043 Change-Id: Ie72074c5b394bdc41865938a86ec9c7629e1f5e0 Commit-Queue: Harald Alvestrand <hta@webrtc.org> Cr-Commit-Position: refs/heads/main@{#37417} (cherry picked from commit 1c5808145e8b151800b0320b8a7316a09b706488) Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2294: Heap buffer overflow in WebRTC (1/2)Roger Zanoni2022-07-251-1/+1
| | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://webrtc-review.googlesource.com/c/src/+/267629 [M96-LTS] Do not allow simulcast to be turned off using SDP munging This is an error that puts the PC into an inconsistent state, so causing a crash is the right thing to do. Bug: chromium:1341043 Change-Id: Ie1eb89400ad87f0c83634b7073236b07e92ec7ab Commit-Queue: Harald Alvestrand <hta@webrtc.org> Cr-Commit-Position: refs/heads/main@{#37391} (cherry picked from commit 3fe8b0d9a980642ee5ebb1f9e429378b063c1f07) Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2295: Type Confusion in V8Tobias Tebbi2022-07-254-24/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3726007: [M96-LTS][compiler] make CanCover() transitive In addition to checking that a node is owned, CanCover() also needs to check if there are any side-effects in between the current node and the merged node. When merging inputs of inputs, this check was done with the wrong side-effect level of the in-between node. We partially fixed this before with `CanCoverTransitively`. This CL addresses the issue by always comparing to the side-effect level of the node from which we started, making `CanCoverTransitively` superfluous. (cherry picked from commit 6048f754931e0971cab58fb0de785482d175175b) Bug: chromium:1336869 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I78479b32461ede81138f8b5d48d60058cfb5fa0a Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#81217} Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Artem Sumaneev <asumaneev@google.com> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Owners-Override: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/branch-heads/9.6@{#70} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2160: Insufficient policy enforcement in DevToolsDanil Somsikov2022-07-253-3/+14
| | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3599349: Only allow capturing screenshots from surface for chrome extensions. Bug: 1116450 Change-Id: Ia4e081dbd44e0d3e2f85248b9e4ec9306e3ceb72 Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Auto-Submit: Danil Somsikov <dsv@chromium.org> Commit-Queue: Danil Somsikov <dsv@chromium.org> Cr-Commit-Position: refs/heads/main@{#995663} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2162: Insufficient policy enforcement in File System APIAustin Sullivan2022-07-251-4/+6
| | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3638698/: FSA: Sanitize .url files Bug: 1307930 Change-Id: I7ed3cca5942a5334ba761d269bdd8961fa9d13fe Reviewed-by: Marijn Kruisselbrink <mek@chromium.org> Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Auto-Submit: Austin Sullivan <asully@chromium.org> Cr-Commit-Position: refs/heads/main@{#1002495} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2158: Type Confusion in V8Shu-yu Guo2022-07-253-12/+21
| | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3676863: [M96-LTS][weakrefs] Set unregister_token to undefined when unregistering (cherry picked from commit dd3289d7945dac855d1287cf4ea248883e908d54) Bug: chromium:1321078 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I426327ffc3d7eebdb562c01a87039a93dfb79a88 Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#80349} Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#68} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1316578Geoff Lang2022-07-252-10/+12
| | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3683869: Ignore eglBind/ReleaseTexImage calls for lost contexts. eglBindTexImage and eglReleaseTexImage no-op when no context is current. Extend this to lost contexts to match the behaviour of making a GL call on a lost context. This avoids potential unexpected bad accesses in the backends. Bug: chromium:1316578 Change-Id: I7b309c297e0c803019720733dee2950abb4c4b5f Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Alexis Hétu <sugoi@google.com> Reviewed-by: Alexis Hétu <sugoi@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2008: Out of bounds memory access in WebGLJamie Madill2022-07-251-6/+5
| | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3651153: D3D: Fix race condition with parallel shader compile. Bug: chromium:1317673 Change-Id: I0fb7c9a66248852e41e8700e80c295393ef941e8 Reviewed-by: Jie A Chen <jie.a.chen@intel.com> Reviewed-by: Lingfeng Yang <lfy@google.com> Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-2010: Out of bounds read in compositingJustin Novosad2022-07-251-0/+4
| | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3669596: PaintOpReader: Harden PaintImage deserialization This fix prevents the deserialization of PaintImage pixel data from reading data out of bounds when the block of serialized pixel data isn't large enough to cover the expected amount of data, given the size and format of the image. Bug: 1325298 Change-Id: Icbeb405d2031d7d8ce4537836d7996ce7885f6d1 Commit-Queue: Justin Novosad <junov@chromium.org> Reviewed-by: Jonathan Ross <jonross@chromium.org> Cr-Commit-Position: refs/heads/main@{#1007804} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1854: Use after free in ANGLE.Jamie Madill2022-07-251-0/+1
| | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3650697: [M102] Fix validation cache when deleting a Transform Feedback. Bug: chromium:1320024 Change-Id: I76ef85a3c65c663c138d8caebd4ef2c0da53cd4f Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org> (cherry picked from commit 84e42c3b04da9e2c9d93d35bb6f2b1830fef22f4) Reviewed-by: Geoff Lang <geofflang@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>i Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1857: Insufficient policy enforcement in File System APIAustin Sullivan2022-07-253-28/+47
| | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3648322: M102: FSA: Sanitize .scf files .scf files can be used to execute code without opening the file. Sanitize these files the same way we sanitize .lnk files. Also updates filename sanitization logic to be consistent in blocking .lnk and .local extensions on all OSes. (cherry picked from commit 988164c6c4a563c3d4c0dedba295d09472dfc15f) Bug: 1227995 Change-Id: I4b018f1ba524c783547e18630db9addc9fb126e6 Reviewed-by: Marijn Kruisselbrink <mek@chromium.org> Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1002147} Auto-Submit: Austin Sullivan <asully@chromium.org> Commit-Queue: Austin Sullivan <asully@chromium.org> Cr-Commit-Position: refs/branch-heads/5005@{#759} Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1855: Use after free in MessagingMarijn Kruisselbrink2022-07-252-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3609249: Reland "Close a MessagePort if it is created in a destroyed context." This is a reland of commit 068f13cc5aa5f7a6e9faf28d8731275e64cb657b This reland changes the timeout in the test from 3 to 2 seconds, because two 3 second timeouts is too long for chrome's default overall test timeout of 6 seconds on non-dcheck release builds. Original change's description: > Close a MessagePort if it is created in a destroyed context. > > MessagePort assumes it is only destroyed either after ContextDestroyed, > or after the port has been closed explicitly. As it turns out ports that > were created in an already detached iframe would violate this invariant, > causing issues. > > Bug: 1228661 > Change-Id: Ib1abce15f1d1d15f044de19fe0534767db488af0 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3561845 > Reviewed-by: Jeremy Roman <jbroman@chromium.org> > Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> > Cr-Commit-Position: refs/heads/main@{#988859} Bug: 1228661 Change-Id: Ifc5ec866678667b0d81438e2a2c8e5ada6e19d8c Commit-Queue: Jeremy Roman <jbroman@chromium.org> Reviewed-by: Jeremy Roman <jbroman@chromium.org> Auto-Submit: Marijn Kruisselbrink <mek@chromium.org> Cr-Commit-Position: refs/heads/main@{#996880} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* FIXUP: Fix url_utils for QtWebEngineAllan Sandfeld Jensen2022-06-231-5/+15
| | | | | | | | | | | Allow redirects from local schemes to local schemes, and clean up the general logic. We still allow almost anything from custom url schemes. Fixes: QTBUG-99207 Change-Id: I7d1b7edc91f82064edbf6c1a41682d5874b42d12 Reviewed-by: Michal Klocek <michal.klocek@qt.io> (cherry picked from commit 3a4c9ba6936ec8b11a97ea0b3c684b3002f01a12)
* Fixup: CVE-2022-0796: Use after free in MediaMichael Brüning2022-06-201-6/+6
| | | | | | | | | | Commit ecc2bb74f1f accidentally introduced a build break due to an apparent typo. This fixes it. Change-Id: I746c6f10ecd2b212b847a291677e24e527d6b922 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-0796: Use after free in MediaTed Meyer2022-06-032-23/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3482463: Guard BatchingMediaLog::event_handlers_ with lock It seems that despite MediaLog::OnWebMediaPlayerDestroyed and MediaLog::AddLogRecord both grabbing a lock, BatchingMediaLog::AddLogRecordLocked can escape the lock handle by posting BatchingMediaLog::SendQueuedMediaEvents, causing a race. When the addition of an event is interrupted by the deletion of a player due to player culling in MediaInspectorContextImpl, a UAF can occur. R=​dalecurtis (cherry picked from commit 34526c3d0a857a22618e4d77c7f63b5ca6f8d3d2) Bug: 1295786 Change-Id: I77df94988f806e4d98924669d27860e50455299d Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Ted (Chromium) Meyer <tmathmeyer@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#970815} Auto-Submit: Ted (Chromium) Meyer <tmathmeyer@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/branch-heads/4758@{#1192} Cr-Branched-From: 4a2cf4baf90326df19c3ee70ff987960d59a386e-refs/heads/main@{#950365} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Linux sandbox: ENOSYS for some statx syscallsMatthew Denton2022-06-023-0/+16
| | | | | | | | | | | | | | On some platforms, glibc will default to statx for normal stat-family calls. Unfortunately there's no way to rewrite statx to something safe using a signal handler. Returning ENOSYS will cause glibc to fallback to old stat paths. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2823150 Task-number: QTBUG-103969 Change-Id: I75c5a52fa9cc142102d38ddbeb38019961ec6b22 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Workaround MSVC2022 ICE in constexpr functionsPeter Varga2022-05-241-2/+8
| | | | | | | | | This workaround can be reverted after Microsoft fixes the issue: https://developercommunity.visualstudio.com/t/fatal-error-C1001:-Internal-compiler-err/1669485 Change-Id: I4916163ffaf1f925ff9297dbd0d8d72042a1dc9e Fixes: QTBUG-103617 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Bump V8_PATCH_LEVELMichael Brüning2022-05-231-1/+1
| | | | | Change-Id: I2cf0641b57550c8517502428d814c8adc841fc6c Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1306507Scott Violet2022-05-202-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3538001: history: don't handle db error during destruction Handling of db errors is delayed using a posttask. ~HistoryBackend closes all the dbs. If closing the db results in an error, then a PostTask() is scheduled with a HistoryBackend that is part way through deletion. When the PostTask() runs, we get a uaf. This patch resets the error callback in ~HistoryBackend to ensure this doesn't happen. This means a db error is effectively ignored during shutdown. Presumably if the error is fatal, it'll be handled when the HistoryBackend is created again. BUG=1306507 TEST=none Change-Id: Ic158589a43e7bc2fd1f602fb2798ab500dc8d6d7 Reviewed-by: Victor Costan <pwnall@chromium.org> Commit-Queue: Victor Costan <pwnall@chromium.org> Commit-Queue: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/main@{#983478} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1304659Joey Arhar2022-05-1992-39182/+1132
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Roll libxml from eab86522 to 37ebf8a8 This patch also updates the roll.py script to be python3 compatible. 2021-05-31 damjan.jov@gmail.com Document support for the non-standard escape sequences. Support non-BMP code points in surrogate pairs of '\uXXXX\uXXXX'. 2021-05-30 damjan.jov@gmail.com Use strtoul() instead of sscanf, and correct data types that break GCC. 2021-05-29 damjan.jov@gmail.com Add support for some non-standard escapes in regular expressions. 2021-07-17 mike.dalessio@gmail.com htmlParseComment: handle abruptly-closed comments 2021-07-17 mike.dalessio@gmail.com test coverage for abruptly-closed comments 2021-08-21 damjan.jov@gmail.com Properly fold whitespace around the QName value when validating an XSD schema. 2021-08-19 damjan.jov@gmail.com Add whitespace folding for some atomic data types that it's missing on. 2022-01-12 oliver.diehl@nxp.com Add let variable tag support 2022-01-11 oliver.diehl@nxp.com Add value-of tag support 2022-01-11 oliver.diehl@nxp.com Replaced tabs by 4 spaces 2022-03-02 wellnhofer@aevum.de Remove obsolete AC_HEADER checks 2022-03-02 wellnhofer@aevum.de Don't check for standard C89 library functions 2022-03-02 wellnhofer@aevum.de Don't check for standard C89 headers 2022-03-01 wellnhofer@aevum.de Remove broken VxWorks support 2022-03-01 wellnhofer@aevum.de Remove broken Mac OS 9 support 2022-03-01 wellnhofer@aevum.de Remove useless call to xmlRelaxNGCleanupTypes 2022-03-01 wellnhofer@aevum.de Reset last error in xmlCleanupGlobals 2022-03-01 wellnhofer@aevum.de Warn when using deprecated functions from Python bindings 2022-03-01 wellnhofer@aevum.de Don't include ICU headers in public headers 2022-03-01 wellnhofer@aevum.de Remove broken bakefile support 2022-03-01 wellnhofer@aevum.de Remove broken Visual Studio 2010 support 2022-03-01 wellnhofer@aevum.de Remove broken Windows CE support 2022-02-28 wellnhofer@aevum.de Always fopen files with "rb" 2022-02-28 wellnhofer@aevum.de Remove __DJGPP__ checks 2022-02-28 wellnhofer@aevum.de Remove useless __CYGWIN__ checks 2021-12-20 wellnhofer@aevum.de Fix certain combinations of regex range quantifiers 2021-12-20 wellnhofer@aevum.de Fix range quantifier on subregex 2022-02-21 mike.dalessio@gmail.com Update `xmlStrlen()` to use POSIX / ISO C `strlen()` 2022-02-24 wellnhofer@aevum.de Fix build with older Python versions 2022-02-22 wellnhofer@aevum.de Fix unused variable warnings with disabled features 2022-02-22 wellnhofer@aevum.de Fix recovery from invalid HTML start tags 2022-02-22 wellnhofer@aevum.de More fixes to --without-valid build 2022-02-22 wellnhofer@aevum.de Fix --without-valid build 2022-02-20 wellnhofer@aevum.de Fix documentation in entities.c 2022-02-20 wellnhofer@aevum.de Add note about optimization flags 2022-02-20 wellnhofer@aevum.de Remove special configuration for certain maintainers 2022-02-20 wellnhofer@aevum.de Deprecate IDREF-related functions in valid.h 2022-02-20 wellnhofer@aevum.de Deprecate all functions in DOCBparser.h 2022-02-20 wellnhofer@aevum.de Disable docbook support by default 2022-02-20 wellnhofer@aevum.de Deprecate legacy functions 2022-02-20 wellnhofer@aevum.de Disable legacy support by default 2022-02-20 wellnhofer@aevum.de Deprecate all functions in nanoftp.h 2022-02-20 wellnhofer@aevum.de Disable FTP support by default 2022-02-20 wellnhofer@aevum.de Add XML_DEPRECATED macro 2022-02-20 wellnhofer@aevum.de Remove elfgcchack.h 2022-02-20 wellnhofer@aevum.de Only warn on invalid redeclarations of predefined entities 2022-02-08 wellnhofer@aevum.de Don't add IDs containing unexpanded entity references 2022-02-20 wellnhofer@aevum.de Remove unneeded code in xmlreader.c 2022-01-13 wellnhofer@aevum.de Rework validation context flags 2022-02-19 wellnhofer@aevum.de Release v2.9.13 2022-02-19 wellnhofer@aevum.de Update news and rebuild documentation 2022-02-08 wellnhofer@aevum.de [CVE-2022-23308] Use-after-free of ID and IDREF attributes 2022-02-19 wellnhofer@aevum.de Fix fuzz/.gitignore after fixing VPATH build 2022-02-17 wellnhofer@aevum.de Remove SVN keyword anchors 2022-02-16 wellnhofer@aevum.de Remove xmlwin32version.h 2022-02-14 wellnhofer@aevum.de Fix source URL in libxml.spec.in 2022-02-14 wellnhofer@aevum.de Fix fuzzer test with VPATH build 2022-02-14 wellnhofer@aevum.de Support custom prefix when installing Python module 2022-02-14 wellnhofer@aevum.de Remove Makefile.win 2022-02-14 wellnhofer@aevum.de Fix distribution after README change 2022-02-14 wellnhofer@aevum.de Rework README 2022-02-14 wellnhofer@aevum.de Remove README.cvs-commits 2022-02-14 wellnhofer@aevum.de Remove outdated ChangeLog code 2022-02-13 wellnhofer@aevum.de Remove CVS and SVN-related code 2022-02-13 wellnhofer@aevum.de Redirect links to xmlsoft.org 2022-02-13 wellnhofer@aevum.de Remove README.docs 2022-02-13 wellnhofer@aevum.de Remove MAINTAINERS 2022-02-13 wellnhofer@aevum.de Remove xmltutorial.pdf 2022-02-08 wellnhofer@aevum.de Fix regression in RelaxNG pattern matching 2022-02-12 wellnhofer@aevum.de Remove .travis.yml 2022-02-12 wellnhofer@aevum.de Try again to only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Try again to only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Only build GitLab Pages on main repo 2022-02-12 wellnhofer@aevum.de Upload documentation to GitLab pages 2022-01-26 wellnhofer@aevum.de Make xmlFuzzReadString return a zero size in error case 2022-02-07 wellnhofer@aevum.de Fix xmlSetTreeDoc with entity references 2022-02-07 wellnhofer@aevum.de Fix "xmllint -" 2022-02-07 wellnhofer@aevum.de Fix double counting of CRLF in comments 2022-02-07 wellnhofer@aevum.de Remove old ChangeLog 2022-02-07 wellnhofer@aevum.de Document how to escape XML_CATALOG_FILES 2022-02-07 wellnhofer@aevum.de Properly handle nested documents in xmlFreeNode 2022-02-07 wellnhofer@aevum.de Make sure to grow input buffer in xmlParseMisc 2022-02-04 wellnhofer@aevum.de Fix unused function warning in testapi.c 2022-02-04 wellnhofer@aevum.de Don't ignore xmllint options after "-" 2022-02-04 wellnhofer@aevum.de Don't normalize namespace URIs in XPointer xmlns() scheme 2022-02-03 wellnhofer@aevum.de Fix handling of XSD with empty namespace 2022-02-03 wellnhofer@aevum.de Update NewsML DTD in test suite 2022-02-01 wellnhofer@aevum.de Fix parsing of xmllint --maxmem option 2022-02-01 wellnhofer@aevum.de Also register HTML document nodes 2022-02-01 wellnhofer@aevum.de Add more checks for malloc failures in xmllint.c Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3528473 Bug: 934413 Change-Id: I7b8716b17d84a6c0a8c140996968db8cfab08735 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1269999Michael Brüning2022-05-1926-281/+301
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual update of libxml following upstream patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3422595: Roll libxml from dea91c97 to eab86522 2022-01-31 wellnhofer@aevum.de Make xmllint return an error if arguments are missing 2022-01-28 wellnhofer@aevum.de Avoid potential integer overflow in xmlstring.c 2021-07-07 ddkilzer@apple.com xmlAddChild() and xmlAddNextSibling() may not attach their second argument 2022-01-25 wellnhofer@aevum.de Run CI tests with UBSan implicit-conversion checks 2022-01-25 wellnhofer@aevum.de Fix casting of line numbers in SAX2.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warnings in hash.c 2022-01-25 wellnhofer@aevum.de Add explicit casts in runtest.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warning in xmlIconvWrapper 2022-01-25 wellnhofer@aevum.de Add suffix to unsigned constant in xmlmemory.c 2022-01-25 wellnhofer@aevum.de Add explicit casts in testchar.c 2022-01-25 wellnhofer@aevum.de Fix integer conversion warnings in xmlstring.c 2022-01-25 wellnhofer@aevum.de Add explicit cast in xmlURIUnescapeString 2022-01-25 wellnhofer@aevum.de Fix handling of ctxt->base in xmlXPtrEvalXPtrPart 2022-01-20 wellnhofer@aevum.de Remove wrong tarname from AC_INIT 2022-01-17 wellnhofer@aevum.de Remove old devhelp format 2022-01-16 wellnhofer@aevum.de Fix regression with PEs in external DTD 2022-01-16 wellnhofer@aevum.de Fix xmllint --maxmem 2021-11-03 huangduirong@huawei.com Fix Null-deref-in-xmlSchemaGetComponentTargetNs 2022-01-16 wellnhofer@aevum.de Fix libxml2.doap 2021-08-26 finnbarber@protonmail.com Added regression tests for xmlReadFd() and htmlReadFd() 2021-07-27 finnbarber@protonmail.com Fix htmlReadFd, which was using a mix of xml and html context functions 2022-01-16 wellnhofer@aevum.de Fix memory leak in xmlXPathCompNodeTest 2021-07-22 fanchunwei@src.gnome.org setup.py.in: Try to import setuptools 2021-07-22 fanchunwei@src.gnome.org Python distutils: Make DLL packaging more flexible 2021-07-22 fanchunwei@src.gnome.org tstmem.py: Try importing from libxmlmods.libxml2mod if needed 2021-03-30 fanchunwei@src.gnome.org python: Port python 3.x module to Windows 2021-11-03 mrazavi64@gmail.com Fix random dropping of characters on dumping ASCII encoded XML 2021-10-14 kjellahlstedt@gmail.com Update URL for libxml++ C++ binding 2022-01-16 wellnhofer@aevum.de Fix null pointer deref in xmlStringGetNodeList 2021-08-06 liyulin@pku.edu.cn move current position before possible calling of ctxt->sax->characters. 2021-07-29 mattia@mapreri.org Correctly install the HTML examples into their subdirectory. 2021-07-29 mattia@mapreri.org Refactor the settings of $docdir 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for functions 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for libraries 2021-07-26 ben.boeckel@kitware.com cmake: remove unused checks 2021-07-26 ben.boeckel@kitware.com configure: remove unused checks for headers 2021-07-26 ben.boeckel@kitware.com cmake: fix `ATTRIBUTE_DESTRUCTOR` definition 2021-07-23 ebassi@gnome.org Generate devhelp2 index file 2021-07-14 amigadave@amigadave.com Remove duplicated code in xmlcatalog 2021-07-14 amigadave@amigadave.com Fix leak in __xmlOutputBufferCreateFilename 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlRelaxNGNewDocParserCtxt 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlRelaxNGParseData 2021-07-14 amigadave@amigadave.com Fix memory leak in libxml_C14NDocSaveTo 2021-07-14 amigadave@amigadave.com Fix memory leak in libxml_saveNodeTo 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlNewInputFromFile 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlCreateIOParserCtxt 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlParseSGMLCatalog 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlParseCatalogFile 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlSAX2AttributeDecl 2021-07-14 amigadave@amigadave.com Fix memory leak in xmlFreeParserInputBuffer 2021-07-07 ddkilzer@apple.com Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk 2021-07-05 jtojnar@gmail.com man: Mention XML_CATALOG_FILES is space-separated 2021-07-05 rainer.canavan@avenga.com add documentaiton for xmllint exit code 10 2021-06-28 sam@gentoo.org python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS 2022-01-16 wellnhofer@aevum.de Fix check for libtool in autogen.sh 2022-01-16 wellnhofer@aevum.de Add myself to maintainers 2022-01-15 wellnhofer@aevum.de Revert "Make schema validation fail with multiple top-level elements" 2022-01-10 wellnhofer@aevum.de Different approach to fix quadratic behavior in HTML push parser 2022-01-10 wellnhofer@aevum.de Fix regression when parsing invalid HTML tags in push mode 2022-01-10 wellnhofer@aevum.de Fix regression parsing public IDs literals in HTML Fixed: 1269999 Bug: 934413 Change-Id: I602a086b91d514cb80859237c48729d4c10cf83e Reviewed-by: Stephen Chenney <schenney@chromium.org> Commit-Queue: Joey Arhar <jarhar@chromium.org> Cr-Commit-Position: refs/heads/main@{#965736} Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml from a46e85f6 to dea91c97Joey Arhar2022-05-197-25/+46
| | | | | | | | | Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3069724 Bug: 934413 Change-Id: I04f0e89ae14359062a595326bb9e569fe49691d7 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml from bfd2f430 to a46e85f6Joey Arhar2022-05-1916-73/+122
| | | | | | | | | | | | | | | | | | | | | 2021-05-22 rickert@fortiss.org Update CMake project version 2021-05-22 rickert@fortiss.org Add CMake alias targets for embedded projects 2021-05-18 dking@redhat.com Fix some validation errors in the FAQ 2021-05-19 dking@redhat.com Remove unused variable in xmlCharEncOutFunc 2021-05-16 rickert@fortiss.org Add missing file xmlwin32version.h.in to EXTRA_DIST 2021-05-16 rickert@fortiss.org Add instructions on how to use CMake to compile libxml 2021-05-18 wellnhofer@aevum.de Work around lxml API abuse 2021-05-20 mike.dalessio@gmail.com fix: avoid segfault at exit when using custom memory functions 2021-05-13 veillard@redhat.com Release of libxml2-2.9.12 2021-05-13 veillard@redhat.com Release of libxml2-2.9.11 2021-05-13 veillard@redhat.com Patch for security issue CVE-2021-3541 Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2915101 Bug: 934413 Change-Id: I5b37109c0043fe16730b91d0eb032332b615c33a Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml to bfd2f430Joey Arhar2022-05-196-376/+141
| | | | | | | | | | | | | | | | | revert-non-recursive-xml-parsing.patch was fixed upstream, so this also removes the revert patch. The new test baselines are more correct than they used to be. One of the new libxml patches fixes line numbers, and you can see that's the only difference in the new baselines, and that the new line numbers are more correct than the old ones. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2878399 Bug: 934413 Change-Id: I7c2d239bdf12b055938868782852114aac586ee3 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml to 7279d236Joey Arhar2022-05-1918-286/+536
| | | | | | | | | | | | | This patch also adds --allow-empty to the git commit command for windows in the roll.py script since there are usually no changes for windows. libxslt's roll.py already does this for windows. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/2866731 Bug: 934413 Change-Id: If055dabe61e5be77e4cf649f285f9b20c91ec3c6 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Roll libxml to f93ca3e1Joey Arhar2022-05-1916-189/+1421
| | | | | | | | | | | | | add-fuzz-target.patch was merged upstream in 1bde1040 chromium-issue-1138555.patch was fixed upstream in b516ed18 Bug: 934413 Change-Id: I168c16d6882eea4d3523576126c2542d5d861be2 Reviewed-by: Stephen Chenney <schenney@chromium.org> Commit-Queue: Joey Arhar <jarhar@chromium.org> Cr-Commit-Position: refs/heads/master@{#849631} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1292905Anders Hartvoll Ruud2022-05-191-2/+4
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3551609: Disallow CSS-wide keywords for StylePropertyMap.set We don't support this properly, and the spec does not handle CSS-keywords either. Disallow it until we can add proper support for this. Fixed: 1292905 Bug: 1310761 Change-Id: Ieb3d20edfea72c2ccb0928536fdfd86d10aad1a9 Reviewed-by: Rune Lillesveen <futhark@chromium.org> Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org> Cr-Commit-Position: refs/heads/main@{#986411} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1314: Type Confusion in V8Nico Hartmann2022-05-191-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3541919: Fix NumberConstant used with Word32 rep in ISel Bug: chromium:1304658 (cherry picked from commit bbea5909c797dec7c620b9fee43d80a1420c2e08) No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I6a82603a7c5de5ae8f5a895990c1a904bbdd39b2 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79526} Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#58} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1310: Use after free in regular expressionsBrendon Tiszka2022-05-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3548819: Update write barrier when storing HeapNumber to last index. (cherry picked from commit bdc4f54a50293507d9ef51573bab537883560cc8) Bug: chromium:1307610 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79538} Reviewed-by: Artem Sumaneev <asumaneev@google.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#64} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1305: Use after free in storageMarijn Kruisselbrink2022-05-194-78/+85
| | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3553304: Change ownership of BlobBytesProvider. Rather than immediately passing ownership to a cross-thread SelfOwnedReceiver while retaining a raw pointer, instead maintain ownership in a unique_ptr as long as it is needed, only transferring ownership to a SelfOwnedReceiver when BlobData is done with the BlobBytesProvider. Also clean-up/tighten down sequence checks for BlobBytesProvider a bit. Bug: 1285234 Change-Id: I7273e886a0bab2ae489b680d786991c9e4ff1dbb Reviewed-by: Austin Sullivan <asully@chromium.org> Commit-Queue: Marijn Kruisselbrink <mek@chromium.org> Cr-Commit-Position: refs/heads/main@{#986111} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-1125Adithya Srinivasan2022-05-191-0/+5
| | | | | | | | | | | | | Fix UAF in JavaScriptTabModalDialogManagerDelegateDesktop See bug for more details. Backport review link: https://chromium-review.googlesource.com/c/chromium/src/+/3465258 Bug: 1292261 Change-Id: Iebe499b4eda76b1b190f5f7b97a0938eb22dc405 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1280852Henrik Lundin2022-05-191-1/+6
| | | | | | | | | | | Adding fuzzer for PCM16b decoder and fixing a fuzzer problem Backport review link: https://webrtc-review.googlesource.com/c/src/+/251580 Bug: chromium:1280852 Change-Id: I732d44ddcd7b4c25c9c09932254820ab6cc85c46 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Secuirity Bug 1296876Clemens Backes2022-05-194-35/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/3509394: [M96-LTS][liftoff][x64] Fix bug in i32.atomic.sub32 {AtomicSub} on x64 first negates the {value} register, then does an atomic addition. For that reason, {value} should be a unique register. So far, we only checked that it's not used in the value stack, but we should also check for overlap with the destination address or the offset register. Drive-by: Remove unneeded handling of non-unique register index on arm, as that cannot happen (LiftoffCompiler ensures that the result register is unique). R=thibaudm@chromium.org (cherry picked from commit b5003a3c631328bfbe3357dfea7aaebf46316c09) Bug: chromium:1296876 Change-Id: Ie6b97eec8e8dea07b0bcc644d261f47467cc5b8e Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#79265} Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/9.6@{#52} Cr-Branched-From: 0b7bda016178bf438f09b3c93da572ae3663a1f7-refs/heads/9.6.180@{#1} Cr-Branched-From: 41a5a247d9430b953e38631e88d17790306f7a4c-refs/heads/main@{#77244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-0978: Use after free in ANGLEJamie Madill2022-05-191-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | Partial backport of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3516115: [M96-LTS] Fix base level changes not updating FBO completeness check. M96 merge issues: - RendererVk.cpp: conflicting kSkippedSyncvalMessages entries - vk_helpers.cpp getRenderPassWriteCommandCount() not present in M96 - capture_replay_expectations.txt: conflicting skipped test entries - src/tests/gl_tests/FramebufferTest.cpp RedefineLayerAttachment not present in M96 Bug: chromium:1299264 Change-Id: I0881a4916c3eeb9ee023d28d207795899417d530 Commit-Queue: Jamie Madill <jmadill@chromium.org> Auto-Submit: Jamie Madill <jmadill@chromium.org> (cherry picked from commit ea70300ba04404ba0c1cacf2173a0a1e3b443adf) Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1493: Use after free in Dev ToolsJaroslav Sevcik2022-05-191-7/+7
| | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3510307: Use weak pointers for devtools http server handlers This makes sure that we do not call HttpServer message handlers on a deallocated HttpServer instance. Interestingly, the weak pointer factory was already there, but it was unused. Bug: chromium:1275414 Change-Id: Ic0c33319bb3e67e3c15349d07acbaad64a7f62e3 Reviewed-by: Robbie McElrath <rmcelrath@chromium.org> Reviewed-by: Danil Somsikov <dsv@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/main@{#979140} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-1138: Inappropriate implementation in Web Cursor.Mike Wasserman2022-05-192-5/+7
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3413912: Make web cursor size limits match on browser and renderer Use NSCursor arrowCursor on Mac for ui::mojom::CursorType::kNull. (i.e. when WebCursor is constructed with an overly large custom cursor) Bug: 1246188 Test: Automated unit tests and WPTs Change-Id: I89627fa13cba96b755b8f80adbc91cfc865b6b1b Reviewed-by: Henrique Ferreiro <hferreiro@igalia.com> Reviewed-by: Charlie Harrison <csharrison@chromium.org> Commit-Queue: Mike Wasserman <msw@chromium.org> Auto-Submit: Mike Wasserman <msw@chromium.org> Cr-Commit-Position: refs/heads/main@{#964378} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Quick fix for regression in service workers by reverting backportsMichael Brüning2022-05-1927-421/+91
| | | | | | | | | | | | | This backport causes a crash under certain circumstances. The issue that was being fixed was not a high priority, so reverting until a proper fix has been found. This reverts commits 155c60b9db6b07e16dab7b105865d49ecad2fa84, e67dc64220e00d27be338f507c0fb4872fecdaf1 as well as 6f1275cb40ffbc83dd7b216d554d2765c239144d. Change-Id: Id8ce09cc7115991fa176c588103541a7a52fcd39 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2022-0797: Out of bounds memory access in MojoKen Rockot2022-05-194-12/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3483815: [M96-LTS][mojo-bindings]: Validate message headers sooner M96 merge issues: - multiplex_router.h: conflict in removed lines because of differences in comments above header_validator_ - connector.h: conflicting includes Message header validation has been tied to interface message dispatch, but not all mojo::Message consumers are interface bindings. mojo::Connector is a more general-purpose entry point through which incoming messages are received and transformed into mojo::Message objects. Blink's MessagePort implementation uses Connector directly to transmit and receive raw serialized object data. This change moves MessageHeaderValidator ownership into Connector and always applies its validation immediately after reading a message from the pipe, thereby ensuring that all mojo::Message objects used in production have validated headers before use. (cherry picked from commit 8d5bc69146505785ce299c490e35e3f3ef19f69c) Fixed: 1281908 Change-Id: Ie0e251ab04681a4fd4b849d82c247e0ed800dc04 Commit-Queue: Ken Rockot <rockot@google.com> Cr-Original-Commit-Position: refs/heads/main@{#971263} Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/4664@{#1505} Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix missing dependency for gpu sourcesMichal Klocek2022-04-281-1/+2
| | | | | | | Fix build dependency condition. Change-Id: Iae2e8bf880d8ab098becc3734e8e36cf80b4a942 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Workaround MSVC2022 ICE in constexpr functionsPeter Varga2022-04-272-9/+64
| | | | | | | | | | | | | | | | It happens around initialization of STL containers in a constexpr function. In this case, aggregate initialization of std::array with double braces seems to cause the crash. For some reason it doesn't seem to happen in 98-based. This workaround can be reverted after Microsoft fixes the issue: https://developercommunity.visualstudio.com/t/fatal-error-C1001:-Internal-compiler-err/1669485 Change-Id: I6bc2c71d328691cc74bc53c6d62f3d5df519b81e Pick-to: 90-based Fixes: QTBUG-101917 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 0ce5e91bdfa2cd7cac247911b9e8c4404c114937)
* Fix cross-compilation arm64->x86_64Michal Klocek2022-04-262-10/+16
| | | | | | Task-number: QTBUG-100672 Change-Id: Ibb29c7caf19315956762d9528a6b56a833488e75 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix python callsMichal Klocek2022-04-261-3/+3
| | | | | | | Used python configured with gn. Change-Id: Id9190818a85c052238a7cda846b67a606a685a5e Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-05 02:12:07 +0000