Add patch for CVE-2014-0190 (DoS in the GIF image handler).

MFH:		2014Q3
Security:	904d78b8-0f7e-11e4-8b71-5453ed2e2b49

4 files changed, 76 insertions, 2 deletions

diff --git a/x11-toolkits/qt4-gui/Makefile b/x11-toolkits/qt4-gui/Makefile
index 2879935f6d22..175b7c331b17 100644
--- a/x11-toolkits/qt4-gui/Makefile
+++ b/x11-toolkits/qt4-gui/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	gui
 DISTVERSION=	${QT4_VERSION}
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	x11-toolkits
 PKGNAMEPREFIX=	qt4-
 
diff --git a/x11-toolkits/qt4-gui/files/patch-CVE-2014-0190 b/x11-toolkits/qt4-gui/files/patch-CVE-2014-0190
new file mode 100644
index 000000000000..46e2e0e104c2
--- /dev/null
+++ b/x11-toolkits/qt4-gui/files/patch-CVE-2014-0190
@@ -0,0 +1,38 @@
+commit f1b76c126c476c155af8c404b97c42cd1a709333
+Author: Lars Knoll <lars.knoll@digia.com>
+Date:   Thu Apr 24 15:33:27 2014 +0200
+
+    Don't crash on broken GIF images
+    
+    Broken GIF images could set invalid width and height
+    values inside the image, leading to Qt creating a null
+    QImage for it. In that case we need to abort decoding
+    the image and return an error.
+    
+    Initial patch by Rich Moore.
+    
+    Backport of Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e from Qt 5
+    
+    Task-number: QTBUG-38367
+    Change-Id: I0680740018aaa8356d267b7af3f01fac3697312a
+    Security-advisory: CVE-2014-0190
+    Reviewed-by: Richard J. Moore <rich@kde.org>
+
+diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
+index 3324f04..5199dd3 100644
+--- src/gui/image/qgifhandler.cpp
++++ src/gui/image/qgifhandler.cpp
+@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
+                     memset(bits, 0, image->byteCount());
+                 }
+ 
++                // Check if the previous attempt to create the image failed. If it
++                // did then the image is broken and we should give up.
++                if (image->isNull()) {
++                    state = Error;
++                    return -1;
++                }
++
+                 disposePrevious(image);
+                 disposed = false;
+ 
diff --git a/x11-toolkits/qt5-gui/Makefile b/x11-toolkits/qt5-gui/Makefile
index 1ca0a2186cc7..bc320077089e 100644
--- a/x11-toolkits/qt5-gui/Makefile
+++ b/x11-toolkits/qt5-gui/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	gui
 DISTVERSION=	${QT5_VERSION}
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	x11-toolkits graphics
 PKGNAMEPREFIX=	qt5-
 
diff --git a/x11-toolkits/qt5-gui/files/patch-CVE-2014-0190 b/x11-toolkits/qt5-gui/files/patch-CVE-2014-0190
new file mode 100644
index 000000000000..cfbbe0f755c4
--- /dev/null
+++ b/x11-toolkits/qt5-gui/files/patch-CVE-2014-0190
@@ -0,0 +1,36 @@
+commit eb1325047f2697d24e93ebaf924900affc876bc1
+Author: Lars Knoll <lars.knoll@digia.com>
+Date:   Thu Apr 24 15:33:27 2014 +0200
+
+    Don't crash on broken GIF images
+    
+    Broken GIF images could set invalid width and height
+    values inside the image, leading to Qt creating a null
+    QImage for it. In that case we need to abort decoding
+    the image and return an error.
+    
+    Initial patch by Rich Moore.
+    
+    Task-number: QTBUG-38367
+    Change-Id: Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e
+    Security-advisory: CVE-2014-0190
+    Reviewed-by: Richard J. Moore <rich@kde.org>
+
+diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
+index eeb62af..19b8382 100644
+--- src/gui/image/qgifhandler.cpp
++++ src/gui/image/qgifhandler.cpp
+@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
+                     memset(bits, 0, image->byteCount());
+                 }
+ 
++                // Check if the previous attempt to create the image failed. If it
++                // did then the image is broken and we should give up.
++                if (image->isNull()) {
++                    state = Error;
++                    return -1;
++                }
++
+                 disposePrevious(image);
+                 disposed = false;
+