Re: [Buildroot] [PATCH 1/1] package/qt6base: fix CVE-2024-39936

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Roy,

On Thu, 15 Aug 2024 08:28:39 +0200
Roy Kollen Svendsen <roykollensvendsen@gmail.com> wrote:

> Fixes:
> https://security-tracker.debian.org/tracker/CVE-2024-39936
> 
> Got patch from:
> https://download.qt.io/official_releases/qt/6.7/CVE-2024-39936-qtbase-6.7.patch
> 
> Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>

Thanks for the fix, but I actually have a request, see below.

> diff --git a/package/qt6/qt6base/0001-fix-CVE-2024-39936.patch b/package/qt6/qt6base/0001-fix-CVE-2024-39936.patch
> new file mode 100644
> index 0000000000..1d11eb9fd9
> --- /dev/null
> +++ b/package/qt6/qt6base/0001-fix-CVE-2024-39936.patch
> @@ -0,0 +1,155 @@
> +From 627617b002a34a9a0a63bcd9529c655e93d6246e Mon Sep 17 00:00:00 2001
> +From: Roy Kollen Svendsen <roykollensvendsen@gmail.com>

The patch is not from you. I know the patch
at https://download.qt.io/official_releases/qt/6.7/CVE-2024-39936-qtbase-6.7.patch
does not have any author information (which is kind of crappy from the
Qt people), but it would be really really better to use the real
upstream patch. So instead, could you cherry
pick https://github.com/qt/qtbase/commit/2b1e36e183ce75c224305c7a94457b92f7a5cf58,
adding the Upstream: link and your Signed-off-by ?

Another question: in https://download.qt.io/official_releases/qt/6.7/,
I see two other patches for CVEs. Do we want them?

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot