moritzruth/void-packages
1
0
Fork 0
Code Releases Activity Actions 2

kdepimlibs: add CVE-2016-7966_part2.patch

Browse source 
since the last patch for CVE-2016-7966 did not fix the vulnerability entirely
according to the information released by the KDE project, this commit adds the
second patch released to fix CVE-2016-7966.
This commit is contained in:
Helmut Pozimski 2016-11-02 19:17:00 +01:00
parent 099ef6c792
commit abef251c79
2 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
srcpkgs/kdepimlibs/patches/CVE-2016-7966_part2.patch Normal file
View file

@ -0,0 +1,29 @@
--- kpimutils/linklocator.cpp
+++ kpimutils/linklocator.cpp
@@ -389,7 +389,23 @@
bool badUrl = false;
str = locator.getUrlAndCheckValidHref(&badUrl);
if (badUrl) {
- return locator.mText;
+ QString resultBadUrl;
+ const int helperTextSize(locator.mText.count());
+ for (int i = 0; i < helperTextSize; ++i) {
+ const QChar chBadUrl = locator.mText[i];
+ if (chBadUrl == QLatin1Char('&')) {
+ resultBadUrl += QLatin1String("&amp;");
+ } else if (chBadUrl == QLatin1Char('"')) {
+ resultBadUrl += QLatin1String("&quot;");
+ } else if (chBadUrl == QLatin1Char('<')) {
+ resultBadUrl += QLatin1String("&lt;");
+ } else if (chBadUrl == QLatin1Char('>')) {
+ resultBadUrl += QLatin1String("&gt;");
+ } else {
+ resultBadUrl += chBadUrl;
+ }
+ }
+ return resultBadUrl;
}
if ( !str.isEmpty() ) {

2
srcpkgs/kdepimlibs/template
View file

@ -1,7 +1,7 @@
# Template file for 'kdepimlibs' # Template file for 'kdepimlibs'
pkgname=kdepimlibs pkgname=kdepimlibs
version=4.14.3 version=4.14.3
revision=4 revision=5
short_desc="KDE PIM Libraries" short_desc="KDE PIM Libraries"
maintainer="Juan RP <xtraeme@voidlinux.eu>" maintainer="Juan RP <xtraeme@voidlinux.eu>"
license="GPL-2, LGPL-2.1, FDL" license="GPL-2, LGPL-2.1, FDL"