[neon/qt/qtsvg/Neon/release] debian: Drop CVE-2021-3481.diff, included in the new release.
Dmitry Shachnev
null at kde.org
Fri Jul 15 12:11:36 BST 2022
Git commit cbaed9d410dd562cde7eb559b084008029f0324b by Dmitry Shachnev.
Committed on 12/05/2022 at 21:46.
Pushed by jriddell into branch 'Neon/release'.
Drop CVE-2021-3481.diff, included in the new release.
M +1 -0 debian/changelog
D +0 -25 debian/patches/CVE-2021-3481.diff
M +0 -1 debian/patches/series
https://invent.kde.org/neon/qt/qtsvg/commit/cbaed9d410dd562cde7eb559b084008029f0324b
diff --git a/debian/changelog b/debian/changelog
index d0bb691..320a25b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,7 @@ qtsvg-opensource-src (5.15.4-1) UNRELEASED; urgency=medium
* New upstream release.
* Bump Qt build-dependencies to 5.15.4.
* Bump ABI version to 5-15-4.
+ * Drop CVE-2021-3481.diff, included in the new release.
-- Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org> Fri, 13 May 2022 00:26:34 +0300
diff --git a/debian/patches/CVE-2021-3481.diff b/debian/patches/CVE-2021-3481.diff
deleted file mode 100644
index f49d1df..0000000
--- a/debian/patches/CVE-2021-3481.diff
+++ /dev/null
@@ -1,25 +0,0 @@
-Description: clamp parsed doubles to float representable values
-Origin: upstream, https://code.qt.io/cgit/qt/qtsvg.git/commit/?id=bfd6ee0d8cf34b63
-Last-Update: 2022-03-05
-
---- a/src/svg/qsvghandler.cpp
-+++ b/src/svg/qsvghandler.cpp
-@@ -673,7 +673,8 @@ static qreal toDouble(const QChar *&str)
- val = -val;
- } else {
- val = QByteArray::fromRawData(temp, pos).toDouble();
-- if (qFpClassify(val) != FP_NORMAL)
-+ // Do not tolerate values too wild to be represented normally by floats
-+ if (qFpClassify(float(val)) != FP_NORMAL)
- val = 0;
- }
- return val;
-@@ -3046,6 +3047,8 @@ static QSvgStyleProperty *createRadialGr
- ncy = toDouble(cy);
- if (!r.isEmpty())
- nr = toDouble(r);
-+ if (nr < 0.5)
-+ nr = 0.5;
-
- qreal nfx = ncx;
- if (!fx.isEmpty())
diff --git a/debian/patches/series b/debian/patches/series
index dccecd7..88d2933 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,2 @@
-CVE-2021-3481.diff
CVE-2021-45930.diff
reject_oversize_svgs.diff
More information about the Neon-commits
mailing list