Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[r20.03] sigil: 0.9.14 -> 0.9.16, addressing CVE-2019-14452 #95583

Merged
merged 1 commit into from Aug 21, 2020

Conversation

risicle
Copy link
Contributor

@risicle risicle commented Aug 16, 2020

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2019-14452

Seems to work fine, tested non-nixos linux x86_64.

master bumped in #95537

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • [x ] Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@mweinelt
Copy link
Member

mweinelt commented Aug 18, 2020

Builds, but segfaults for me.

Fontconfig warning: "/etc/fonts/2.11/fonts.conf", line 5: unknown element "description"
Fontconfig error: "/etc/fonts/2.11/fonts.conf", line 5: invalid attribute 'domain'
Fontconfig warning: "/etc/fonts/2.11/conf.d/10-hinting-slight.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/10-scale-bitmap-fonts.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/20-unhint-small-vera.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/30-metric-aliases.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/40-nonlatin.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/45-generic.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/45-latin.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/49-sansserif.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/51-local.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/60-generic.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/60-latin.conf", line 4: unknown element "description"
Fontconfig warning: "/etc/fonts/2.11/conf.d/65-nonlatin.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/10-hinting-slight.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/20-unhint-small-vera.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/30-metric-aliases.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/40-nonlatin.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/45-generic.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/45-latin.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/49-sansserif.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/51-local.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/60-generic.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/60-latin.conf", line 4: unknown element "description"
Fontconfig warning: "/nix/store/4arv3m974gnhl5jyry94bbhp25lv20cr-fontconfig-2.13.92/etc/fonts/conf.d/65-nonlatin.conf", line 4: unknown element "description"
Fontconfig error: Cannot load config file from /etc/fonts/2.11/fonts.conf
Fontconfig warning: FcPattern object width does not accept value [60 402)
Segmentation fault (core dumped)
Program received signal SIGSEGV, Segmentation fault.
0x00007fffef478eae in QGuiApplication::font() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
(gdb) bt full
#0  0x00007fffef478eae in QGuiApplication::font() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
No symbol table info available.
#1  0x00007fffef535651 in QFont::QFont() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
No symbol table info available.
#2  0x00007ffff754f34d in QWidgetPrivate::QWidgetPrivate(int) () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Widgets.so.5
No symbol table info available.
#3  0x00007ffff775aaca in QMessageBox::QMessageBox(QWidget*) () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Widgets.so.5
No symbol table info available.
#4  0x00000000006a1ecf in Utility::DisplayExceptionErrorDialog(QString const&) ()
No symbol table info available.
#5  0x0000000000536993 in MessageHandler(QtMsgType, QMessageLogContext const&, QString const&) ()
No symbol table info available.
#6  0x00007fffee823678 in ?? () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Core.so.5
No symbol table info available.
#7  0x00007fffee823799 in ?? () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Core.so.5
No symbol table info available.
#8  0x00007fffee7f3582 in QMessageLogger::fatal(char const*, ...) const () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Core.so.5
No symbol table info available.
#9  0x00007fffef47b8df in QGuiApplicationPrivate::createPlatformIntegration() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
No symbol table info available.
#10 0x00007fffef47c690 in QGuiApplicationPrivate::createEventDispatcher() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
No symbol table info available.
#11 0x00007fffeea01695 in QCoreApplicationPrivate::init() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Core.so.5
No symbol table info available.
#12 0x00007fffef47e48f in QGuiApplicationPrivate::init() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Gui.so.5
No symbol table info available.
#13 0x00007ffff752d4e9 in QApplicationPrivate::init() () from /nix/store/ldsisvmqar1hcdkc0pz4qqxgqs76a5r2-qtbase-5.12.7/lib/libQt5Widgets.so.5
No symbol table info available.
#14 0x000000000075c53e in MainApplication::MainApplication(int&, char**) ()
No symbol table info available.
#15 0x000000000050cb73 in main ()
No symbol table info available.

Result of nixpkgs-review pr 95583 1

1 package built:
- sigil

@risicle
Copy link
Contributor Author

risicle commented Aug 18, 2020

QGuiApplication::font() ? That's weird. I needed to run it under nixGL but it ran for me. Will take a closer look tomorrow.

@risicle
Copy link
Contributor Author

risicle commented Aug 19, 2020

Incidentally, does the existing 0.9.14 work for you without crashing?

@mweinelt
Copy link
Member

Incidentally, does the existing 0.9.14 work for you without crashing?

Yes, it does.

@risicle
Copy link
Contributor Author

risicle commented Aug 20, 2020

@mweinelt might just go the patching route - does #95873 work for you?

@infinisil
Copy link
Member

@mweinelt So to just be sure, this one fails (that's HEAD~ of this PR):

$ /nix/store/yifkzcg07kfvasmc1ycc53nav5s3n4kh-sigil-0.9.14/bin/sigil

While this one succeeds (that's from this PR):

$ /nix/store/w8fp0kmqnqfb4gh8lji6gfrj4am47rh9-sigil-0.9.16/bin/sigil

Is that correct?

@mweinelt
Copy link
Member

/nix/store/w8fp0kmqnqfb4gh8lji6gfrj4am47rh9-sigil-0.9.16

#95583 crashes.

/nix/store/xlsl4iqgcphvxq9s4gm4p0zzzl4h7jzc-sigil-0.9.14

#95873 crashes.

nix-build --check -A sigil
/nix/store/yifkzcg07kfvasmc1ycc53nav5s3n4kh-sigil-0.9.14

release-20.03 crashes as well.

 - system: `"x86_64-linux"`
 - host os: `Linux 5.7.15, NixOS, 20.09.git.b78e08e981a (Nightingale)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.3.7`
 - channels(root): `"nixos-20.09pre236721.840c782d507, nixos-unstable-20.09pre236721.840c782d507"`
 - channels(hexa): `""`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

@infinisil
Copy link
Member

@mweinelt Which version worked for you in #95583 (comment) then?

@mweinelt
Copy link
Member

@mweinelt Which version worked for you in #95583 (comment) then?

I think that was 0.9.14 from master :/

@infinisil
Copy link
Member

Alright, then this PR didn't break it for wayland, because it never worked on 20.03 anyways. @mweinelt I believe you mistakenly answered in #95583 (comment) then, because the current version on master isn't 0.9.14 but rather 1.3.0. For the future please make sure to compare PRs against the base branch and not master :)

@infinisil infinisil merged commit 666d310 into NixOS:release-20.03 Aug 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants