diff --git a/.gitignore b/.gitignore index bd08429..2d75ddd 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ /qtquick3d-everywhere-src-6.8.1.tar.xz /qtquick3d-everywhere-src-6.9.0.tar.xz /qtquick3d-everywhere-src-6.9.1.tar.xz +/qtquick3d-everywhere-src-6.10.1.tar.xz diff --git a/qt6-qtquick3d.spec b/qt6-qtquick3d.spec index 79aeec5..300decb 100644 --- a/qt6-qtquick3d.spec +++ b/qt6-qtquick3d.spec @@ -16,7 +16,7 @@ Summary: Qt6 - Quick3D Libraries and utilities Name: qt6-%{qt_module} -Version: 6.9.1 +Version: 6.10.1 Release: 1%{?dist} License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0 @@ -30,6 +30,9 @@ Source0: https://download.qt.io/development_releases/qt/%{majmin}/%{qt_version}/ Source0: https://download.qt.io/official_releases/qt/%{majmin}/%{version}/submodules/%{qt_module}-everywhere-src-%{version}.tar.xz %endif Patch0: qtquick3d-fix-build-with-gcc11.patch +# CVE-2025-11277: Add overflow check for texture dimensions in Q3DLoader +# https://github.com/assimp/assimp/commit/0978918f7148fbcd3d05cc6573dae7859975a895 +Patch1: qtquick3d-assimp-fix-CVE-2025-11277.patch BuildRequires: cmake BuildRequires: gcc-c++ @@ -134,7 +137,7 @@ mkdir %{buildroot}%{_bindir} pushd %{buildroot}%{_qt6_bindir} for i in * ; do case "${i}" in - balsam|meshdebug|shadergen|balsamui|instancer|materialeditor|shapegen) + balsam|meshdebug|shadergen|balsamui|instancer|materialeditor|shapegen|lightmapviewer) ln -v ${i} %{buildroot}%{_bindir}/${i}-qt6 ;; *) @@ -188,6 +191,7 @@ popd %{_bindir}/instancer-qt6 %{_bindir}/materialeditor-qt6 %{_bindir}/shapegen-qt6 +%{_bindir}/lightmapviewer-qt6 %{_qt6_bindir}/balsam %{_qt6_bindir}/meshdebug %{_qt6_bindir}/shadergen @@ -195,6 +199,7 @@ popd %{_qt6_bindir}/instancer %{_qt6_bindir}/materialeditor %{_qt6_bindir}/shapegen +%{_qt6_bindir}/lightmapviewer %{_qt6_archdatadir}/mkspecs/modules/*.pri %{_qt6_libdir}/qt6/modules/*.json %{_qt6_includedir}/QtQuick3D @@ -223,7 +228,6 @@ popd %dir %{_qt6_libdir}/cmake/Qt6Quick3DAssetUtils/ %dir %{_qt6_libdir}/cmake/Qt6Quick3DAssetUtilsPrivate %dir %{_qt6_libdir}/cmake/Qt6Quick3DEffects/ -%dir %{_qt6_libdir}/cmake/Qt6Quick3DEffectsPrivate/ %dir %{_qt6_libdir}/cmake/Qt6Quick3DGlslParserPrivate %dir %{_qt6_libdir}/cmake/Qt6Quick3DHelpers/ %dir %{_qt6_libdir}/cmake/Qt6Quick3DHelpersPrivate/ @@ -232,7 +236,6 @@ popd %dir %{_qt6_libdir}/cmake/Qt6Quick3DIblBaker %dir %{_qt6_libdir}/cmake/Qt6Quick3DIblBakerPrivate %dir %{_qt6_libdir}/cmake/Qt6Quick3DParticleEffects -%dir %{_qt6_libdir}/cmake/Qt6Quick3DParticleEffectsPrivate %dir %{_qt6_libdir}/cmake/Qt6Quick3DParticles %dir %{_qt6_libdir}/cmake/Qt6Quick3DParticlesPrivate %dir %{_qt6_libdir}/cmake/Qt6Quick3DPrivate @@ -254,7 +257,6 @@ popd %{_qt6_libdir}/cmake/Qt6Quick3DAssetUtils/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DAssetUtilsPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DEffects/*.cmake -%{_qt6_libdir}/cmake/Qt6Quick3DEffectsPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DGlslParserPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DHelpers/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DHelpersPrivate/*.cmake @@ -263,7 +265,6 @@ popd %{_qt6_libdir}/cmake/Qt6Quick3DIblBaker/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DIblBakerPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DParticleEffects/*.cmake -%{_qt6_libdir}/cmake/Qt6Quick3DParticleEffectsPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DParticles/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DParticlesPrivate/*.cmake %{_qt6_libdir}/cmake/Qt6Quick3DPrivate/*.cmake @@ -321,6 +322,12 @@ popd %endif %changelog +* Mon Nov 24 2025 Jan Grulich - 6.10.1-1 +- 6.10.1 + Resolves: RHEL-109197 +- Fix CVE-2025-11277 in bundled assimp library + Resolves: RHEL-120979 + * Wed May 14 2025 Jan Grulich - 6.9.1-1 - 6.9.1 Resolves: RHEL-78543 diff --git a/qtquick3d-assimp-fix-CVE-2025-11277.patch b/qtquick3d-assimp-fix-CVE-2025-11277.patch new file mode 100644 index 0000000..de447b7 --- /dev/null +++ b/qtquick3d-assimp-fix-CVE-2025-11277.patch @@ -0,0 +1,38 @@ +From 4ec60c8dac89776e12bac9eeac00abc5398ec763 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Tue, 25 Nov 2025 13:04:59 +0000 +Subject: [PATCH] Fix CVE-2025-11277: Add overflow check for texture dimensions + in Q3DLoader + +--- + src/3rdparty/assimp/src/code/AssetLib/Q3D/Q3DLoader.cpp | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/3rdparty/assimp/src/code/AssetLib/Q3D/Q3DLoader.cpp b/src/3rdparty/assimp/src/code/AssetLib/Q3D/Q3DLoader.cpp +index 84a5089..8d38926 100644 +--- a/src/3rdparty/assimp/src/code/AssetLib/Q3D/Q3DLoader.cpp ++++ b/src/3rdparty/assimp/src/code/AssetLib/Q3D/Q3DLoader.cpp +@@ -55,6 +55,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + #include + #include + ++#include ++ + namespace Assimp { + + static constexpr aiImporterDesc desc = { +@@ -309,6 +311,11 @@ void Q3DImporter::InternReadFile(const std::string &pFile, + throw DeadlyImportError("Quick3D: Invalid texture. Width or height is zero"); + } + ++ const unsigned int uint_max = std::numeric_limits::max(); ++ if (tex->mWidth > (uint_max / tex->mHeight)) { ++ throw DeadlyImportError("Quick3D: Texture dimensions are too large, resulting in overflow."); ++ } ++ + unsigned int mul = tex->mWidth * tex->mHeight; + aiTexel *begin = tex->pcData = new aiTexel[mul]; + aiTexel *const end = &begin[mul - 1] + 1; +-- +2.47.3 + diff --git a/sources b/sources index 249290a..1aac39c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (qtquick3d-everywhere-src-6.9.1.tar.xz) = ed300ec9eaab59cdd6b15217c0f6b39f2f4678c6757e76ed5ad76654cf542f09abc9af959a2f525abdc8ee43855a3fd4a4f0b6d84cdd3221065cd2e4ae95e517 +SHA512 (qtquick3d-everywhere-src-6.10.1.tar.xz) = 504ababdd325963d81a0539b843d34b71cc4059d646084d332bc02d48aa3d2e3d518e75e3fb975a58c6a9f13fa34dc1556b5c5a324c52401dbf3e53e56186004