Skip to content

Commit 38baa5f

Browse files
PastaPastaPastaPastaPastaPasta
committed
Merge #6949: depends: Qt 5.15.18
04b647f doc: update `dependencies.md` (Kittywhiskers Van Gogh) 5046964 depends: add patches included with Qt 5.15.19 (Kittywhiskers Van Gogh) 0286d78 depends: Qt 5.15.18 (Kittywhiskers Van Gogh) Pull request description: ## Motivation Bitcoin switched to Qt 6.x in [bitcoin#30997](bitcoin#30997), upgrading from Qt 5.15.16 to Qt 6.7.3. This transition was enabled by, alongside a series of changes to GUI code, migrating the build system to CMake (see [bitcoin#30454](bitcoin#30454)). While efforts have been undertaken to bridge the gap between the pre-transition Autotools infrastructure and our infrastructure, migration is complicated by two factors: * The need for significant OOO backports to bridge the gap * Our divergence from upstream's GUI implementation that will require manual assessment to follow best Qt 6 practices This means that the timeline to migration is medium-term at best but in the meanwhile, the latest OSS version of Qt is 5.15.18 ([source](https://lists.qt-project.org/pipermail/announce/2025-October/000592.html)) and between 5.15.16 and 5.15.19 (the as-of-this-writing, still proprietary release of Qt, [source](https://www.qt.io/blog/commercial-lts-qt-5.15.19-released)), mitigations for vulnerabilities have been included ([source](https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products)). While Qt 5.15.19 OSS is not available, critical patches shipped with them are. This pull request updates our Qt depends to the latest available OSS release (v5.15.18) and includes the patches included in the 5.15.19 release. ## Additional Information * Guidance on patch application has been taken from the `qt@5` Homebrew formula ([source](https://github.com/Homebrew/homebrew-core/blob/013dad6a9c390da76aacba8249afa47d4c807a85/Formula/q/qt@5.rb)). * The patches themselves have been sourced from Qt ([source](https://download.qt.io/archive/qt/5.15/)) and modified to fit the build's directory structure, it should remain identical otherwise. *`clang_18_libpng.patch` has been dropped as it is already included in v5.15.18 ## Breaking Changes None expected. ## Checklist - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas **(note: N/A)** - [x] I have added or updated relevant unit/integration/functional/e2e tests **(note: N/A)** - [x] I have made corresponding changes to the documentation - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_ ACKs for top commit: PastaPastaPasta: utACK 04b647f UdjinM6: light ACK 04b647f Tree-SHA512: 02e497e32561fcd91c4a08cf389a522cec14b8fc98cd3b5c4bc108d829dc32009c8ade52651e4f56d0d43b9cbad2d2cff9a6ec95e1bfc5a4b2167c0a8d47e791
2 parents 69f9093 + 04b647f commit 38baa5f

File tree

6 files changed

+248
-47
lines changed

6 files changed

+248
-47
lines changed

‎depends/packages/qt.mk‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
package=qt
2-
$(package)_version=5.15.16
2+
$(package)_version=5.15.18
33
$(package)_download_path=https://download.qt.io/archive/qt/5.15/$($(package)_version)/submodules
44
$(package)_suffix=everywhere-opensource-src-$($(package)_version).tar.xz
55
$(package)_file_name=qtbase-$($(package)_suffix)
6-
$(package)_sha256_hash=b04815058c18058b6ba837206756a2c87d1391f07a0dcb0dd314f970fd041592
6+
$(package)_sha256_hash=7b632550ea1048fc10c741e46e2e3b093e5ca94dfa6209e9e0848800e247023b
77
$(package)_linux_dependencies=freetype fontconfig libxcb libxkbcommon libxcb_util libxcb_util_render libxcb_util_keysyms libxcb_util_image libxcb_util_wm
88
$(package)_qt_libs=corelib network widgets gui plugins testlib
99
$(package)_linguist_tools = lrelease lupdate lconvert
@@ -20,16 +20,18 @@ $(package)_patches += rcc_hardcode_timestamp.patch
2020
$(package)_patches += duplicate_lcqpafonts.patch
2121
$(package)_patches += guix_cross_lib_path.patch
2222
$(package)_patches += memory_resource.patch
23-
$(package)_patches += clang_18_libpng.patch
2423
$(package)_patches += utc_from_string_no_optimize.patch
2524
$(package)_patches += windows_lto.patch
2625
$(package)_patches += darwin_no_libm.patch
26+
$(package)_patches += CVE-2025-4211-qtbase-5.15.patch
27+
$(package)_patches += CVE-2025-5455-qtbase-5.15.patch
28+
$(package)_patches += CVE-2025-30348-qtbase-5.15.patch
2729

2830
$(package)_qttranslations_file_name=qttranslations-$($(package)_suffix)
29-
$(package)_qttranslations_sha256_hash=415dbbb82a75dfc9a7be969e743bee54c0e6867be37bce4cf8f03da39f20112a
31+
$(package)_qttranslations_sha256_hash=e5625757913caf66a9d702ba102ae92cb165d8dde17759b6de9fdea84a1f857f
3032

3133
$(package)_qttools_file_name=qttools-$($(package)_suffix)
32-
$(package)_qttools_sha256_hash=1cab11887faca54af59f4995ee435c9ad98d194e9e6889c846692c8b6815fc1c
34+
$(package)_qttools_sha256_hash=931e0969d9f9d8f233e5e9bf9db0cea9ce9914d49982f1795fe6191010113568
3335

3436
$(package)_extra_sources = $($(package)_qttranslations_file_name)
3537
$(package)_extra_sources += $($(package)_qttools_file_name)
@@ -247,13 +249,15 @@ define $(package)_preprocess_cmds
247249
patch -p1 -i $($(package)_patch_dir)/qtbase-moc-ignore-gcc-macro.patch && \
248250
patch -p1 -i $($(package)_patch_dir)/memory_resource.patch && \
249251
patch -p1 -i $($(package)_patch_dir)/no_warnings_for_symbols.patch && \
250-
patch -p1 -i $($(package)_patch_dir)/clang_18_libpng.patch && \
251252
patch -p1 -i $($(package)_patch_dir)/rcc_hardcode_timestamp.patch && \
252253
patch -p1 -i $($(package)_patch_dir)/duplicate_lcqpafonts.patch && \
253254
patch -p1 -i $($(package)_patch_dir)/utc_from_string_no_optimize.patch && \
254255
patch -p1 -i $($(package)_patch_dir)/guix_cross_lib_path.patch && \
255256
patch -p1 -i $($(package)_patch_dir)/windows_lto.patch && \
256257
patch -p1 -i $($(package)_patch_dir)/darwin_no_libm.patch && \
258+
patch -p1 -i $($(package)_patch_dir)/CVE-2025-4211-qtbase-5.15.patch && \
259+
patch -p1 -i $($(package)_patch_dir)/CVE-2025-5455-qtbase-5.15.patch && \
260+
patch -p1 -i $($(package)_patch_dir)/CVE-2025-30348-qtbase-5.15.patch && \
257261
mkdir -p qtbase/mkspecs/macx-clang-linux &&\
258262
cp -f qtbase/mkspecs/macx-clang/qplatformdefs.h qtbase/mkspecs/macx-clang-linux/ &&\
259263
cp -f $($(package)_patch_dir)/mac-qmake.conf qtbase/mkspecs/macx-clang-linux/qmake.conf && \

‎depends/patches/qt/CVE-2025-30348-qtbase-5.15.patch‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
From 16918c1df3e709df2a97281e3825d94c84edb668 Mon Sep 17 00:00:00 2001
2+
From: Christian Ehrlicher <ch.ehrlicher@gmx.de>
3+
Date: Tue, 06 Aug 2024 22:39:44 +0200
4+
Subject: [PATCH] XML/QDom: speedup encodeText()
5+
6+
The code copied the whole string, then replaced parts inline, at
7+
the cost of relocating everything beyond, at each replacement.
8+
Instead, copy character by character (in chunks where possible)
9+
and append replacements as we skip what they replace.
10+
11+
Manual conflict resolution for 6.5:
12+
- This is a manual cherry-pick. The original change was only
13+
picked to 6.8, but the quadratic behavior is present in Qt 5, too.
14+
- Changed Task-number to Fixes: because this is the real fix;
15+
the QString change, 315210de916d060c044c01e53ff249d676122b1b,
16+
was unrelated to the original QTBUG-127549.
17+
18+
Manual conflcit resolution for 5.15:
19+
- Kept/re-added QTextCodec::canEncode() check
20+
- Ported from Qt 6 to 5, to wit:
21+
- qsizetype -> int
22+
- QStringView::first/sliced(n) -> left/mid(n)
23+
(these functions are clearly called in-range, so the widened
24+
contract of the Qt 5 functions doesn't matter)
25+
- Ported from C++17- and C++14-isms to C++11:
26+
- replaced polymorphic lambda with a normal one (this requires
27+
rewriting the !canEncode() branch to use QByteArray/QLatin1String
28+
instead of QString)
29+
- As a drive-by, corrected the indentation of the case labels to
30+
horizontally align existing code (and follow Qt style)
31+
32+
Fixes: QTBUG-127549
33+
Change-Id: I368482859ed0c4127f1eec2919183711b5488ada
34+
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
35+
(cherry picked from commit 2ce08e3671b8d18b0284447e5908ce15e6e8f80f)
36+
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
37+
(cherry picked from commit 225e235cf966a44af23dbe9aaaa2fd20ab6430ee)
38+
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
39+
(cherry picked from commit 905a5bd421efff6a1d90b6140500d134d32ca745)
40+
---
41+
42+
diff --git a/qtbase/src/xml/dom/qdom.cpp b/qtbase/src/xml/dom/qdom.cpp
43+
index 872221c..bf70477 100644
44+
--- a/qtbase/src/xml/dom/qdom.cpp
45+
+++ b/qtbase/src/xml/dom/qdom.cpp
46+
@@ -3676,59 +3676,67 @@
47+
const QTextCodec *const codec = s.codec();
48+
Q_ASSERT(codec);
49+
#endif
50+
- QString retval(str);
51+
- int len = retval.length();
52+
- int i = 0;
53+
+ QString retval;
54+
+ int start = 0;
55+
+ auto appendToOutput = [&](int cur, QLatin1String replacement)
56+
+ {
57+
+ if (start < cur) {
58+
+ retval.reserve(str.size() + replacement.size());
59+
+ retval.append(QStringView(str).left(cur).mid(start));
60+
+ }
61+
+ // Skip over str[cur], replaced by replacement
62+
+ start = cur + 1;
63+
+ retval.append(replacement);
64+
+ };
65+
66+
- while (i < len) {
67+
- const QChar ati(retval.at(i));
68+
-
69+
- if (ati == QLatin1Char('<')) {
70+
- retval.replace(i, 1, QLatin1String("&lt;"));
71+
- len += 3;
72+
- i += 4;
73+
- } else if (encodeQuotes && (ati == QLatin1Char('"'))) {
74+
- retval.replace(i, 1, QLatin1String("&quot;"));
75+
- len += 5;
76+
- i += 6;
77+
- } else if (ati == QLatin1Char('&')) {
78+
- retval.replace(i, 1, QLatin1String("&amp;"));
79+
- len += 4;
80+
- i += 5;
81+
- } else if (ati == QLatin1Char('>') && i >= 2 && retval[i - 1] == QLatin1Char(']') && retval[i - 2] == QLatin1Char(']')) {
82+
- retval.replace(i, 1, QLatin1String("&gt;"));
83+
- len += 3;
84+
- i += 4;
85+
- } else if (performAVN &&
86+
- (ati == QChar(0xA) ||
87+
- ati == QChar(0xD) ||
88+
- ati == QChar(0x9))) {
89+
- const QString replacement(QLatin1String("&#x") + QString::number(ati.unicode(), 16) + QLatin1Char(';'));
90+
- retval.replace(i, 1, replacement);
91+
- i += replacement.length();
92+
- len += replacement.length() - 1;
93+
- } else if (encodeEOLs && ati == QChar(0xD)) {
94+
- retval.replace(i, 1, QLatin1String("&#xd;")); // Replace a single 0xD with a ref for 0xD
95+
- len += 4;
96+
- i += 5;
97+
- } else {
98+
+ const int len = str.size();
99+
+ for (int cur = 0; cur < len; ++cur) {
100+
+ switch (const char16_t ati = str[cur].unicode()) {
101+
+ case u'<':
102+
+ appendToOutput(cur, QLatin1String("&lt;"));
103+
+ break;
104+
+ case u'"':
105+
+ if (encodeQuotes)
106+
+ appendToOutput(cur, QLatin1String("&quot;"));
107+
+ break;
108+
+ case u'&':
109+
+ appendToOutput(cur, QLatin1String("&amp;"));
110+
+ break;
111+
+ case u'>':
112+
+ if (cur >= 2 && str[cur - 1] == u']' && str[cur - 2] == u']')
113+
+ appendToOutput(cur, QLatin1String("&gt;"));
114+
+ break;
115+
+ case u'\r':
116+
+ if (performAVN || encodeEOLs)
117+
+ appendToOutput(cur, QLatin1String("&#xd;")); // \r == 0x0d
118+
+ break;
119+
+ case u'\n':
120+
+ if (performAVN)
121+
+ appendToOutput(cur, QLatin1String("&#xa;")); // \n == 0x0a
122+
+ break;
123+
+ case u'\t':
124+
+ if (performAVN)
125+
+ appendToOutput(cur, QLatin1String("&#x9;")); // \t == 0x09
126+
+ break;
127+
+ default:
128+
#if QT_CONFIG(textcodec)
129+
if(codec->canEncode(ati))
130+
- ++i;
131+
+ ; // continue
132+
else
133+
#endif
134+
{
135+
// We have to use a character reference to get it through.
136+
- const ushort codepoint(ati.unicode());
137+
- const QString replacement(QLatin1String("&#x") + QString::number(codepoint, 16) + QLatin1Char(';'));
138+
- retval.replace(i, 1, replacement);
139+
- i += replacement.length();
140+
- len += replacement.length() - 1;
141+
+ const QByteArray replacement = "&#x" + QByteArray::number(uint{ati}, 16) + ';';
142+
+ appendToOutput(cur, QLatin1String{replacement});
143+
}
144+
+ break;
145+
}
146+
}
147+
-
148+
- return retval;
149+
+ if (start > 0) {
150+
+ retval.append(QStringView(str).left(len).mid(start));
151+
+ return retval;
152+
+ }
153+
+ return str;
154+
}
155+
156+
void QDomAttrPrivate::save(QTextStream& s, int, int) const

‎depends/patches/qt/CVE-2025-4211-qtbase-5.15.patch‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
From 3d20cd0105c2ae06605c5078e7675e200f1a001a Mon Sep 17 00:00:00 2001
2+
From: Mårten Nordheim <marten.nordheim@qt.io>
3+
Date: Mon, 17 Mar 2025 14:22:11 +0100
4+
Subject: [PATCH] QFileSystemEngine/Win: Use GetTempPath2 when available
5+
6+
Because the documentation for GetTempPath nows says apps should call
7+
GetTempPath2.[0]
8+
9+
Starting with Windows 11[1], and recently Windows 10[2],
10+
GetTempPath2 was added. The difference being that elevated
11+
processes are returned a different directory. Usually
12+
'C:\Windows\SystemTemp'.
13+
14+
Currently temporary files of an elevated process may be placed in a
15+
world write-able location. GetTempPath2, by default, but can be
16+
overridden, places it in a directory that's only accessible by SYSTEM
17+
and administrators.
18+
19+
[0] https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppathw#remarks
20+
[1] https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppath2w
21+
(Minimum supported client - Windows 11 Build 22000)
22+
[2] https://blogs.windows.com/windows-insider/2025/03/13/releasing-windows-10-build-19045-5674-to-the-release-preview-channel/
23+
(This update enables system processes to store temporary files ...)
24+
25+
[ChangeLog][QtCore][Important Behavior Changes] On
26+
Windows, generating temporary directories for processes with elevated
27+
privileges may now return a different path with a stricter
28+
set of permissions. Please consult Microsoft's documentation from when
29+
they made the same change for the .NET framework:
30+
https://support.microsoft.com/en-us/topic/gettemppath-changes-in-windows-february-cumulative-update-preview-4cc631fb-9d97-4118-ab6d-f643cd0a7259
31+
32+
Change-Id: I5caf11151fb2f711bbc5599231f140598b3c9d03
33+
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
34+
(cherry picked from commit 69633bcb58e681bac5bff3744e5a2352788dc36c)
35+
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
36+
(cherry picked from commit 6a684a53b371ec483b27bf243af24819be63f85f)
37+
(cherry picked from commit bbeccc0c22e520f46f0b33e281fa5ac85ac9c727)
38+
(cherry picked from commit 59d7eb9bbb4f13cccbd9323fd995a8c108b56e60)
39+
---
40+
41+
diff --git a/qtbase/src/corelib/io/qfilesystemengine_win.cpp b/qtbase/src/corelib/io/qfilesystemengine_win.cpp
42+
index 75c661f..37a400f 100644
43+
--- a/qtbase/src/corelib/io/qfilesystemengine_win.cpp
44+
+++ b/qtbase/src/corelib/io/qfilesystemengine_win.cpp
45+
@@ -1390,7 +1390,15 @@
46+
QString ret;
47+
#ifndef Q_OS_WINRT
48+
wchar_t tempPath[MAX_PATH];
49+
- const DWORD len = GetTempPath(MAX_PATH, tempPath);
50+
+ using GetTempPathPrototype = DWORD (WINAPI *)(DWORD, LPWSTR);
51+
+ // We try to resolve GetTempPath2 and use that, otherwise fall back to GetTempPath:
52+
+ static GetTempPathPrototype getTempPathW = []() {
53+
+ const HMODULE kernel32 = GetModuleHandleW(L"kernel32.dll");
54+
+ if (auto *func = QFunctionPointer(GetProcAddress(kernel32, "GetTempPath2W")))
55+
+ return GetTempPathPrototype(func);
56+
+ return GetTempPath;
57+
+ }();
58+
+ const DWORD len = getTempPathW(MAX_PATH, tempPath);
59+
if (len) { // GetTempPath() can return short names, expand.
60+
wchar_t longTempPath[MAX_PATH];
61+
const DWORD longLen = GetLongPathName(tempPath, longTempPath, MAX_PATH);

‎depends/patches/qt/CVE-2025-5455-qtbase-5.15.patch‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
diff --git a/qtbase/src/corelib/io/qdataurl.cpp b/qtbase/src/corelib/io/qdataurl.cpp
2+
index f14d399301f..83e59e3ac00 100644
3+
--- a/qtbase/src/corelib/io/qdataurl.cpp
4+
+++ b/qtbase/src/corelib/io/qdataurl.cpp
5+
@@ -76,10 +76,11 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const QUrl &uri, QString &mimeType, QByteArray
6+
}
7+
8+
if (data.toLower().startsWith("charset")) {
9+
- int i = 7; // strlen("charset")
10+
- while (data.at(i) == ' ')
11+
- ++i;
12+
- if (data.at(i) == '=')
13+
+ int prefixSize = 7; // strlen("charset")
14+
+ QLatin1String copy(data.constData() + prefixSize, data.size() - prefixSize);
15+
+ while (copy.startsWith(QLatin1String(" ")))
16+
+ copy = copy.mid(1);
17+
+ if (copy.startsWith(QLatin1String("=")))
18+
data.prepend("text/plain;");
19+
}
20+

‎depends/patches/qt/clang_18_libpng.patch‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎doc/dependencies.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ You can find installation instructions in the `build-*.md` file for your platfor
3333
| [Fontconfig](../depends/packages/fontconfig.mk) | [link](https://www.freedesktop.org/wiki/Software/fontconfig/) | [2.12.6](https://github.com/bitcoin/bitcoin/pull/23495) | 2.6 | Yes |
3434
| [FreeType](../depends/packages/freetype.mk) | [link](https://freetype.org) | [2.11.0](https://github.com/bitcoin/bitcoin/commit/01544dd78ccc0b0474571da854e27adef97137fb) | 2.3.0 | Yes |
3535
| [qrencode](../depends/packages/qrencode.mk) | [link](https://fukuchi.org/works/qrencode/) | [4.1.1](https://github.com/bitcoin/bitcoin/pull/27312) | | No |
36-
| [Qt](../depends/packages/qt.mk) | [link](https://download.qt.io/official_releases/qt/) | [5.15.16](https://github.com/bitcoin/bitcoin/pull/30774) | [5.11.3](https://github.com/bitcoin/bitcoin/pull/24132) | No |
36+
| [Qt](../depends/packages/qt.mk) | [link](https://download.qt.io/official_releases/qt/) | [5.15.18](https://github.com/dashpay/dash/pull/6949) | [5.11.3](https://github.com/bitcoin/bitcoin/pull/24132) | No |
3737

3838
### Networking
3939
| Dependency | Releases | Version used | Minimum required | Runtime |

0 commit comments

Comments
 (0)