Skip to content

fix: add CVE-2026-111487 morph target attribute patch - #6

Merged
lzwind merged 1 commit into
deepin-community:masterfrom
JWWTSL:cve-2026-111487
Oct 20, 2026
Merged

lzwind merged 1 commit into
deepin-community:masterfrom
JWWTSL:cve-2026-111487

Conversation

@JWWTSL

@JWWTSL JWWTSL commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

变更内容

回移 Qt 安全补丁,修复 CVE-2026-111487:

备注

Qt 6.8 不具备上游新增的 tests/auto/render/assimpplugin 测试目录,本次仅回移运行时代码。

验证

  • quilt pop -a / quilt push -a 通过
  • dpkg-buildpackage 打包及安装验证通过

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

Hi @JWWTSL. Thanks for your PR. 😃

@github-actions

Copy link
Copy Markdown

TAG Bot

TAG: 6.8.0+dfsg-0deepin3
EXISTED: no
DISTRIBUTION: unstable

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

Hi @JWWTSL. Thanks for your PR.

I'm waiting for a deepin-community member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@JWWTSL

JWWTSL commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor Author

已按建议完整回移上游测试目标。所有测试文件均取自上游 Gerrit change 777981 当前 revision,非自行编写:

  • tests/auto/render/assimpplugin/CMakeLists.txt
  • tests/auto/render/assimpplugin/tst_assimpplugin.cpp
  • tests/auto/render/assimpplugin/triangle.gltf
  • tests/auto/render/assimpplugin/morph_target.gltf
  • tests/auto/render/assimpplugin/mixed_morph_target_attribs.gltf
  • tests/auto/render/CMakeLists.txt 中按上游条件注册:if(QT_FEATURE_private_tests AND QT_FEATURE_qt3d_assimp)

说明:Qt 6.8 源码树缺少该测试目标,基础文件取自上游同一 revision;测试所需 API 在 6.8 均存在(QEntity::componentsOfType、QSceneImportFactory::create、QMorphTarget::attributeList、QMorphingAnimation::morphTargetList),运行时代码与上游逐字一致。

验证:dpkg-source --before-build / quilt 全量应用通过。本机未安装 Qt3D private dev 头文件,该测试未单独编译。

Compute the morph target buffer layout for each target instead of
reusing the first target's attributes.

按每个变形目标单独计算缓冲区布局,避免属性不一致导致越界。

Log: 修复 assimp 插件混合变形目标属性处理漏洞
Influence: 加载属性不一致的变形目标时不再产生错误缓冲区布局。
@deepin-ci-robot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lzwind
Once this PR has been reviewed and has the lgtm label, please assign goldendeng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@lzwind
lzwind merged commit a20e033 into deepin-community:master Oct 20, 2026
1 of 2 checks passed
@Zeno-sole

Copy link
Copy Markdown

/topic qt6-20261027

@deepin-ci-robot

Copy link
Copy Markdown
Contributor

Add topic: qt6-20261027 successed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants