From 37db6b60febf5ab2ff071d655439b7d121443fb3 Mon Sep 17 00:00:00 2001 From: Than Ngo Date: Wed, 1 May 2024 13:28:16 +0200 Subject: [PATCH] - update to 124.0.6367.118 * High CVE-2024-4331: Use after free in Picture In Picture * High CVE-2024-4368: Use after free in Dawn - use system highway --- chromium-124-wayland-regression.patch | 88 --------------------------- chromium.spec | 18 +++++- sources | 2 +- 3 files changed, 16 insertions(+), 92 deletions(-) delete mode 100644 chromium-124-wayland-regression.patch diff --git a/chromium-124-wayland-regression.patch b/chromium-124-wayland-regression.patch deleted file mode 100644 index 9cebf668..00000000 --- a/chromium-124-wayland-regression.patch +++ /dev/null @@ -1,88 +0,0 @@ -commit c7f4c58f896a651eba80ad805ebdb49d19ebdbd4 -Author: Tom Anderson -Date: Wed Mar 20 00:00:12 2024 +0000 - - Fix --ozone-platform-hint - - This fixes a regression after r1269993 which moved ozone platform - early initialization before the ozone platform hint flag was - processed. This CL ensures the flag processing happens even earlier. - - R=sky - - Change-Id: Icc9649beb0b86753265be2b6cdf3059611eb410f - Bug: None - Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5375669 - Reviewed-by: Scott Violet - Auto-Submit: Thomas Anderson - Commit-Queue: Thomas Anderson - Cr-Commit-Position: refs/heads/main@{#1275306} - -diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc -index 73b6ab0934b14..0b4c44be679d0 100644 ---- a/chrome/app/chrome_main_delegate.cc -+++ b/chrome/app/chrome_main_delegate.cc -@@ -249,6 +249,9 @@ - #include "base/scoped_add_feature_flags.h" - #include "ui/base/ui_base_features.h" - #include "ui/ozone/public/ozone_platform.h" -+#if BUILDFLAG(IS_LINUX) -+#include "chrome/browser/chrome_browser_main_extra_parts_linux.h" -+#endif - #endif // BUILDFLAG(IS_OZONE) - - base::LazyInstance::DestructorAtExit -@@ -959,6 +962,9 @@ std::optional ChromeMainDelegate::PostEarlyInitialization( - // Initialize Ozone platform and add required feature flags as per platform's - // properties. Must be added before feature list is created otherwise the - // added flag won't be picked up. -+#if BUILDFLAG(IS_LINUX) -+ ChromeBrowserMainExtraPartsLinux::InitOzonePlatformHint(); -+#endif - ui::OzonePlatform::PreEarlyInitialization(); - AddFeatureFlagsToCommandLine(); - #endif // BUILDFLAG(IS_OZONE) -diff --git a/chrome/browser/chrome_browser_main_extra_parts_linux.cc b/chrome/browser/chrome_browser_main_extra_parts_linux.cc -index dba7b116ecaa0..ea0487022dcdc 100644 ---- a/chrome/browser/chrome_browser_main_extra_parts_linux.cc -+++ b/chrome/browser/chrome_browser_main_extra_parts_linux.cc -@@ -168,7 +168,13 @@ ChromeBrowserMainExtraPartsLinux::ChromeBrowserMainExtraPartsLinux() = default; - - ChromeBrowserMainExtraPartsLinux::~ChromeBrowserMainExtraPartsLinux() = default; - --void ChromeBrowserMainExtraPartsLinux::PreEarlyInitialization() { -+void ChromeBrowserMainExtraPartsLinux::PostBrowserStart() { -+ RecordDisplayServerProtocolSupport(); -+ ChromeBrowserMainExtraPartsOzone::PostBrowserStart(); -+} -+ -+// static -+void ChromeBrowserMainExtraPartsLinux::InitOzonePlatformHint() { - #if BUILDFLAG(IS_LINUX) - // On the desktop, we fix the platform name if necessary. - // See https://crbug.com/1246928. -@@ -189,8 +195,3 @@ void ChromeBrowserMainExtraPartsLinux::PreEarlyInitialization() { - } - #endif // BUILDFLAG(IS_LINUX) - } -- --void ChromeBrowserMainExtraPartsLinux::PostBrowserStart() { -- RecordDisplayServerProtocolSupport(); -- ChromeBrowserMainExtraPartsOzone::PostBrowserStart(); --} -diff --git a/chrome/browser/chrome_browser_main_extra_parts_linux.h b/chrome/browser/chrome_browser_main_extra_parts_linux.h -index 3847bd2090e28..4f188a7bdfe38 100644 ---- a/chrome/browser/chrome_browser_main_extra_parts_linux.h -+++ b/chrome/browser/chrome_browser_main_extra_parts_linux.h -@@ -17,9 +17,10 @@ class ChromeBrowserMainExtraPartsLinux - const ChromeBrowserMainExtraPartsLinux&) = delete; - ~ChromeBrowserMainExtraPartsLinux() override; - -+ static void InitOzonePlatformHint(); -+ - private: - // ChromeBrowserMainExtraParts overrides. -- void PreEarlyInitialization() override; - void PostBrowserStart() override; - }; - diff --git a/chromium.spec b/chromium.spec index 0f0c065c..27bbb082 100644 --- a/chromium.spec +++ b/chromium.spec @@ -245,6 +245,7 @@ %else %global bundlebrotli 1 %endif +%global bundlehighway 0 %global bundledav1d 0 %global bundleopus 0 %global bundlelibusbx 0 @@ -306,7 +307,7 @@ %endif Name: chromium%{chromium_channel} -Version: 124.0.6367.91 +Version: 124.0.6367.118 Release: 1%{?dist} Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use Url: http://www.chromium.org/Home @@ -564,7 +565,6 @@ Patch415: fix-clang-selection.patch # upstream patches # 64kpage support on el8 Patch500: chromium-124-el8-support-64kpage.patch -Patch501: chromium-124-wayland-regression.patch # Use chromium-latest.py to generate clean tarball from released build tarballs, found here: # http://build.chromium.org/buildbot/official/ @@ -771,6 +771,10 @@ BuildRequires: woff2-devel BuildRequires: libdav1d-devel %endif +%if ! %{bundlehighway} +BuildRequires: highway-devel +%endif + %if ! %{bundlelibavif} BuildRequires: libavif-devel %endif @@ -1322,7 +1326,6 @@ udev. %patch -P500 -p1 -b .el8-support-64kpage.patch %endif %endif -%patch -P501 -p1 -b .wayland-regression # Change shebang in all relevant files in this directory and all subdirectories # See `man find` for how the `-exec command {} +` syntax works @@ -1642,6 +1645,9 @@ system_libs=() %if ! %{bundledav1d} system_libs+=(dav1d) %endif +%if ! %{bundlehighway} + system_libs+=(highway) +%endif %if ! %{bundlefontconfig} system_libs+=(fontconfig) %endif @@ -2120,6 +2126,12 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %endif %changelog +* Wed May 01 2024 Than Ngo - 124.0.6367.118-1 +- update to 124.0.6367.118 + * High CVE-2024-4331: Use after free in Picture In Picture + * High CVE-2024-4368: Use after free in Dawn +- use system highway + * Sat Apr 27 2024 Than Ngo - 124.0.6367.91-1 - update to 124.0.6367.91 - fixed bz#2277228 - chromium wrapper causes library issues (symbol lookup error) diff --git a/sources b/sources index 83c4dfd3..c7ee2f89 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (node-v20.6.1-linux-arm64.tar.xz) = adfcaf2c22614797fd69fb46d94c1cbf64dea SHA512 (node-v20.6.1-linux-x64.tar.xz) = 7e15c05041a9a50f0046266aadb2e092a5aefbec19be1c7c809471add520cb57c7df3c47d88b1888b29bf2979dca3c92adddfd965370fa2a9da4ea02186464fd SHA512 (linux-arm64-0.19.2.tgz) = 8a0d8fec6786fffcd6954d00820037a55d61e60762c74300df0801f8db27057562c221a063bedfb8df56af9ba80abb366336987e881782c5996e6f871abd3dc6 SHA512 (linux-x64-0.19.2.tgz) = a31cc74c4bfa54f9b75d735a1cfc944d3b5efb7c06bfba9542da9a642ae0b2d235ea00ae84d3ad0572c406405110fe7b61377af0fd15803806ef78d20fc6f05d -SHA512 (chromium-124.0.6367.91-clean.tar.xz) = 183a3af2b639e63bec636e9ad9e6d091993cb63bb4369b9804b8a72d8fb946e6efd9288884bd9698426b0f595cc57ff4e9884ff91fba7ec1ed16d9d96eb046d1 +SHA512 (chromium-124.0.6367.118-clean.tar.xz) = 203d0abe379aceee628f8e38b8e57265d984aba260a319bf9c2c718aa71bc211dc7a38ca443d01d3fb5f0867debb4cc49fcda0b9b8e4b12aef68af2cfba90e06