Merge branch '4.8-upstream' into master-water

11 files changed, 79 insertions, 119 deletions

diff --git a/src/corelib/arch/qatomic_integrity.h b/src/corelib/arch/qatomic_integrity.h
index f957297..c72a48d 100644
--- a/src/corelib/arch/qatomic_integrity.h
+++ b/src/corelib/arch/qatomic_integrity.h
@@ -203,7 +203,7 @@ inline int QBasicAtomicInt::fetchAndAddRelease(int valueToAdd)
 template <typename T>
 Q_INLINE_TEMPLATE bool QBasicAtomicPointer<T>::testAndSetOrdered(T *expectedValue, T *newValue)
 {
-    return TestAndSet((Address*)&_q_value, qt_addr(expectedValue), qt_addr(newValue)) == Success;
+    return TestAndSet(reinterpret_cast<Address *>(const_cast<T **>(&_q_value)), qt_addr(expectedValue), qt_addr(newValue)) == Success;
 }
 
 template <typename T>
@@ -231,7 +231,7 @@ Q_INLINE_TEMPLATE T *QBasicAtomicPointer<T>::fetchAndStoreOrdered(T *newValue)
 {
     Address old_val;
     do {
-        old_val = *reinterpret_cast<Address *>(const_cast<T *>(newValue));
+        old_val = *reinterpret_cast<Address *>(const_cast<T *>(_q_value));
     } while (TestAndSet(reinterpret_cast<Address *>(const_cast<T **>(&_q_value)), old_val, qt_addr(newValue)) != Success);
     return reinterpret_cast<T *>(old_val);
 }
@@ -259,7 +259,8 @@ Q_INLINE_TEMPLATE T *QBasicAtomicPointer<T>::fetchAndStoreRelease(T *newValue)
 template <typename T>
 Q_INLINE_TEMPLATE T *QBasicAtomicPointer<T>::fetchAndAddOrdered(qptrdiff valueToAdd)
 {
-    AtomicModify(qt_p2addr(&_q_value), qt_addr(_q_value), qt_addr(_q_value) + valueToAdd * sizeof(T));
+    Address old_value;
+    AtomicModify(reinterpret_cast<volatile Address*>(&_q_value), &old_value, 0, valueToAdd * sizeof(T));
     return _q_value;
 }
 
diff --git a/src/corelib/global/qglobal.h b/src/corelib/global/qglobal.h
index cfe5eea..e8c611b 100644
--- a/src/corelib/global/qglobal.h
+++ b/src/corelib/global/qglobal.h
@@ -1824,7 +1824,7 @@ inline T *q_check_ptr(T *p) { Q_CHECK_PTR(p); return p; }
 #elif defined(_MSC_VER)
 #  define Q_FUNC_INFO __FUNCSIG__
 #else
-#   if defined(Q_OS_SOLARIS) || defined(Q_CC_XLC) || defined(Q_OS_SYMBIAN)
+#   if defined(Q_OS_SOLARIS) || defined(Q_CC_XLC) || defined(Q_OS_SYMBIAN) || defined(Q_OS_INTEGRITY)
 #      define Q_FUNC_INFO __FILE__ "(line number unavailable)"
 #   else
         /* These two macros makes it possible to turn the builtin line expander into a
diff --git a/src/corelib/tools/qlocale_tools.cpp b/src/corelib/tools/qlocale_tools.cpp
index df31bf9..750379c 100644
--- a/src/corelib/tools/qlocale_tools.cpp
+++ b/src/corelib/tools/qlocale_tools.cpp
@@ -2253,6 +2253,13 @@ static int quorem(Bigint *b, Bigint *S)
  *           calculation.
  */
 
+#if defined(Q_OS_WIN) && defined (Q_CC_GNU) && !defined(_clear87) // See QTBUG-7576
+extern "C" {
+__attribute__ ((dllimport)) unsigned int __cdecl __MINGW_NOTHROW _control87 (unsigned int unNew, unsigned int unMask);
+__attribute__ ((dllimport)) unsigned int __cdecl __MINGW_NOTHROW _clearfp (void); /* Clear the FPU status word */
+}
+#  define _clear87 _clearfp
+#endif
 
 /* This actually sometimes returns a pointer to a string literal
    cast to a char*. Do NOT try to modify the return value. */
diff --git a/src/gui/dialogs/qfiledialog.cpp b/src/gui/dialogs/qfiledialog.cpp
index 817cd38..970d111 100644
--- a/src/gui/dialogs/qfiledialog.cpp
+++ b/src/gui/dialogs/qfiledialog.cpp
@@ -869,6 +869,7 @@ Q_AUTOTEST_EXPORT QString qt_tildeExpansion(const QString &path, bool *expanded
     if (!path.startsWith(QLatin1Char('~')))
         return path;
     QString ret = path;
+#if !defined(Q_OS_INTEGRITY)
     QStringList tokens = ret.split(QDir::separator());
     if (tokens.first() == QLatin1String("~")) {
         ret.replace(0, 1, QDir::homePath());
@@ -899,6 +900,7 @@ Q_AUTOTEST_EXPORT QString qt_tildeExpansion(const QString &path, bool *expanded
     }
     if (expanded != 0)
         *expanded = true;
+#endif
     return ret;
 }
 #endif
diff --git a/src/gui/embedded/qscreenintegrityfb_qws.cpp b/src/gui/embedded/qscreenintegrityfb_qws.cpp
index 6f30812..5b1e0d5 100644
--- a/src/gui/embedded/qscreenintegrityfb_qws.cpp
+++ b/src/gui/embedded/qscreenintegrityfb_qws.cpp
@@ -64,7 +64,8 @@ public:
     ~QIntfbScreenPrivate();
 
     FBHandle handle;
-    struct FBInfoStruct fbinfo;
+    FBInfo fbinfo;
+    FBDriver *fbdrv;
 
     QWSMouseHandler *mouse;
 #ifndef QT_NO_QWS_KEYBOARD
@@ -172,15 +173,14 @@ static QIntfbScreen *connected = 0;
 
 bool QIntfbScreen::connect(const QString &displaySpec)
 {
-    FBDriver *fbdev;
-
-    CheckSuccess(gh_FB_get_driver(0, &fbdev));
-    CheckSuccess(gh_FB_init_device(fbdev, 0, &d_ptr->handle));
+    CheckSuccess(gh_FB_get_driver(0, &d_ptr->fbdrv));
+    CheckSuccess(gh_FB_check_info(d_ptr->fbdrv, &d_ptr->fbinfo));
+    CheckSuccess(gh_FB_open(d_ptr->fbdrv, &d_ptr->fbinfo, &d_ptr->handle));
     CheckSuccess(gh_FB_get_info(d_ptr->handle, &d_ptr->fbinfo));
 
-    data = (uchar *)d_ptr->fbinfo.start;
+    data = (uchar *)d_ptr->fbinfo.Start;
 
-    d = d_ptr->fbinfo.bitsperpixel;
+    d = d_ptr->fbinfo.BitsPerPixel;
     switch (d) {
     case 1:
         setPixelFormat(QImage::Format_Mono);
@@ -205,24 +205,24 @@ bool QIntfbScreen::connect(const QString &displaySpec)
 #ifdef QT_QWS_DEPTH_GENERIC
 #if Q_BYTE_ORDER != Q_BIG_ENDIAN
             qt_set_generic_blit(this, 24,
-                    d_ptr->fbinfo.redbits,
-                    d_ptr->fbinfo.greenbits,
-                    d_ptr->fbinfo.bluebits,
-                    d_ptr->fbinfo.alphabits,
-                    d_ptr->fbinfo.redoffset,
-                    d_ptr->fbinfo.greenoffset,
-                    d_ptr->fbinfo.blueoffset,
-                    d_ptr->fbinfo.alphaoffset);
+                    d_ptr->fbinfo.Red.Bits,
+                    d_ptr->fbinfo.Green.Bits,
+                    d_ptr->fbinfo.Blue.Bits,
+                    d_ptr->fbinfo.Alpha.Bits,
+                    d_ptr->fbinfo.Red.Offset,
+                    d_ptr->fbinfo.Green.Offset,
+                    d_ptr->fbinfo.Blue.Offset,
+                    d_ptr->fbinfo.Alpha.Offset);
 #else
             qt_set_generic_blit(this, 24,
-                    d_ptr->fbinfo.redbits,
-                    d_ptr->fbinfo.greenbits,
-                    d_ptr->fbinfo.bluebits,
-                    d_ptr->fbinfo.alphabits,
-                    16 - d_ptr->fbinfo.redoffset,
-                    16 - d_ptr->fbinfo.greenoffset,
-                    16 - d_ptr->fbinfo.blueoffset,
-                    d_ptr->fbinfo.alphaoffset);
+                    d_ptr->fbinfo.Red.Bits,
+                    d_ptr->fbinfo.Green.Bits,
+                    d_ptr->fbinfo.Blue.Bits,
+                    d_ptr->fbinfo.Alpha.Bits,
+                    16 - d_ptr->fbinfo.Red.Offset,
+                    16 - d_ptr->fbinfo.Green.Offset,
+                    16 - d_ptr->fbinfo.Blue.Offset,
+                    16 - d_ptr->fbinfo.Alpha.Offset);
 #endif
 #endif
         break;
@@ -231,31 +231,31 @@ bool QIntfbScreen::connect(const QString &displaySpec)
 #ifdef QT_QWS_DEPTH_GENERIC
 #if Q_BYTE_ORDER != Q_BIG_ENDIAN
             qt_set_generic_blit(this, 32,
-                    d_ptr->fbinfo.redbits,
-                    d_ptr->fbinfo.greenbits,
-                    d_ptr->fbinfo.bluebits,
-                    d_ptr->fbinfo.alphabits,
-                    d_ptr->fbinfo.redoffset,
-                    d_ptr->fbinfo.greenoffset,
-                    d_ptr->fbinfo.blueoffset,
-                    d_ptr->fbinfo.alphaoffset);
+                    d_ptr->fbinfo.Red.Bits,
+                    d_ptr->fbinfo.Green.Bits,
+                    d_ptr->fbinfo.Blue.Bits,
+                    d_ptr->fbinfo.Alpha.Bits,
+                    d_ptr->fbinfo.Red.Offset,
+                    d_ptr->fbinfo.Green.Offset,
+                    d_ptr->fbinfo.Blue.Offset,
+                    d_ptr->fbinfo.Alpha.Offset);
 #else
             qt_set_generic_blit(this, 32,
-                    d_ptr->fbinfo.redbits,
-                    d_ptr->fbinfo.greenbits,
-                    d_ptr->fbinfo.bluebits,
-                    d_ptr->fbinfo.alphabits,
-                    24 - d_ptr->fbinfo.redoffset,
-                    24 - d_ptr->fbinfo.greenoffset,
-                    24 - d_ptr->fbinfo.blueoffset,
-                    d_ptr->fbinfo.alphaoffset ? 24 - d_ptr->fbinfo.alphaoffset : 0);
+                    d_ptr->fbinfo.Red.Bits,
+                    d_ptr->fbinfo.Green.Bits,
+                    d_ptr->fbinfo.Blue.Bits,
+                    d_ptr->fbinfo.Alpha.Bits,
+                    24 - d_ptr->fbinfo.Red.Offset,
+                    24 - d_ptr->fbinfo.Green.Offset,
+                    24 - d_ptr->fbinfo.Blue.Offset,
+                    24 - d_ptr->fbinfo.Alpha.Offset);
 #endif
 #endif
         break;
     }
 
-    dw = w = d_ptr->fbinfo.width;
-    dh = h = d_ptr->fbinfo.height;
+    dw = w = d_ptr->fbinfo.Width;
+    dh = h = d_ptr->fbinfo.Height;
 
     /* assumes no padding */
     lstep = w * ((d + 7) >> 3);
@@ -286,72 +286,6 @@ void QIntfbScreen::disconnect()
 
 bool QIntfbScreen::initDevice()
 {
-
-    CheckSuccess(gh_FB_set_info(d_ptr->handle, &d_ptr->fbinfo, false));
-    CheckSuccess(gh_FB_get_info(d_ptr->handle, &d_ptr->fbinfo));
-    data = (uchar *)d_ptr->fbinfo.start;
-    d = d_ptr->fbinfo.bitsperpixel;
-    dw = w = d_ptr->fbinfo.width;
-    dh = h = d_ptr->fbinfo.height;
-    mapsize = d_ptr->fbinfo.length;
-    /* assumes no padding */
-    lstep = w * ((d + 7) >> 3);
-
-    mapsize = size =  h * lstep;
-
-    data = (uchar *)d_ptr->fbinfo.start;
-
-    d = d_ptr->fbinfo.bitsperpixel;
-    switch (d) {
-    case 1:
-        setPixelFormat(QImage::Format_Mono);
-        break;
-    case 8:
-        setPixelFormat(QImage::Format_Indexed8);
-        break;
-    case 12:
-        setPixelFormat(QImage::Format_RGB444);
-        break;
-    case 15:
-        setPixelFormat(QImage::Format_RGB555);
-        break;
-    case 16:
-        setPixelFormat(QImage::Format_RGB16);
-        break;
-    case 18:
-        setPixelFormat(QImage::Format_RGB666);
-        break;
-    case 24:
-        setPixelFormat(QImage::Format_RGB888);
-        break;
-    case 32:
-        setPixelFormat(QImage::Format_ARGB32_Premultiplied);
-        break;
-    }
-#ifdef QT_QWS_DEPTH_GENERIC
-#if defined(__BIG_ENDIAN__)
-       qt_set_generic_blit(this, d,
-               d_ptr->fbinfo.redbits,
-               d_ptr->fbinfo.greenbits,
-               d_ptr->fbinfo.bluebits,
-               d_ptr->fbinfo.alphabits,
-               24 - d_ptr->fbinfo.redoffset,
-               24 - d_ptr->fbinfo.greenoffset,
-               24 - d_ptr->fbinfo.blueoffset,
-               d_ptr->fbinfo.alphaoffset ? 24 - d_ptr->fbinfo.alphaoffset : 0);
-#else
-       qt_set_generic_blit(this, d,
-               d_ptr->fbinfo.redbits,
-               d_ptr->fbinfo.greenbits,
-               d_ptr->fbinfo.bluebits,
-               d_ptr->fbinfo.alphabits,
-               d_ptr->fbinfo.redoffset,
-               d_ptr->fbinfo.greenoffset,
-               d_ptr->fbinfo.blueoffset,
-               d_ptr->fbinfo.alphaoffset);
-#endif
-#endif
-
 #ifndef QT_NO_QWS_CURSOR
     QScreenCursor::initSoftwareCursor();
 #endif
@@ -384,9 +318,9 @@ void QIntfbScreen::setDirty(const QRect& rect)
     FBRect fbrect;
     fbrect.dx = rect.x();
     fbrect.dy = rect.y();
-    fbrect.width = rect.width();
-    fbrect.height = rect.height();
-    gh_FB_expose(d_ptr->handle, &fbrect);
+    fbrect.Width = rect.width();
+    fbrect.Height = rect.height();
+    gh_FB_expose(d_ptr->handle, &fbrect, 0);
 }
 
 void QIntfbScreen::setBrightness(int b)
diff --git a/src/network/ssl/qssl.cpp b/src/network/ssl/qssl.cpp
index b556328..01297c9 100644
--- a/src/network/ssl/qssl.cpp
+++ b/src/network/ssl/qssl.cpp
@@ -141,9 +141,15 @@ QT_BEGIN_NAMESPACE
     \value SslOptionDisableServerNameIndication Disables the SSL server
     name indication extension. When enabled, this tells the server the virtual
     host being accessed allowing it to respond with the correct certificate.
+    \value SslOptionDisableLegacyRenegotiation Disables the older insecure
+    mechanism for renegotiating the connection parameters. When enabled, this
+    option can allow connections for legacy servers, but it introduces the
+    possibility that an attacker could inject plaintext into the SSL session.
 
     By default, SslOptionDisableEmptyFragments is turned on since this causes
-    problems with a large number of servers, but the other options are disabled.
+    problems with a large number of servers. SslOptionDisableLegacyRenegotiation
+    is also turned on, since it introduces a security risk. The other options
+    are turned off.
 
     Note: Availability of above options depends on the version of the SSL
     backend in use.
diff --git a/src/network/ssl/qssl.h b/src/network/ssl/qssl.h
index 453d4da..571aa1f 100644
--- a/src/network/ssl/qssl.h
+++ b/src/network/ssl/qssl.h
@@ -87,7 +87,8 @@ namespace QSsl {
         SslOptionDisableEmptyFragments = 0x01,
         SslOptionDisableSessionTickets = 0x02,
         SslOptionDisableCompression = 0x04,
-        SslOptionDisableServerNameIndication = 0x08
+        SslOptionDisableServerNameIndication = 0x08,
+        SslOptionDisableLegacyRenegotiation = 0x10
     };
     Q_DECLARE_FLAGS(SslOptions, SslOption)
 }
diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp
index e24076e..727130b 100644
--- a/src/network/ssl/qsslconfiguration.cpp
+++ b/src/network/ssl/qsslconfiguration.cpp
@@ -201,7 +201,7 @@ bool QSslConfiguration::isNull() const
             d->privateKey.isNull() &&
             d->peerCertificate.isNull() &&
             d->peerCertificateChain.count() == 0 &&
-            d->sslOptions == 0);
+            d->sslOptions == QSsl::SslOptionDisableEmptyFragments|QSsl::SslOptionDisableLegacyRenegotiation);
 }
 
 /*!
diff --git a/src/network/ssl/qsslconfiguration_p.h b/src/network/ssl/qsslconfiguration_p.h
index b83edb9..a711eeb 100644
--- a/src/network/ssl/qsslconfiguration_p.h
+++ b/src/network/ssl/qsslconfiguration_p.h
@@ -82,7 +82,8 @@ public:
     QSslConfigurationPrivate()
         : protocol(QSsl::SecureProtocols),
           peerVerifyMode(QSslSocket::AutoVerifyPeer),
-          peerVerifyDepth(0)
+          peerVerifyDepth(0),
+          sslOptions(QSsl::SslOptionDisableEmptyFragments|QSsl::SslOptionDisableLegacyRenegotiation)
     { }
 
     QSslCertificate peerCertificate;
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
index 3942209..5f520f7 100644
--- a/src/network/ssl/qsslsocket_openssl.cpp
+++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -298,6 +298,14 @@ init_context:
     else
         options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
 
+#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
+    // This option is disabled by default, so we need to be able to clear it
+    if (configuration.sslOptions & QSsl::SslOptionDisableLegacyRenegotiation)
+        options &= ~SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
+    else
+        options |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
+#endif
+
 #ifdef SSL_OP_NO_TICKET
     if (configuration.sslOptions & QSsl::SslOptionDisableSessionTickets)
         options |= SSL_OP_NO_TICKET;
diff --git a/src/src.pro b/src/src.pro
index 9314fbd..c51683b 100644
--- a/src/src.pro
+++ b/src/src.pro
@@ -8,7 +8,7 @@ SRC_SUBDIRS += src_corelib src_xml src_network src_sql src_testlib
 nacl: SRC_SUBDIRS -= src_network src_testlib
 !symbian:contains(QT_CONFIG, dbus):SRC_SUBDIRS += src_dbus
 !contains(QT_CONFIG, no-gui): SRC_SUBDIRS += src_gui
-!wince*:!symbian:!vxworks:contains(QT_CONFIG, qt3support): SRC_SUBDIRS += src_qt3support
+!wince*:!symbian:!vxworks:!integrity:contains(QT_CONFIG, qt3support): SRC_SUBDIRS += src_qt3support
 
 !wince*:!symbian-abld:!symbian-sbsv2:include(tools/tools.pro)
 win32:!win32-g++*:SRC_SUBDIRS += src_activeqt