Fix security issue CVE-2016-10040

[taken from RedHat Qt3 patches]

Signed-off-by: Slávek Banko <slavek.banko@axis.cz>
(cherry picked from commit 54809cd81b)

configure

@@ -2810,7 +2810,7 @@ case "$COMPILER" in
 g++*)
     # GNU C++
     QMAKE_CONF_COMPILER=`grep "QMAKE_CXX[^_A-Z0-9a-z]" $QMAKESPEC/qmake.conf | sed "s,.* *= *\(.*\)$,\1,"`
-    COMPILER_VERSION=`${QMAKE_CONF_COMPILER} --version 2>/dev/null | sed 's,^[^0-9]*,,g'`
+    COMPILER_VERSION=`${QMAKE_CONF_COMPILER} -dumpversion 2>/dev/null | sed 's,^[^0-9]*,,g'`
     case "$COMPILER_VERSION" in
     2.95.*)
 	COMPILER_VERSION="2.95.*"
@@ -2818,7 +2818,7 @@ g++*)
     3.*)
 	COMPILER_VERSION="3.*"
 	;;
-    4.*)
+    [7-8]|[4-6].*)
 	COMPILER_VERSION="4.*"
 	;;
     *)
@@ -2826,6 +2826,17 @@ g++*)
     esac
     [ ! -z "$COMPILER_VERSION" ] && COMPILER="g++-${COMPILER_VERSION}"
     ;;
+clang)
+    # Clang
+    QMAKE_CONF_COMPILER=`grep "QMAKE_CXX[^_A-Z0-9a-z]" $QMAKESPEC/qmake.conf | sed "s,.* *= *\(.*\)$,\1,"`
+    COMPILER_VERSION=`${QMAKE_CONF_COMPILER} -dumpversion 2>/dev/null | sed 's,^[^0-9]*,,g'`
+    case "$COMPILER_VERSION" in
+    *)
+	# Consider clang as compatible with g++-4.x and therefore the same build-key is used
+	COMPILER="g++-4.*"
+	;;
+    esac
+    ;;
 *)
     #
     ;;

doc/html/qiconview-h.html

@@ -528,12 +528,7 @@ private:
 	DirLeft,
 	DirRight
     };
-    QIconViewItem* findItem( Direction dir,
+    QIconViewItem* findItem(Direction dir, const QIconViewItem *fromItem) const;
-			     const QPoint &relativeTo,
-			     const QRect &searchRect ) const;
-    bool neighbourItem( Direction dir,
-			const QPoint &relativeTo,
-			const QIconViewItem *item ) const;
     QBitmap mask( QPixmap *pix ) const;
 
     QIconViewPrivate *d;

doc/html/qnamespace-h.html

@@ -652,6 +652,11 @@ public:
 	Key_LaunchD  = 0x10af,
 	Key_LaunchE  = 0x10b0,
 	Key_LaunchF  = 0x10b1,
+	Key_MonBrightnessUp        = 0x010b2,
+	Key_MonBrightnessDown      = 0x010b3,
+	Key_KeyboardLightOnOff     = 0x010b4,
+	Key_KeyboardBrightnessUp   = 0x010b5,
+	Key_KeyboardBrightnessDown = 0x010b6,
 
 	Key_MediaLast = 0x1fff,
 

mkspecs/freebsd-clang/qmake.conf

@@ -0,0 +1,81 @@
+#
+#
+# qmake configuration for freebsd-clang
+#
+
+MAKEFILE_GENERATOR	= UNIX
+TEMPLATE		= app
+CONFIG			+= qt warn_on release thread link_prl
+
+QMAKE_CC		= clang
+QMAKE_LEX		= flex
+QMAKE_LEXFLAGS		=
+QMAKE_YACC		= yacc
+QMAKE_YACCFLAGS		= -d
+QMAKE_CFLAGS		= -pipe
+QMAKE_CFLAGS_DEPS	= -M
+QMAKE_CFLAGS_WARN_ON	= -Wall -W
+QMAKE_CFLAGS_WARN_OFF	= -w
+QMAKE_CFLAGS_RELEASE	= -O2
+QMAKE_CFLAGS_DEBUG	= -g
+QMAKE_CFLAGS_SHLIB	= -fPIC
+QMAKE_CFLAGS_YACC	= -Wno-unused -Wno-parentheses
+QMAKE_CFLAGS_THREAD	= -pthread -D_THREAD_SAFE
+
+QMAKE_CXX		= clang++
+QMAKE_CXXFLAGS		= $$QMAKE_CFLAGS
+QMAKE_CXXFLAGS_DEPS	= $$QMAKE_CFLAGS_DEPS
+QMAKE_CXXFLAGS_WARN_ON	= $$QMAKE_CFLAGS_WARN_ON
+QMAKE_CXXFLAGS_WARN_OFF	= $$QMAKE_CFLAGS_WARN_OFF
+QMAKE_CXXFLAGS_RELEASE	= $$QMAKE_CFLAGS_RELEASE
+QMAKE_CXXFLAGS_DEBUG	= $$QMAKE_CFLAGS_DEBUG
+QMAKE_CXXFLAGS_SHLIB	= $$QMAKE_CFLAGS_SHLIB
+QMAKE_CXXFLAGS_YACC	= $$QMAKE_CFLAGS_YACC
+QMAKE_CXXFLAGS_THREAD	= $$QMAKE_CFLAGS_THREAD
+
+# Addon software goes into /usr/local on the BSDs, by default we will look there
+QMAKE_INCDIR		= /usr/local/include
+QMAKE_LIBDIR		= /usr/local/lib
+QMAKE_INCDIR_X11	= /usr/X11R6/include
+QMAKE_LIBDIR_X11	= /usr/X11R6/lib
+QMAKE_INCDIR_QT		= $(QTDIR)/include
+QMAKE_LIBDIR_QT		= $(QTDIR)/lib
+QMAKE_INCDIR_OPENGL	= /usr/X11R6/include
+QMAKE_LIBDIR_OPENGL	= /usr/X11R6/lib
+
+QMAKE_LINK		= clang++
+QMAKE_LINK_SHLIB	= clang++
+QMAKE_LFLAGS		=
+QMAKE_LFLAGS_RELEASE	=
+QMAKE_LFLAGS_DEBUG	=
+QMAKE_LFLAGS_SHLIB	= -shared
+QMAKE_LFLAGS_PLUGIN	= $$QMAKE_LFLAGS_SHLIB
+QMAKE_LFLAGS_SONAME	= -Wl,-soname,
+QMAKE_LFLAGS_THREAD	= -pthread
+QMAKE_RPATH		= -Wl,-rpath,
+
+QMAKE_LIBS		=
+QMAKE_LIBS_DYNLOAD	=
+QMAKE_LIBS_X11		= -lXext -lX11 -lm
+QMAKE_LIBS_X11SM	= -lSM -lICE
+QMAKE_LIBS_QT		= -lqt
+QMAKE_LIBS_QT_THREAD	= -lqt-mt
+QMAKE_LIBS_OPENGL	= -lGLU -lGL -lXmu
+QMAKE_LIBS_OPENGL_QT	= -lGL -lXmu
+QMAKE_LIBS_THREAD	=
+
+QMAKE_MOC		= $(QTDIR)/bin/moc
+QMAKE_UIC		= $(QTDIR)/bin/uic
+
+QMAKE_AR		= ar cqs
+QMAKE_RANLIB		=
+
+QMAKE_TAR		= tar -cf
+QMAKE_GZIP		= gzip -9f
+
+QMAKE_COPY		= cp -f
+QMAKE_MOVE		= mv -f
+QMAKE_DEL_FILE		= rm -f
+QMAKE_DEL_DIR		= rmdir
+QMAKE_CHK_DIR_EXISTS	= test -d
+QMAKE_MKDIR		= mkdir -p

mkspecs/freebsd-clang/qplatformdefs.h

@@ -0,0 +1,103 @@
+#ifndef QPLATFORMDEFS_H
+#define QPLATFORMDEFS_H
+
+// Get Qt defines/settings
+
+#include "qglobal.h"
+
+// Set any POSIX/XOPEN defines at the top of this file to turn on specific APIs
+
+#include <unistd.h>
+
+
+// We are hot - unistd.h should have turned on the specific APIs we requested
+
+
+#ifdef QT_THREAD_SUPPORT
+#include <pthread.h>
+#endif
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <pwd.h>
+#include <signal.h>
+#include <dlfcn.h>
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/ipc.h>
+#include <sys/time.h>
+#include <sys/shm.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+// DNS header files are not fully covered by X/Open specifications.
+// In particular nothing is said about res_* :/
+// On BSDs header files <netinet/in.h> and <arpa/nameser.h> are not
+// included by <resolv.h>. Note that <arpa/nameser.h> must be included
+// before <resolv.h>.
+#include <netinet/in.h>
+#define class c_class // FreeeBSD 3.x
+#include <arpa/nameser.h>
+#undef class
+#include <resolv.h>
+
+
+#if !defined(QT_NO_COMPAT)
+#define QT_STATBUF		struct stat
+#define QT_STATBUF4TSTAT	struct stat
+#define QT_STAT			::stat
+#define QT_FSTAT		::fstat
+#define QT_STAT_REG		S_IFREG
+#define QT_STAT_DIR		S_IFDIR
+#define QT_STAT_MASK		S_IFMT
+#define QT_STAT_LNK		S_IFLNK
+#define QT_FILENO		fileno
+#define QT_OPEN			::open
+#define QT_CLOSE		::close
+#define QT_LSEEK		::lseek
+#define QT_READ			::read
+#define QT_WRITE		::write
+#define QT_ACCESS		::access
+#define QT_GETCWD		::getcwd
+#define QT_CHDIR		::chdir
+#define QT_MKDIR		::mkdir
+#define QT_RMDIR		::rmdir
+#define QT_OPEN_RDONLY		O_RDONLY
+#define QT_OPEN_WRONLY		O_WRONLY
+#define QT_OPEN_RDWR		O_RDWR
+#define QT_OPEN_CREAT		O_CREAT
+#define QT_OPEN_TRUNC		O_TRUNC
+#define QT_OPEN_APPEND		O_APPEND
+#endif
+
+#define QT_SIGNAL_RETTYPE	void
+#define QT_SIGNAL_ARGS		int
+#define QT_SIGNAL_IGNORE	SIG_IGN
+
+#if !defined(__DragonFly__) && __FreeBSD_version < 400000
+// FreeBSD 1.0 - 3.5.1
+#  define QT_SOCKLEN_T		int
+#else
+// FreeBSD 4.0 - 5.0
+#  define QT_SOCKLEN_T		socklen_t
+#endif
+
+#define QT_SNPRINTF		::snprintf
+#define QT_VSNPRINTF		::vsnprintf
+
+// Older FreeBSD versions may still use the a.out format instead of ELF.
+// From the FreeBSD man pages:
+// 	In previous implementations, it was necessary to prepend an
+// 	underscore to all external symbols in order to gain symbol
+// 	compatibility with object code compiled from the C language.
+// 	This is still the case when using the (obsolete) -aout option to
+// 	the C language compiler.
+#ifndef __ELF__
+#define QT_AOUT_UNDERSCORE
+#endif
+
+
+#endif // QPLATFORMDEFS_H

mkspecs/linux-clang/qmake.conf

@@ -0,0 +1,89 @@
+#
+#
+# qmake configuration for linux-clang
+#
+
+MAKEFILE_GENERATOR	= UNIX
+TEMPLATE		= app
+CONFIG			+= qt warn_on release incremental link_prl thread
+QMAKE_INCREMENTAL_STYLE = sublib
+
+QMAKE_CC		= clang
+QMAKE_LEX		= flex
+QMAKE_LEXFLAGS		=
+QMAKE_YACC		= yacc
+QMAKE_YACCFLAGS		= -d
+QMAKE_YACCFLAGS_MANGLE  = -p $base -b $base
+QMAKE_YACC_HEADER       = $base.tab.h
+QMAKE_YACC_SOURCE       = $base.tab.c
+QMAKE_CFLAGS		= -pipe -g -fvisibility=hidden -fvisibility-inlines-hidden
+QMAKE_CFLAGS_DEPS	= -M
+QMAKE_CFLAGS_WARN_ON	= -Wall -W
+QMAKE_CFLAGS_WARN_OFF	= -w
+QMAKE_CFLAGS_RELEASE	= -O2
+QMAKE_CFLAGS_DEBUG	= -O0
+QMAKE_CFLAGS_SHLIB	= -fPIC
+QMAKE_CFLAGS_YACC	= -Wno-unused -Wno-parentheses
+QMAKE_CFLAGS_THREAD	= -D_REENTRANT
+
+QMAKE_CXX		= clang++
+QMAKE_CXXFLAGS		= $$QMAKE_CFLAGS
+QMAKE_CXXFLAGS_DEPS	= $$QMAKE_CFLAGS_DEPS
+QMAKE_CXXFLAGS_WARN_ON	= $$QMAKE_CFLAGS_WARN_ON
+QMAKE_CXXFLAGS_WARN_OFF	= $$QMAKE_CFLAGS_WARN_OFF
+QMAKE_CXXFLAGS_RELEASE	= $$QMAKE_CFLAGS_RELEASE
+QMAKE_CXXFLAGS_DEBUG	= $$QMAKE_CFLAGS_DEBUG
+QMAKE_CXXFLAGS_SHLIB	= $$QMAKE_CFLAGS_SHLIB
+QMAKE_CXXFLAGS_YACC	= $$QMAKE_CFLAGS_YACC
+QMAKE_CXXFLAGS_THREAD	= $$QMAKE_CFLAGS_THREAD
+
+QMAKE_INCDIR		=
+QMAKE_LIBDIR		=
+QMAKE_INCDIR_X11	= /usr/X11R6/include
+QMAKE_LIBDIR_X11	= /usr/X11R6/lib
+QMAKE_INCDIR_QT		= $(QTDIR)/include
+QMAKE_LIBDIR_QT		= $(QTDIR)/lib
+QMAKE_INCDIR_OPENGL	= /usr/X11R6/include
+QMAKE_LIBDIR_OPENGL	= /usr/X11R6/lib
+
+QMAKE_LINK		= clang++
+QMAKE_LINK_SHLIB	= clang++
+QMAKE_LFLAGS		= -luuid
+QMAKE_LFLAGS_RELEASE	=
+QMAKE_LFLAGS_DEBUG	=
+QMAKE_LFLAGS_SHLIB	= -shared
+QMAKE_LFLAGS_PLUGIN	= $$QMAKE_LFLAGS_SHLIB
+QMAKE_LFLAGS_SONAME	= -Wl,-soname,
+QMAKE_LFLAGS_THREAD	=
+QMAKE_RPATH		= -Wl,-rpath,
+
+QMAKE_LIBS		= -luuid
+QMAKE_LIBS_DYNLOAD	= -ldl
+QMAKE_LIBS_X11		= -lXext -lX11 -lm
+QMAKE_LIBS_X11SM	= -lSM -lICE
+QMAKE_LIBS_NIS		= -lnsl
+QMAKE_LIBS_QT		= -lqt
+QMAKE_LIBS_QT_THREAD	= -lqt-mt
+QMAKE_LIBS_OPENGL	= -lGLU -lGL -lXmu
+QMAKE_LIBS_OPENGL_QT	= -lGL -lXmu
+QMAKE_LIBS_THREAD	= -lpthread
+
+QMAKE_MOC		= $(QTDIR)/bin/moc
+QMAKE_UIC		= $(QTDIR)/bin/uic
+
+QMAKE_AR		= ar cqs
+QMAKE_RANLIB		=
+
+QMAKE_TAR		= tar -cf
+QMAKE_GZIP		= gzip -9f
+
+QMAKE_COPY		= cp -f
+QMAKE_COPY_FILE         = $(COPY)
+QMAKE_COPY_DIR          = $(COPY) -r
+QMAKE_MOVE		= mv -f
+QMAKE_DEL_FILE		= rm -f
+QMAKE_DEL_DIR		= rmdir
+QMAKE_STRIP             =
+QMAKE_STRIPFLAGS_LIB 	+= --strip-unneeded
+QMAKE_CHK_DIR_EXISTS	= test -d
+QMAKE_MKDIR		= mkdir -p

mkspecs/linux-clang/qplatformdefs.h

@@ -0,0 +1,107 @@
+#ifndef QPLATFORMDEFS_H
+#define QPLATFORMDEFS_H
+
+// Get Qt defines/settings
+
+#include "qglobal.h"
+
+// Set any POSIX/XOPEN defines at the top of this file to turn on specific APIs
+
+// DNS system header files are a mess!
+// <resolv.h> includes <arpa/nameser.h>. <arpa/nameser.h> is using
+// 'u_char' and includes <sys/types.h>.  Now the problem is that
+// <sys/types.h> defines 'u_char' only if __USE_BSD is defined.
+// __USE_BSD is defined in <features.h> if _BSD_SOURCE is defined.
+#ifndef _BSD_SOURCE
+#  define _BSD_SOURCE
+#endif
+
+// 1) need to reset default environment if _BSD_SOURCE is defined
+// 2) need to specify POSIX thread interfaces explicitly in glibc 2.0
+// 3) it seems older glibc need this to include the X/Open stuff
+#ifndef _GNU_SOURCE
+#  define _GNU_SOURCE
+#endif
+
+#include <unistd.h>
+
+
+// We are hot - unistd.h should have turned on the specific APIs we requested
+
+
+#ifdef QT_THREAD_SUPPORT
+#include <pthread.h>
+#endif
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <pwd.h>
+#include <signal.h>
+#include <dlfcn.h>
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/ipc.h>
+#include <sys/time.h>
+#include <sys/shm.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+// DNS header files are not fully covered by X/Open specifications.
+// In particular nothing is said about res_* :/
+// Header files <netinet/in.h> and <arpa/nameser.h> are not included
+// by <resolv.h> on older versions of the GNU C library. Note that
+// <arpa/nameser.h> must be included before <resolv.h>.
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+
+#if !defined(QT_NO_COMPAT)
+#define QT_STATBUF		struct stat
+#define QT_STATBUF4TSTAT	struct stat
+#define QT_STAT			::stat
+#define QT_FSTAT		::fstat
+#define QT_STAT_REG		S_IFREG
+#define QT_STAT_DIR		S_IFDIR
+#define QT_STAT_MASK		S_IFMT
+#define QT_STAT_LNK		S_IFLNK
+#define QT_FILENO		fileno
+#define QT_OPEN			::open
+#define QT_CLOSE		::close
+#define QT_LSEEK		::lseek
+#define QT_READ			::read
+#define QT_WRITE		::write
+#define QT_ACCESS		::access
+#define QT_GETCWD		::getcwd
+#define QT_CHDIR		::chdir
+#define QT_MKDIR		::mkdir
+#define QT_RMDIR		::rmdir
+#define QT_OPEN_RDONLY		O_RDONLY
+#define QT_OPEN_WRONLY		O_WRONLY
+#define QT_OPEN_RDWR		O_RDWR
+#define QT_OPEN_CREAT		O_CREAT
+#define QT_OPEN_TRUNC		O_TRUNC
+#define QT_OPEN_APPEND		O_APPEND
+#endif
+
+#define QT_SIGNAL_RETTYPE	void
+#define QT_SIGNAL_ARGS		int
+#define QT_SIGNAL_IGNORE	SIG_IGN
+
+#if defined(__GLIBC__) && (__GLIBC__ >= 2)
+#define QT_SOCKLEN_T		socklen_t
+#else
+#define QT_SOCKLEN_T		int
+#endif
+
+#if defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 500)
+#define QT_SNPRINTF		::snprintf
+#define QT_VSNPRINTF		::vsnprintf
+#endif
+
+#define QT_MITSHM
+
+#endif // QPLATFORMDEFS_H

src/iconview/qiconview.cpp

@@ -287,74 +287,8 @@ public:
     struct SortableItem {
 	QIconViewItem *item;
     };
-
-public:
-
-    /* finds the containers that intersect with \a searchRect in the direction \a dir relative to \a relativeTo */
-    QPtrList<ItemContainer>* findContainers(
-	QIconView:: Direction dir,
-	const QPoint &relativeTo,
-	const QRect &searchRect ) const;
-    //    friend int cmpIconViewItems( const void *n1, const void *n2 );
 };
 
-
-QPtrList<QIconViewPrivate::ItemContainer>* QIconViewPrivate::findContainers(
-	QIconView:: Direction dir,
-	const QPoint &relativeTo,
-	const QRect &searchRect ) const
-{
-
-    QPtrList<QIconViewPrivate::ItemContainer>* list =
-	new QPtrList<QIconViewPrivate::ItemContainer>();
-
-    if ( arrangement == QIconView::LeftToRight ) {
-	if ( dir == QIconView::DirLeft || dir == QIconView::DirRight ) {
-	    ItemContainer *c = firstContainer;
-	    for ( ; c; c = c->n )
-		if ( c->rect.intersects( searchRect ) )
-		    list->append( c );
-	} else {
-	    if ( dir == QIconView::DirDown ) {
-		ItemContainer *c = firstContainer;
-		for ( ; c; c = c->n )
-		    if ( c->rect.intersects( searchRect ) &&
-			 c->rect.bottom() >= relativeTo.y() )
-			list->append( c );
-	    } else {
-		ItemContainer *c = lastContainer;
-		for ( ; c; c = c->p )
-		    if ( c->rect.intersects( searchRect ) &&
-			 c->rect.top() <= relativeTo.y() )
-			list->append( c );
-	    }
-	}
-    } else {
-	if ( dir == QIconView::DirUp || dir == QIconView::DirDown ) {
-	    ItemContainer *c = firstContainer;
-	    for ( ; c; c = c->n )
-		if ( c->rect.intersects( searchRect ) )
-		    list->append( c );
-	} else {
-	    if ( dir == QIconView::DirRight ) {
-		ItemContainer *c = firstContainer;
-		for ( ; c; c = c->n )
-		    if ( c->rect.intersects( searchRect ) &&
-			 c->rect.right() >= relativeTo.x() )
-			list->append( c );
-	    } else {
-		ItemContainer *c = lastContainer;
-		for ( ; c; c = c->p )
-		    if ( c->rect.intersects( searchRect ) &&
-			 c->rect.left() <= relativeTo.x() )
-			list->append( c );
-	    }
-	}
-    }
-    return list;
-}
-
-
 #if defined(Q_C_CALLBACKS)
 extern "C" {
 #endif
@@ -2347,14 +2281,15 @@ void QIconViewItem::checkRect()
 
     When an item is inserted the QIconView allocates a position for it.
     Existing items are rearranged if autoArrange() is TRUE. The
-    default arrangement is \c LeftToRight -- the QIconView fills up
+    default arrangement is \c LeftToRight -- the QIconView fills
-    the \e left-most column from top to bottom, then moves one column
+    the \e top-most row from left to right, then moves one row \e down
-    \e right and fills that from top to bottom and so on. The
+    and fills that row from left to right and so on. The
     arrangement can be modified with any of the following approaches:
     \list
-    \i Call setArrangement(), e.g. with \c TopToBottom which will fill
+    \i Call setArrangement(), e.g. with \c TopToBottom which will fill up
-    the \e top-most row from left to right, then moves one row \e down
+    the \e left-most column from top to bottom, then moves one column
-    and fills that row from left to right and so on.
+    \e right and fills that from top to bottom and so on.
+    
     \i Construct each QIconViewItem using a constructor which allows
     you to specify which item the new one is to follow.
     \i Call setSorting() or sort() to sort the items.
@@ -3937,11 +3872,11 @@ void QIconView::selectAll( bool select )
 	        rr = rr.unite( item->rect() );
 	        changed = TRUE;
 	    }
-	    else {
+	}
-	        if ( FALSE != item->isSelected() ) {
+	else {
-	            item->setSelected( FALSE, TRUE );
+	    if ( FALSE != item->isSelected() ) {
-	            changed = TRUE;
+	        item->setSelected( FALSE, TRUE );
-	        }
+	        changed = TRUE;
 	    }
 	}
     }
@@ -3971,8 +3906,16 @@ void QIconView::invertSelection()
     bool b = signalsBlocked();
     blockSignals( TRUE );
     QIconViewItem *item = d->firstItem;
-    for ( ; item; item = item->next )
+    for ( ; item; item = item->next ) {
-	item->setSelected( !item->isSelected(), TRUE );
+        if (item->isVisible()) {
+            item->setSelected( !item->isSelected(), TRUE );
+        }
+        else {
+            if ( FALSE != item->isSelected() ) {
+                item->setSelected( FALSE, TRUE );
+            }
+        }
+    }
     blockSignals( b );
     emit selectionChanged();
 }
@@ -5105,6 +5048,7 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 	}
     } break;
 #endif
+
     case Key_Home: {
 	d->currInputString = QString::null;
 	if ( !d->firstItem )
@@ -5149,6 +5093,7 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 			      e->state() & ControlButton, TRUE );
 	}
     } break;
+    
     case Key_End: {
 	d->currInputString = QString::null;
 	if ( !d->lastItem )
@@ -5192,50 +5137,7 @@ void QIconView::keyPressEvent( QKeyEvent *e )
  			      e->state() & ControlButton, TRUE );
 	}
     } break;
-    case Key_Right: {
+    
-	d->currInputString = QString::null;
-	QIconViewItem *item;
-	selectCurrent = FALSE;
-	Direction dir = DirRight;
-
-	QRect r( 0, d->currentItem->y(), contentsWidth(), d->currentItem->height() );
-	item = findItem( dir, d->currentItem->rect().center(), r );
-
-	// search the row below from the right
-	while ( !item && r.y() < contentsHeight() ) {
-	    r.moveBy(0, d->currentItem->height() );
-	    item = findItem( dir, QPoint( 0, r.center().y() ), r );
-	}
-
-	if ( item ) {
-	    QIconViewItem *old = d->currentItem;
-	    setCurrentItem( item );
-	    ensureItemVisible( item );
-	    handleItemChange( old, e->state() & ShiftButton, e->state() & ControlButton );
-	}
-    } break;
-    case Key_Left: {
-	d->currInputString = QString::null;
-	QIconViewItem *item;
-	selectCurrent = FALSE;
-	Direction dir = DirLeft;
-
-	QRect r( 0, d->currentItem->y(), contentsWidth(), d->currentItem->height() );
-	item = findItem( dir, d->currentItem->rect().center(), r );
-
-	// search the row above from the left
-	while ( !item && r.y() >= 0 ) {
-	    r.moveBy(0, - d->currentItem->height() );
-	    item = findItem( dir, QPoint( contentsWidth(), r.center().y() ), r );
-	}
-
-	if ( item ) {
-	    QIconViewItem *old = d->currentItem;
-	    setCurrentItem( item );
-	    ensureItemVisible( item );
-	    handleItemChange( old, e->state() & ShiftButton, e->state() & ControlButton );
-	}
-    } break;
     case Key_Space: {
 	d->currInputString = QString::null;
 	if ( d->selectionMode == Single)
@@ -5243,51 +5145,65 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 
 	d->currentItem->setSelected( !d->currentItem->isSelected(), TRUE );
     } break;
-    case Key_Enter: case Key_Return:
+    
+    case Key_Enter: 
+    case Key_Return:
 	d->currInputString = QString::null;
 	emit returnPressed( d->currentItem );
 	break;
+	
+    case Key_Right: {
+	d->currInputString = QString::null;
+	selectCurrent = FALSE;
+	Direction dir = DirRight;
+	QIconViewItem *item = findItem(dir, d->currentItem);
+	if (item) {
+	    QIconViewItem *old=d->currentItem;
+	    setCurrentItem(item);
+	    ensureItemVisible(item);
+	    handleItemChange(old, e->state() & ShiftButton, e->state() & ControlButton );
+        }
+    } break;
+    
+    case Key_Left: {
+	d->currInputString = QString::null;
+	selectCurrent = FALSE;
+	Direction dir = DirLeft;
+	QIconViewItem *item = findItem(dir, d->currentItem);
+	if (item) {
+	    QIconViewItem *old=d->currentItem;
+	    setCurrentItem(item);
+	    ensureItemVisible(item);
+	    handleItemChange(old, e->state() & ShiftButton, e->state() & ControlButton );
+        }
+    } break;
+    
     case Key_Down: {
 	d->currInputString = QString::null;
-	QIconViewItem *item;
 	selectCurrent = FALSE;
 	Direction dir = DirDown;
-
+	QIconViewItem *item = findItem(dir, d->currentItem);
-	QRect r( d->currentItem->x(), 0, d->currentItem->width(), contentsHeight() );
+	if (item) {
-	item = findItem( dir, d->currentItem->rect().center(), r );
+	    QIconViewItem *old=d->currentItem;
-
+	    setCurrentItem(item);
-	// finding the closest item below and to the right
+	    ensureItemVisible(item);
-	while ( !item && r.x() < contentsWidth() ) {
+	    handleItemChange(old, e->state() & ShiftButton, e->state() & ControlButton );
-	    r.moveBy( r.width() , 0 );
+        }
-	    item = findItem( dir, QPoint( r.center().x(), 0 ), r );
-	}
-
-
-	QIconViewItem *i = d->currentItem;
-	setCurrentItem( item );
-	item = i;
-	handleItemChange( item, e->state() & ShiftButton, e->state() & ControlButton );
     } break;
+    
     case Key_Up: {
 	d->currInputString = QString::null;
-	QIconViewItem *item;
 	selectCurrent = FALSE;
 	Direction dir = DirUp;
-
+	QIconViewItem *item = findItem(dir, d->currentItem);
-	QRect r( d->currentItem->x(), 0, d->currentItem->width(), contentsHeight() );
+	if (item) {
-	item = findItem( dir, d->currentItem->rect().center(), r );
+	    QIconViewItem *old=d->currentItem;
-
+	    setCurrentItem(item);
-	// finding the closest item above and to the left
+	    ensureItemVisible(item);
-	while ( !item && r.x() >= 0 ) {
+	    handleItemChange(old, e->state() & ShiftButton, e->state() & ControlButton );
-	    r.moveBy(- r.width(), 0 );
+        }
-	    item = findItem( dir, QPoint(r.center().x(), contentsHeight() ), r );
-	}
-
-	QIconViewItem *i = d->currentItem;
-	setCurrentItem( item );
-	item = i;
-	handleItemChange( item, e->state() & ShiftButton, e->state() & ControlButton );
     } break;
+    
     case Key_Next: {
 	d->currInputString = QString::null;
 	selectCurrent = FALSE;
@@ -5310,6 +5226,7 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 	    handleItemChange( item, e->state() & ShiftButton, e->state() & ControlButton );
 	}
     } break;
+    
     case Key_Prior: {
 	d->currInputString = QString::null;
 	selectCurrent = FALSE;
@@ -5332,6 +5249,7 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 	    handleItemChange( item, e->state() & ShiftButton, e->state() & ControlButton );
 	}
     } break;
+    
     default:
 	if ( !e->text().isEmpty() && e->text()[ 0 ].isPrint() ) {
 	    selectCurrent = FALSE;
@@ -5402,79 +5320,193 @@ void QIconView::keyPressEvent( QKeyEvent *e )
 }
 
 /*
-  Finds the closest item in the Direction \a dir relative from the point \a relativeTo
+  Finds the closest item in the direction \a dir starting from the specified \a fromItem.
-  which intersects with the searchRect.
+  If the arrangement is LeftToRight (icon view mode): use (center, top) as item reference
-
+  If the arrangement is TopToBottom (multicolumn view mode): use (left, top) as item reference
-  The function choses the closest item with its center in the searchRect.
+  This is to allow for smooth scrolling when using the keyboard arrow keys.
 */
-QIconViewItem* QIconView::findItem( Direction dir,
+QIconViewItem* QIconView::findItem(Direction dir, const QIconViewItem *fromItem) const
-				    const QPoint &relativeTo,
-				    const QRect &searchRect ) const
 {
-    QIconViewItem *item;
+    QIconViewItem *closestItem=NULL;
-    QIconViewItem *centerMatch = 0;
+    int distPri=0, distSec=0;
-    int centerMatchML = 0;
+    int itemDistancePri=0, itemDistanceSec=0;
-
-    // gets list of containers with potential items
-    QPtrList<QIconViewPrivate::ItemContainer>* cList =
-	d->findContainers( dir, relativeTo, searchRect);
-
-    cList->first();
-    while ( cList->current() && !centerMatch ) {
-	QPtrList<QIconViewItem> &list = (cList->current())->items;
-	for ( item = list.first(); item; item = list.next() ) {
-	    if ( neighbourItem( dir, relativeTo, item ) &&
-		 searchRect.contains( item->rect().center() ) &&
-		 item != currentItem() ) {
- 		int ml = (relativeTo - item->rect().center()).manhattanLength();
-		if ( centerMatch ) {
-		    if ( ml < centerMatchML ) {
-			centerMatch = item;
-			centerMatchML = ml;
-		    }
-		} else {
-		    centerMatch = item;
-		    centerMatchML = ml;
-		}
-	    }
-	}
-	cList->next();
-    }
-    delete cList;
-    return centerMatch;
-}
 
+    QPoint pos=fromItem->rect().topLeft();
+    if (d->arrangement == LeftToRight) {
+        pos.setX(fromItem->rect().center().x());
+    }
 
-/*
+    QRect searchRect;
-  Returns TRUE if the items orientation compared to
+    switch (dir) {
-  the point \a relativeTo is correct.
+        case DirDown:
-*/
+            searchRect.setCoords(pos.x(), 0, contentsWidth(), contentsHeight());
-bool QIconView::neighbourItem( Direction dir,
+            break;
-			       const QPoint &relativeTo,
+    
-			       const QIconViewItem *item ) const
+        case DirUp:
-{
+            searchRect.setCoords(0, 0, pos.x(), contentsHeight());
-    switch ( dir ) {
+            break;
-    case DirUp:
+    
-	if ( item->rect().center().y() < relativeTo.y() )
+        case DirRight:
-	    return TRUE;
+            searchRect.setCoords(0, pos.y(), contentsWidth(), contentsHeight());
-	break;
+            break;
-    case DirDown:
+    
-	if ( item->rect().center().y() > relativeTo.y() )
+        case DirLeft:
-	    return TRUE;
+            searchRect.setCoords(0, 0, contentsWidth(), pos.y());
-	break;
+            break;
-    case DirLeft:
-	if ( item->rect().center().x() < relativeTo.x() )
-	    return TRUE;
-	break;
-    case DirRight:
-	if ( item->rect().center().x() > relativeTo.x() )
-	    return TRUE;
-	break;
-    default:
-	// nothing
-	break;
     }
-    return FALSE;
+    
+    for (QIconViewPrivate::ItemContainer *c=d->firstContainer; c; c=c->n) {
+        if (c->rect.intersects(searchRect)) {
+            QPtrList<QIconViewItem> &list = c->items;
+            for (QIconViewItem *item=list.first(); item; item=list.next()) {
+                if (item != fromItem) {
+                    bool itemOK = true;
+                    const QRect &ir = item->rect();
+                    // DirDown/DirUp   : primary distance X, secondary distance Y
+                    // DirLeft/DirRight: primary distance Y, secondary distance X
+                    if (d->arrangement == LeftToRight) {
+                        // Left to right arrangement (icon view mode): use (center, top) as item reference
+                        switch (dir) {
+                            case DirDown:
+                                if (ir.center().x() > pos.x()) {
+                                    distPri = ir.center().x()-pos.x();
+                                    distSec = ir.top();
+                                    }
+                                else if (ir.center().x() == pos.x() && ir.top() > pos.y()) {
+                                    distPri = 0;
+                                    distSec = ir.top()-pos.y();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirUp:
+                                if (ir.center().x() < pos.x()) {
+                                    distPri = pos.x()-ir.center().x();
+                                    distSec = contentsHeight()-ir.top();
+                                    }
+                                else if (ir.center().x() == pos.x() && ir.top() < pos.y()) {
+                                    distPri = 0;
+                                    distSec = pos.y()-ir.top();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirRight:
+                                if (ir.top() > pos.y()) {
+                                    distPri = ir.top()-pos.y();
+                                    distSec = ir.center().x();
+                                    }
+                                else if (ir.top() == pos.y() && ir.center().x() > pos.x()) {
+                                    distPri = 0;
+                                    distSec = ir.center().x()-pos.x();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirLeft:
+                                if (ir.top() < pos.y()) {
+                                    distPri = pos.y()-ir.top();
+                                    distSec = contentsWidth()-ir.center().x();
+                                    }
+                                else if (ir.top() == pos.y() && ir.center().x() < pos.x()) {
+                                    distPri = 0;
+                                    distSec = pos.x()-ir.center().x();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                                
+                            default:
+                                itemOK = false;
+                                break;
+                        }	
+                    }
+                    else {
+                        // Top to bottom arrangement (multicolumn view mode): use (left, top) as item reference
+                        switch (dir) {
+                            case DirDown:
+                                if (ir.left() > pos.x()) {
+                                    distPri = ir.left()-pos.x();
+                                    distSec = ir.top();
+                                    }
+                                else if (ir.left() == pos.x() && ir.top() > pos.y()) {
+                                    distPri = 0;
+                                    distSec = ir.top()-pos.y();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirUp:
+                                if (ir.left() < pos.x()) {
+                                    distPri = pos.x()-ir.left();
+                                    distSec = contentsHeight()-ir.top();
+                                    }
+                                else if (ir.left() == pos.x() && ir.top() < pos.y()) {
+                                    distPri = 0;
+                                    distSec = pos.y()-ir.top();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirRight:
+                                if (ir.top() > pos.y()) {
+                                    distPri = ir.top()-pos.y();
+                                    distSec = ir.left();
+                                    }
+                                else if (ir.top() == pos.y() && ir.left() > pos.x()) {
+                                    distPri = 0;
+                                    distSec = ir.left()-pos.x();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                            
+                            case DirLeft:
+                                if (ir.top() < pos.y()) {
+                                    distPri = pos.y()-ir.top();
+                                    distSec = contentsWidth()-ir.left();
+                                    }
+                                else if (ir.top() == pos.y() && ir.left() < pos.x()) {
+                                    distPri = 0;
+                                    distSec = pos.x()-ir.left();
+                                    }
+                                else {
+                                    itemOK = false;
+                                    }
+                                break;
+                                
+                            default:
+                                itemOK = false;
+                                break;
+                        }	
+                    }
+                        
+                    if (itemOK) {
+                        if (!closestItem ||
+                            ((distPri < itemDistancePri) ||
+                            (distPri == itemDistancePri && distSec < itemDistanceSec))) {
+                            closestItem = item;
+                            itemDistancePri = distPri;
+                            itemDistanceSec = distSec;
+                        } 
+                    }
+                }
+            }
+        }
+    }
+    return closestItem;
 }
 
 /*!
@@ -6040,7 +6072,7 @@ QIconViewItem *QIconView::makeRowLayout( QIconViewItem *begin, int &y, bool &cha
 	}
 
 
-    } else { // -------------------------------- SOUTH ------------------------------
+    } else { // -------------------------------- TopToBottom ------------------------------
 
 	int x = y;
 
@@ -6075,6 +6107,7 @@ QIconViewItem *QIconView::makeRowLayout( QIconViewItem *begin, int &y, bool &cha
 
 	    // now move the items
 	    item = begin;
+	    QIconViewItem *prevVisibleItem = NULL;
 	    for (;;) {
 		item->dirty = FALSE;
 		if ( d->itemTextPos == Bottom ) {
@@ -6082,15 +6115,16 @@ QIconViewItem *QIconView::makeRowLayout( QIconViewItem *begin, int &y, bool &cha
 			changed = item->move( x + ( w - item->width() ) / 2, d->spacing )  || changed;
 		    else
 			changed = item->move( x + ( w - item->width() ) / 2,
-					      item->prev->y() + item->prev->height() + d->spacing ) || changed;
+					      prevVisibleItem->y() + prevVisibleItem->height() + d->spacing ) || changed;
 		} else {
 		    if ( item == begin )
 			changed = item->move( x, d->spacing ) || changed;
 		    else
-			changed = item->move( x, item->prev->y() + item->prev->height() + d->spacing ) || changed;
+			changed = item->move( x, prevVisibleItem->y() + prevVisibleItem->height() + d->spacing ) || changed;
 		}
 		if ( item == end )
 		    break;
+		prevVisibleItem = item;
 		item = item->next;
 		while (item && (item->isVisible() == FALSE)) {
 		    item = item->next;

src/iconview/qiconview.h

@@ -497,12 +497,7 @@ private:
 	DirLeft,
 	DirRight
     };
-    QIconViewItem* findItem( Direction dir,
+    QIconViewItem* findItem(Direction dir, const QIconViewItem *fromItem) const;
-			     const QPoint &relativeTo,
-			     const QRect &searchRect ) const;
-    bool neighbourItem( Direction dir,
-			const QPoint &relativeTo,
-			const QIconViewItem *item ) const;
     QBitmap mask( QPixmap *pix ) const;
     int visibleWidthSB() const;
     int visibleHeightSB() const;

src/kernel/qapplication_x11.cpp

@@ -4821,6 +4821,11 @@ bool QETWidget::translatePropertyEvent(const XEvent *event)
 #define XF86XK_LaunchD		0x1008FF4D
 #define XF86XK_LaunchE		0x1008FF4E
 #define XF86XK_LaunchF		0x1008FF4F
+#define XF86XK_MonBrightnessUp   0x1008FF02  /* Monitor/panel brightness */
+#define XF86XK_MonBrightnessDown 0x1008FF03  /* Monitor/panel brightness */
+#define XF86XK_KbdLightOnOff     0x1008FF04  /* Keyboards may be lit     */
+#define XF86XK_KbdBrightnessUp   0x1008FF05  /* Keyboards may be lit     */
+#define XF86XK_KbdBrightnessDown 0x1008FF06  /* Keyboards may be lit     */
 // end of XF86keysyms.h
 
 
@@ -5019,6 +5024,11 @@ static const KeySym KeyTbl[] = {		// keyboard mapping table
     XF86XK_LaunchB,	Qt::Key_LaunchD,
     XF86XK_LaunchC,	Qt::Key_LaunchE,
     XF86XK_LaunchD,	Qt::Key_LaunchF,
+    XF86XK_MonBrightnessUp,	Qt::Key_MonBrightnessUp,
+    XF86XK_MonBrightnessDown,	Qt::Key_MonBrightnessDown,
+    XF86XK_KbdLightOnOff,	Qt::Key_KeyboardLightOnOff,
+    XF86XK_KbdBrightnessUp,	Qt::Key_KeyboardBrightnessUp,
+    XF86XK_KbdBrightnessDown,	Qt::Key_KeyboardBrightnessDown,
 
     0,			0
 };

src/kernel/qasyncimageio.cpp

@@ -904,7 +904,12 @@ int QGIFFormat::decode(QImage& img, QImageConsumer* consumer,
 		    sheight = newtop + newheight;
 
 		if (img.isNull()) {
-		    img.create(swidth, sheight, 32);
+		    if (!img.create(swidth, sheight, 32)) {
+			// Check if the attempt to create the image failed. If
+			// it did, the image is broken and we should give up.
+			state = Error;
+			return -1;
+		    }
 		    memset( img.bits(), 0, img.numBytes() );
 		    if (consumer) consumer->setSize(swidth, sheight);
 		}
@@ -1221,6 +1226,8 @@ void QGIFFormat::fillRect(QImage& img, int col, int row, int w, int h, QRgb colo
 
 void QGIFFormat::nextY(QImage& img, QImageConsumer* consumer)
 {
+    if (out_of_bounds)
+        return;
     int my;
     switch (interlace) {
       case 0:

src/kernel/qevent.cpp

@@ -1140,6 +1140,11 @@ Qt::ButtonState QKeyEvent::stateAfter() const
     \value Key_LaunchD
     \value Key_LaunchE
     \value Key_LaunchF
+    \value Key_MonBrightnessUp
+    \value Key_MonBrightnessDown
+    \value Key_KeyboardLightOnOff
+    \value Key_KeyboardBrightnessUp
+    \value Key_KeyboardBrightnessDown
 
     \value Key_MediaLast
 

src/kernel/qeventloop_unix_glib.cpp

@@ -688,7 +688,9 @@ int QEventLoop::activateTimers()
 		QTimerEvent e( t->id );
 #if defined(QT_THREAD_SUPPORT)
 		// Be careful...the current thread may not be the target object's thread!
-		if ((!t->obj) || (QThread::currentThreadObject()->threadPostedEventsDisabled()) || (t->obj && (t->obj->contextThreadObject() == QThread::currentThreadObject()))) {
+		if ((!t->obj) || 
+		    (QThread::currentThreadObject() && QThread::currentThreadObject()->threadPostedEventsDisabled()) ||
+		    (t->obj && t->obj->contextThreadObject() == QThread::currentThreadObject())) {
 			QApplication::sendEvent( t->obj, &e );				// send event
 		}
 		else {
@@ -731,7 +733,9 @@ int QEventLoop::activateSocketNotifiers()
 		sn->pending = FALSE;
 #if defined(QT_THREAD_SUPPORT)
 		// Be careful...the current thread may not be the target object's thread!
-		if ((!sn->obj) || (QThread::currentThreadObject()->threadPostedEventsDisabled()) || (sn->obj && (sn->obj->contextThreadObject() == QThread::currentThreadObject()))) {
+		if ((!sn->obj) || 
+		    (QThread::currentThreadObject() && QThread::currentThreadObject()->threadPostedEventsDisabled()) ||
+		    (sn->obj && sn->obj->contextThreadObject() == QThread::currentThreadObject())) {
 			QApplication::sendEvent( sn->obj, &event );			// send event
 		}
 		else {

src/kernel/qimage.cpp

@@ -4716,10 +4716,16 @@ bool read_dib( QDataStream& s, int offset, int startpos, QImage& image )
 	if ( (Q_ULONG)d->readBlock( (char *)&blue_mask, sizeof(blue_mask) ) != sizeof(blue_mask) )
 	    return FALSE;
 	red_shift = calc_shift(red_mask);
+	if (((red_mask >> red_shift) + 1) == 0)
+	    return FALSE;
 	red_scale = 256 / ((red_mask >> red_shift) + 1);
 	green_shift = calc_shift(green_mask);
+	if (((green_mask >> green_shift) + 1) == 0)
+	    return FALSE;
 	green_scale = 256 / ((green_mask >> green_shift) + 1);
 	blue_shift = calc_shift(blue_mask);
+	if (((blue_mask >> blue_shift) + 1) == 0)
+	    return FALSE;
 	blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
     } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
 	blue_mask = 0x000000ff;

src/kernel/qkeysequence.cpp

@@ -160,6 +160,11 @@ static struct {
     { Qt::Key_LaunchD,	    QT_TRANSLATE_NOOP( "QAccel", "Launch (D)" ) },
     { Qt::Key_LaunchE,	    QT_TRANSLATE_NOOP( "QAccel", "Launch (E)" ) },
     { Qt::Key_LaunchF,	    QT_TRANSLATE_NOOP( "QAccel", "Launch (F)" ) },
+    { Qt::Key_MonBrightnessUp,	    QT_TRANSLATE_NOOP( "QAccel", "Monitor Brightness Up" ) },
+    { Qt::Key_MonBrightnessDown,   QT_TRANSLATE_NOOP( "QAccel", "Monitor Brightness Down" ) },
+    { Qt::Key_KeyboardLightOnOff,  QT_TRANSLATE_NOOP( "QAccel", "Keyboard Light On Off" ) },
+    { Qt::Key_KeyboardBrightnessUp,QT_TRANSLATE_NOOP( "QAccel", "Keyboard Brightness Up" ) },
+    { Qt::Key_KeyboardBrightnessDown,	QT_TRANSLATE_NOOP( "QAccel", "Keyboard Brightness Down" ) },
 
     // --------------------------------------------------------------
     // More consistent namings

src/kernel/qnamespace.h

@@ -726,6 +726,11 @@ public:
 	Key_LaunchD  = 0x10af,
 	Key_LaunchE  = 0x10b0,
 	Key_LaunchF  = 0x10b1,
+	Key_MonBrightnessUp = 0x010b2,
+	Key_MonBrightnessDown = 0x010b3,
+	Key_KeyboardLightOnOff = 0x010b4,
+	Key_KeyboardBrightnessUp = 0x010b5,
+	Key_KeyboardBrightnessDown = 0x010b6,
 
 	Key_MediaLast = 0x1fff,
 

src/kernel/qobject.cpp

@@ -203,9 +203,10 @@ void QObject::moveToThread(QThread *targetThread)
     }
 
     QThread *objectThread = contextThreadObject();
+    // NOTE currentThread could be NULL if the current thread was not started using the QThread API
     QThread *currentThread = QThread::currentThreadObject();
 
-    if (objectThread != currentThread) {
+    if (currentThread && objectThread != currentThread) {
 #if defined(QT_DEBUG)
         qWarning( "QObject::moveToThread: Current thread is not the object's thread" );
 #endif
@@ -2760,6 +2761,7 @@ void QObject::activate_signal( QConnectionList *clist, QUObject *o )
     }
 #endif
 
+    // NOTE currentThread could be NULL if the current thread was not started using the QThread API
     const QThread *currentThread = QThread::currentThreadObject();
 
     QObject *object;
@@ -2779,7 +2781,10 @@ void QObject::activate_signal( QConnectionList *clist, QUObject *o )
 	    sol->currentSender = this;
 	}
 	if ( c->memberType() == QSIGNAL_CODE ) {
-	    if ((d->disableThreadPostedEvents) || (object->d->disableThreadPostedEvents) || (currentThread->threadPostedEventsDisabled()) || (object->d->ownThread == currentThread)) {
+	    if ((d->disableThreadPostedEvents) || 
+	        (object->d->disableThreadPostedEvents) || 
+	        (currentThread && currentThread->threadPostedEventsDisabled()) || 
+	        (currentThread && object->d->ownThread == currentThread)) {
 #ifdef QT_THREAD_SUPPORT
 		sol->listMutex->unlock();
 #endif // QT_THREAD_SUPPORT
@@ -2798,7 +2803,10 @@ void QObject::activate_signal( QConnectionList *clist, QUObject *o )
 	    }
 	}
 	else {
-	    if ((d->disableThreadPostedEvents) || (object->d->disableThreadPostedEvents) || (currentThread->threadPostedEventsDisabled()) || (object->d->ownThread == currentThread)) {
+	    if ((d->disableThreadPostedEvents) || 
+	        (object->d->disableThreadPostedEvents) || 
+	        (currentThread && currentThread->threadPostedEventsDisabled()) || 
+	        (currentThread && object->d->ownThread == currentThread)) {
 #ifdef QT_THREAD_SUPPORT
 		sol->listMutex->unlock();
 #endif // QT_THREAD_SUPPORT
@@ -2846,7 +2854,10 @@ void QObject::activate_signal( QConnectionList *clist, QUObject *o )
 		sol->currentSender = this;
 	    }
 	    if ( c->memberType() == QSIGNAL_CODE ) {
-		if ((d->disableThreadPostedEvents) || (object->d->disableThreadPostedEvents) || (currentThread->threadPostedEventsDisabled()) || (object->d->ownThread == currentThread)) {
+		if ((d->disableThreadPostedEvents) || 
+		    (object->d->disableThreadPostedEvents) || 
+		    (currentThread && currentThread->threadPostedEventsDisabled()) || 
+		    (currentThread && object->d->ownThread == currentThread)) {
 #ifdef QT_THREAD_SUPPORT
 		    sol->listMutex->unlock();
 #endif // QT_THREAD_SUPPORT
@@ -2865,7 +2876,10 @@ void QObject::activate_signal( QConnectionList *clist, QUObject *o )
 		}
 	    }
 	    else {
-		if ((d->disableThreadPostedEvents) || (object->d->disableThreadPostedEvents) || (currentThread->threadPostedEventsDisabled()) || (object->d->ownThread == currentThread)) {
+		if ((d->disableThreadPostedEvents) || 
+		    (object->d->disableThreadPostedEvents) || 
+		    (currentThread && currentThread->threadPostedEventsDisabled()) || 
+		    (currentThread && object->d->ownThread == currentThread)) {
 #ifdef QT_THREAD_SUPPORT
 		    sol->listMutex->unlock();
 #endif // QT_THREAD_SUPPORT

src/sql/drivers/mysql/qsql_mysql.cpp

@@ -350,30 +350,40 @@ int QMYSQLResult::numRowsAffected()
 static void qServerEnd()
 {
 #ifndef Q_NO_MYSQL_EMBEDDED
-# if MYSQL_VERSION_ID >= 40000
+#if !defined(MARIADB_BASE_VERSION) && !defined(MARIADB_VERSION_ID)
+# if MYSQL_VERSION_ID > 40000
+#  if (MYSQL_VERSION_ID >= 40110 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID >= 50003
+    mysql_library_end();
+#  else
     mysql_server_end();
-# endif // MYSQL_VERSION_ID
+#  endif
-#endif // Q_NO_MYSQL_EMBEDDED
+# endif
+#endif
+#endif
 }
 
 static void qServerInit()
 {
 #ifndef Q_NO_MYSQL_EMBEDDED
 # if MYSQL_VERSION_ID >= 40000
-    if ( qMySqlInitHandledByUser || qMySqlConnectionCount > 1 )
+    if (qMySqlInitHandledByUser || qMySqlConnectionCount > 1)
         return;
 
-    // this should only be called once
+    if (
-    // has no effect on client/server library
+# if (MYSQL_VERSION_ID >= 40110 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID >= 50003
-    // but is vital for the embedded lib
+        mysql_library_init(0, 0, 0)
-    if ( mysql_server_init( 0, 0, 0 ) ) {
+# else
-#  ifdef QT_CHECK_RANGE
+        mysql_server_init(0, 0, 0)
-	qWarning( "QMYSQLDriver::qServerInit: unable to start server." );
+# endif
-#  endif
+       ) {
+        qWarning("QMYSQLDriver::qServerInit: unable to start server.");
     }
-    
 # endif // MYSQL_VERSION_ID
 #endif // Q_NO_MYSQL_EMBEDDED
+
+#if defined(MARIADB_BASE_VERSION) || defined(MARIADB_VERSION_ID)
+    qAddPostRoutine(mysql_server_end);
+#endif
 }
 
 QMYSQLDriver::QMYSQLDriver( QObject * parent, const char * name )
@@ -466,7 +476,7 @@ bool QMYSQLDriver::open( const QString& db,
     if ( isOpen() )
 	close();
  
-    unsigned int optionFlags = 0;
+    unsigned int clientOptionFlags = 0;
     
     QStringList raw = QStringList::split( ';', connOpts );
     QStringList opts;
@@ -487,38 +497,47 @@ bool QMYSQLDriver::open( const QString& db,
 	    opts << tmp;
 	}
     }
-    
+
+    if (!(d->mysql = mysql_init((MYSQL*) 0))) {
+	    setLastError( qMakeError( "Unable to connect", QSqlError::Connection, d ) );
+	    mysql_close( d->mysql );
+	    setOpenError( TRUE );
+	    return FALSE;
+    }
+
+    my_bool reconnect = 0;
     for ( it = opts.begin(); it != opts.end(); ++it ) {
 	QString opt( (*it).upper() );
 	if ( opt == "CLIENT_COMPRESS" )
-	    optionFlags |= CLIENT_COMPRESS;
+	    clientOptionFlags |= CLIENT_COMPRESS;
 	else if ( opt == "CLIENT_FOUND_ROWS" )
-	    optionFlags |= CLIENT_FOUND_ROWS;
+	    clientOptionFlags |= CLIENT_FOUND_ROWS;
 	else if ( opt == "CLIENT_IGNORE_SPACE" )
-	    optionFlags |= CLIENT_IGNORE_SPACE;
+	    clientOptionFlags |= CLIENT_IGNORE_SPACE;
 	else if ( opt == "CLIENT_INTERACTIVE" )
-	    optionFlags |= CLIENT_INTERACTIVE;
+	    clientOptionFlags |= CLIENT_INTERACTIVE;
 	else if ( opt == "CLIENT_NO_SCHEMA" )
-	    optionFlags |= CLIENT_NO_SCHEMA;
+	    clientOptionFlags |= CLIENT_NO_SCHEMA;
 	else if ( opt == "CLIENT_ODBC" )
-	    optionFlags |= CLIENT_ODBC;
+	    clientOptionFlags |= CLIENT_ODBC;
 	else if ( opt == "CLIENT_SSL" )
-	    optionFlags |= CLIENT_SSL;
+	    clientOptionFlags |= CLIENT_SSL;
 	else if ( opt == "MYSQL_OPT_RECONNECT" )
-	    optionFlags |= MYSQL_OPT_RECONNECT;
+	    reconnect = 1;
-	else 
+	else
 	    qWarning( "QMYSQLDriver::open: Unknown connect option '%s'", (*it).latin1() );
     }
 
-    if ( (d->mysql = mysql_init((MYSQL*) 0)) &&
+    mysql_options(d->mysql, MYSQL_OPT_RECONNECT, &reconnect);
-	    mysql_real_connect( d->mysql,
+
+    if ( mysql_real_connect( d->mysql,
 				host,
 				user,
 				password,
 				db.isNull() ? QString("") : db,
 				(port > -1) ? port : 0,
 				NULL,
-				optionFlags ) )
+				clientOptionFlags ) )
     {
 	if ( !db.isEmpty() && mysql_select_db( d->mysql, db )) {
 	    setLastError( qMakeError("Unable open database '" + db + "'", QSqlError::Connection, d ) );

src/tools/qmutex_unix.cpp

@@ -45,8 +45,8 @@
 typedef pthread_mutex_t     Q_MUTEX_T;
 
 // POSIX threads mutex types
-#if ((defined(PTHREAD_MUTEX_RECURSIVE) && defined(PTHREAD_MUTEX_DEFAULT)) || \
+#if (defined(PTHREAD_MUTEX_RECURSIVE) && defined(PTHREAD_MUTEX_DEFAULT)) && \
-     defined(Q_OS_FREEBSD)) && !defined(Q_OS_UNIXWARE) && !defined(Q_OS_SOLARIS) && \
+    !defined(Q_OS_UNIXWARE) && !defined(Q_OS_SOLARIS) && \
     !defined(Q_OS_MAC)
 // POSIX 1003.1c-1995 - We love this OS
 #  define Q_MUTEX_SET_TYPE(a, b) pthread_mutexattr_settype((a), (b))

src/widgets/qlistview.cpp

@@ -5366,9 +5366,17 @@ void QListView::selectAll( bool select )
 	QListViewItemIterator it( this );
 	while ( it.current() ) {
 	    QListViewItem *i = it.current();
-	    if ( (bool)i->selected != select ) {
+	    if ( i->isVisible()) {
-		i->setSelected( select );
+		if ( (bool)i->selected != select ) {
-		anything = TRUE;
+		    i->setSelected( select );
+		    anything = TRUE;
+		}
+	    }
+	    else {
+		if ( (bool)i->selected != FALSE ) {
+		    i->setSelected( FALSE );
+		    anything = TRUE;
+		}
 	    }
 	    ++it;
 	}
@@ -5398,8 +5406,16 @@ void QListView::invertSelection()
     bool b = signalsBlocked();
     blockSignals( TRUE );
     QListViewItemIterator it( this );
-    for ( ; it.current(); ++it )
+    for ( ; it.current(); ++it ) {
-	it.current()->setSelected( !it.current()->isSelected() );
+        if (it.current()->isVisible()) {
+            it.current()->setSelected( !it.current()->isSelected() );
+        }
+        else {
+            if ( FALSE != it.current()->isSelected() ) {
+                it.current()->setSelected( FALSE );
+            }
+        }
+    }
     blockSignals( b );
     emit selectionChanged();
     triggerUpdate();

src/xml/qxml.cpp

@@ -4529,6 +4529,11 @@ bool QXmlSimpleReader::parseDoctype()
 		}
 		break;
 	    case Mup:
+		if (dtdRecursionLimit > 0U && d->parameterEntities.size() > dtdRecursionLimit) {
+		    reportParseError(QString::fromLatin1(
+		        "DTD parsing exceeded recursion limit of %1.").arg(dtdRecursionLimit));
+		    return FALSE;
+		}
 		if ( !parseMarkupdecl() ) {
 		    parseFailed( &QXmlSimpleReader::parseDoctype, state );
 		    return FALSE;
@@ -6128,6 +6133,58 @@ bool QXmlSimpleReader::parseChoiceSeq()
     }
 }
 
+bool QXmlSimpleReader::isExpandedEntityValueTooLarge(QString *errorMessage)
+{
+    QMap<QString, uint> literalEntitySizes;
+    // The entity at (QMap<QString,) referenced the entities at (QMap<QString,) (uint>) times.
+    QMap<QString, QMap<QString, uint> > referencesToOtherEntities;
+    QMap<QString, uint> expandedSizes;
+
+    // For every entity, check how many times all entity names were referenced in its value.
+    QMap<QString,QString>::ConstIterator toSearchIterator;
+    for (toSearchIterator = d->entities.begin(); toSearchIterator != d->entities.end(); ++toSearchIterator) {
+        QString toSearch = toSearchIterator.key();
+        // The amount of characters that weren't entity names, but literals, like 'X'.
+        QString leftOvers = toSearchIterator.data();
+        QMap<QString,QString>::ConstIterator entityNameIterator;
+        // How many times was entityName referenced by toSearch?
+        for (entityNameIterator = d->entities.begin(); entityNameIterator != d->entities.end(); ++entityNameIterator) {
+            QString entityName = entityNameIterator.key();
+            for (int i = 0; i >= 0 && (uint) i < leftOvers.length(); ) {
+                i = leftOvers.find(QString::fromLatin1("&%1;").arg(entityName), i);
+                if (i != -1) {
+                    leftOvers.remove(i, entityName.length() + 2U);
+                    // The entityName we're currently trying to find was matched in this string; increase our count.
+                    ++referencesToOtherEntities[toSearch][entityName];
+                }
+            }
+        }
+        literalEntitySizes[toSearch] = leftOvers.length();
+    }
+
+    QMap<QString, QMap<QString, uint> >::ConstIterator entityIterator;
+    for (entityIterator = referencesToOtherEntities.begin(); entityIterator != referencesToOtherEntities.end(); ++entityIterator) {
+        QString entity = entityIterator.key();
+        expandedSizes[entity] = literalEntitySizes[entity];
+        QMap<QString, uint>::ConstIterator referenceToIterator;
+        for (referenceToIterator = entityIterator.data().begin(); referenceToIterator != entityIterator.data().end(); ++referenceToIterator) {
+            QString referenceTo = referenceToIterator.key();
+            const uint references = referenceToIterator.data();
+            // The total size of an entity's value is the expanded size of all of its referenced entities, plus its literal size.
+            expandedSizes[entity] += expandedSizes[referenceTo] * references + literalEntitySizes[referenceTo] * references;
+        }
+
+        if (expandedSizes[entity] > entityCharacterLimit) {
+            if (errorMessage) {
+                *errorMessage = QString::fromLatin1("The XML entity \"%1\" expands to a string that is too large to process (%2 characters > %3).");
+                *errorMessage = (*errorMessage).arg(entity).arg(expandedSizes[entity]).arg(entityCharacterLimit);
+            }
+            return TRUE;
+        }
+    }
+    return FALSE;
+}
+
 /*
   Parse a EntityDecl [70].
 
@@ -6222,6 +6279,12 @@ bool QXmlSimpleReader::parseEntityDecl()
 	switch ( state ) {
 	    case EValue:
 		if (  !entityExist( name() ) ) {
+		    QString errorMessage;
+		    if (isExpandedEntityValueTooLarge(&errorMessage)) {
+		        reportParseError(errorMessage);
+		        return FALSE;
+		    }
+
 		    d->entities.insert( name(), string() );
 		    if ( declHnd ) {
 			if ( !declHnd->internalEntityDecl( name(), string() ) ) {

src/xml/qxml.h

@@ -307,6 +307,12 @@ private:
 
     QXmlSimpleReaderPrivate* d;
 
+    // The limit to the amount of times the DTD parsing functions can be called
+    // for the DTD currently being parsed.
+    static const uint dtdRecursionLimit = 2U;
+    // The maximum amount of characters an entity value may contain, after expansion.
+    static const uint entityCharacterLimit = 4096U;
+
     const QString &string();
     void stringClear();
     inline void stringAddC() { stringAddC(c); }
@@ -378,6 +384,7 @@ private:
     void unexpectedEof( ParseFunction where, int state );
     void parseFailed( ParseFunction where, int state );
     void pushParseState( ParseFunction function, int state );
+    bool isExpandedEntityValueTooLarge(QString *errorMessage);
 
     void setUndefEntityInAttrHack(bool b);