Add fixes from upstream for CVE-2008-2426 #223965.

(Portage version: 2.2_pre5.spank.spunk)

4 files changed, 167 insertions, 1 deletions

diff --git a/media-libs/imlib2/ChangeLog b/media-libs/imlib2/ChangeLog
index 9b878f8616f3..b8996f4deb5a 100644
--- a/media-libs/imlib2/ChangeLog
+++ b/media-libs/imlib2/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for media-libs/imlib2
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/imlib2/ChangeLog,v 1.63 2008/04/19 21:05:30 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/imlib2/ChangeLog,v 1.64 2008/05/31 05:47:12 vapier Exp $
+
+*imlib2-1.4.1.000-r1 (31 May 2008)
+*imlib2-1.4.0-r1 (31 May 2008)
+
+  31 May 2008; Mike Frysinger <vapier@gentoo.org>
+  +files/imlib2-1.4.0-CVE-2008-2426.patch, +imlib2-1.4.0-r1.ebuild,
+  +imlib2-1.4.1.000-r1.ebuild:
+  Add fixes from upstream for CVE-2008-2426 #223965.
 
 *imlib2-1.4.1.000 (19 Apr 2008)
 
diff --git a/media-libs/imlib2/files/imlib2-1.4.0-CVE-2008-2426.patch b/media-libs/imlib2/files/imlib2-1.4.0-CVE-2008-2426.patch
new file mode 100644
index 000000000000..06b9a352085a
--- /dev/null
+++ b/media-libs/imlib2/files/imlib2-1.4.0-CVE-2008-2426.patch
@@ -0,0 +1,52 @@
+fix from upstream for security issue
+http://bugs.gentoo.org/223965
+
+----------------------------
+revision 1.9
+date: 2008/05/27 14:35:17;  author: raster;  state: Exp;  lines: +1 -1
+
+2 possible security vulns fixed. should probably release new version with
+these.
+
+Index: imlib2/src/modules/loaders/loader_xpm.c
+===================================================================
+RCS file: /cvs/e/e17/libs/imlib2/src/modules/loaders/loader_xpm.c,v
+retrieving revision 1.8
+retrieving revision 1.9
+diff -u -p -r1.8 -r1.9
+--- imlib2/src/modules/loaders/loader_xpm.c	25 Aug 2007 02:07:08 -0000	1.8
++++ imlib2/src/modules/loaders/loader_xpm.c	27 May 2008 14:35:17 -0000	1.9
+@@ -286,7 +286,7 @@ load(ImlibImage * im, ImlibProgressFunct
+                                  if (line[k] != ' ')
+                                    {
+                                       s[0] = 0;
+-                                      sscanf(&line[k], "%65535s", s);
++                                      sscanf(&line[k], "%255s", s);
+                                       slen = strlen(s);
+                                       k += slen;
+                                       if (!strcmp(s, "c"))
+
+----------------------------
+revision 1.5
+date: 2008/05/27 14:35:17;  author: raster;  state: Exp;  lines: +1 -1
+
+2 possible security vulns fixed. should probably release new version with
+these.
+
+Index: imlib2/src/modules/loaders/loader_pnm.c
+===================================================================
+RCS file: /cvs/e/e17/libs/imlib2/src/modules/loaders/loader_pnm.c,v
+retrieving revision 1.4
+retrieving revision 1.5
+diff -u -p -r1.4 -r1.5
+--- imlib2/src/modules/loaders/loader_pnm.c	9 Apr 2007 12:55:29 -0000	1.4
++++ imlib2/src/modules/loaders/loader_pnm.c	27 May 2008 14:35:17 -0000	1.5
+@@ -68,7 +68,7 @@ load(ImlibImage * im, ImlibProgressFunct
+              int                 i = 0;
+ 
+              /* read numbers */
+-             while (c != EOF && !isspace(c))
++             while (c != EOF && !isspace(c) && (i < 255))
+                {
+                   buf[i++] = c;
+                   c = fgetc(f);
diff --git a/media-libs/imlib2/imlib2-1.4.0-r1.ebuild b/media-libs/imlib2/imlib2-1.4.0-r1.ebuild
new file mode 100644
index 000000000000..2f8111852c88
--- /dev/null
+++ b/media-libs/imlib2/imlib2-1.4.0-r1.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/imlib2/imlib2-1.4.0-r1.ebuild,v 1.1 2008/05/31 05:47:12 vapier Exp $
+
+EKEY_STATE="release"
+inherit enlightenment toolchain-funcs
+
+MY_P=${P/_/-}
+DESCRIPTION="Version 2 of an advanced replacement library for libraries like libXpm"
+HOMEPAGE="http://www.enlightenment.org/"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="X bzip2 gif jpeg mmx mp3 png tiff zlib"
+
+DEPEND="=media-libs/freetype-2*
+	bzip2? ( app-arch/bzip2 )
+	zlib? ( sys-libs/zlib )
+	gif? ( >=media-libs/giflib-4.1.0 )
+	png? ( >=media-libs/libpng-1.2.1 )
+	jpeg? ( media-libs/jpeg )
+	tiff? ( >=media-libs/tiff-3.5.5 )
+	X? ( x11-libs/libXext x11-proto/xextproto )
+	mp3? ( media-libs/libid3tag )"
+
+src_unpack() {
+	enlightenment_src_unpack
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-CVE-2008-2426.patch #223965
+}
+
+src_compile() {
+	# imlib2 has diff configure options for x86/amd64 mmx
+	local mymmx=""
+	if [[ $(tc-arch) == "amd64" ]] ; then
+		mymmx="$(use_enable mmx amd64) --disable-mmx"
+	else
+		mymmx="--disable-amd64 $(use_enable mmx)"
+	fi
+
+	export MY_ECONF="
+		$(use_with X x) \
+		$(use_with jpeg) \
+		$(use_with png) \
+		$(use_with tiff) \
+		$(use_with gif) \
+		$(use_with zlib) \
+		$(use_with bzip2) \
+		$(use_with mp3 id3) \
+		${mymmx} \
+	"
+	enlightenment_src_compile
+}
diff --git a/media-libs/imlib2/imlib2-1.4.1.000-r1.ebuild b/media-libs/imlib2/imlib2-1.4.1.000-r1.ebuild
new file mode 100644
index 000000000000..6579461b8b4b
--- /dev/null
+++ b/media-libs/imlib2/imlib2-1.4.1.000-r1.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/imlib2/imlib2-1.4.1.000-r1.ebuild,v 1.1 2008/05/31 05:47:12 vapier Exp $
+
+inherit enlightenment toolchain-funcs
+
+MY_P=${P/_/-}
+DESCRIPTION="Version 2 of an advanced replacement library for libraries like libXpm"
+HOMEPAGE="http://www.enlightenment.org/"
+SRC_URI="http://download.enlightenment.org/snapshots/2008-01-25/${P}.tar.bz2"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="X bzip2 gif jpeg mmx mp3 png tiff zlib"
+
+DEPEND="=media-libs/freetype-2*
+	bzip2? ( app-arch/bzip2 )
+	zlib? ( sys-libs/zlib )
+	gif? ( >=media-libs/giflib-4.1.0 )
+	png? ( >=media-libs/libpng-1.2.1 )
+	jpeg? ( media-libs/jpeg )
+	tiff? ( >=media-libs/tiff-3.5.5 )
+	X? ( x11-libs/libXext x11-proto/xextproto )
+	mp3? ( media-libs/libid3tag )"
+
+src_unpack() {
+	enlightenment_src_unpack
+	cd "${S}"
+	epatch "${FILESDIR}"/${PN}-1.4.0-CVE-2008-2426.patch #223965
+}
+
+src_compile() {
+	# imlib2 has diff configure options for x86/amd64 mmx
+	local myconf=""
+	if [[ $(tc-arch) == "amd64" ]] ; then
+		myconf="$(use_enable mmx amd64) --disable-mmx"
+	else
+		myconf="--disable-amd64 $(use_enable mmx)"
+	fi
+
+	[[ $(gcc-major-version) -ge 4 ]] && myconf="${myconf} --enable-visibility-hiding"
+
+	export MY_ECONF="
+		$(use_with X x) \
+		$(use_with jpeg) \
+		$(use_with png) \
+		$(use_with tiff) \
+		$(use_with gif) \
+		$(use_with zlib) \
+		$(use_with bzip2) \
+		$(use_with mp3 id3) \
+		${myconf} \
+	"
+	enlightenment_src_compile
+}