Added a security fix for #142387.

Package-Manager: portage-2.1-r1

6 files changed, 115 insertions, 11 deletions

diff --git a/media-libs/dumb/ChangeLog b/media-libs/dumb/ChangeLog
index 5b67e9bdcdf6..ca1db64b21e0 100644
--- a/media-libs/dumb/ChangeLog
+++ b/media-libs/dumb/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for media-libs/dumb
 # Copyright 2000-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/ChangeLog,v 1.24 2006/07/22 15:54:47 tcort Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/ChangeLog,v 1.25 2006/08/03 15:44:19 joker Exp $
+
+*dumb-0.9.3-r1 (03 Aug 2006)
+
+  03 Aug 2006; Christian Birchinger <joker@gentoo.org>
+  +files/dumb-0.9.3_CVE-2006-3668.patch, dumb-0.9.3.ebuild,
+  +dumb-0.9.3-r1.ebuild:
+  Added a security fix for #142387
 
   22 Jul 2006; Thomas Cort <tcort@gentoo.org> dumb-0.9.3.ebuild:
   Stable on alpha wrt Bug #134990.
diff --git a/media-libs/dumb/Manifest b/media-libs/dumb/Manifest
index 7fc3f4010c9e..b90759484f02 100644
--- a/media-libs/dumb/Manifest
+++ b/media-libs/dumb/Manifest
@@ -2,6 +2,10 @@ AUX dumb-0.9.2-PIC.patch 2697 RMD160 aeba4f6ca8d0245ac21107eb5b4e26ccf5844bde SH
 MD5 06b0308865a7fa48b3f9c75937a4c9e4 files/dumb-0.9.2-PIC.patch 2697
 RMD160 aeba4f6ca8d0245ac21107eb5b4e26ccf5844bde files/dumb-0.9.2-PIC.patch 2697
 SHA256 c1fda1f53e13ae7592ba3b651ac935879294d4318c5a159bba2b1a13f1b501fa files/dumb-0.9.2-PIC.patch 2697
+AUX dumb-0.9.3_CVE-2006-3668.patch 637 RMD160 09c8de5a1ca5f2f45b7e1a8b245006f4f8b85dc8 SHA1 facf6c974bc436369de73367670943a23877d29a SHA256 9f6785435757db725bc73b1c4874b91e80b9277c6fdd2b56e47dae1cfbc968e6
+MD5 e1378e2eb30346073ee188608ac2c9e7 files/dumb-0.9.3_CVE-2006-3668.patch 637
+RMD160 09c8de5a1ca5f2f45b7e1a8b245006f4f8b85dc8 files/dumb-0.9.3_CVE-2006-3668.patch 637
+SHA256 9f6785435757db725bc73b1c4874b91e80b9277c6fdd2b56e47dae1cfbc968e6 files/dumb-0.9.3_CVE-2006-3668.patch 637
 DIST dumb-0.9.2-fixed.tar.gz 145722
 DIST dumb-0.9.3.tar.gz 167379 RMD160 53c7931fec71dd4e67e19c4acf38c0f9202e5698 SHA1 4764bd59f5895eb5035a5139454cef7a53a76bb8 SHA256 8d44fbc9e57f3bac9f761c3b12ce102d47d717f0dd846657fb988e0bb5d1ea33
 EBUILD dumb-0.9.2-r2.ebuild 1906 RMD160 0089ce4c0ffdf9e71804d04c1041b824f3c85aeb SHA1 b8fc91e2d2338f7ec73b9526b4f82006c36fc3c0 SHA256 d22e98bc37172bb43e8fe02c5e040fe0f5a626b5af3202ce4578e5c7abbadd7d
@@ -12,14 +16,18 @@ EBUILD dumb-0.9.2-r3.ebuild 1920 RMD160 fd3293ef199e372c9df9deea54fe4b169187f683
 MD5 8d922c145adf6c23d4b07457e05c8146 dumb-0.9.2-r3.ebuild 1920
 RMD160 fd3293ef199e372c9df9deea54fe4b169187f683 dumb-0.9.2-r3.ebuild 1920
 SHA256 482f1b2c8d9ebc6fb607972af28d70ba240549c7f06413feb7f71f5d3ab7e8c6 dumb-0.9.2-r3.ebuild 1920
-EBUILD dumb-0.9.3.ebuild 1983 RMD160 24fa81a1d02de6cfc0f00170921579c58d61c835 SHA1 585f49e061944812624898db536b1f7629d70104 SHA256 83ac8a58782bdbe27ec64442340d0fa9721281a86472c9f875eb5b7943c54226
-MD5 ac3c0470a73ef8e29e672b305df6b49c dumb-0.9.3.ebuild 1983
-RMD160 24fa81a1d02de6cfc0f00170921579c58d61c835 dumb-0.9.3.ebuild 1983
-SHA256 83ac8a58782bdbe27ec64442340d0fa9721281a86472c9f875eb5b7943c54226 dumb-0.9.3.ebuild 1983
-MISC ChangeLog 3280 RMD160 c6e17550b1e0cf1ffb2ebd0c1f10485abb62a45b SHA1 54856365ea265bae12a6212fc5d15e2a7cfcbc8e SHA256 a3fd3d3a662540e827ac2e76c125f22eba72f6b3772b2abd250cdd957335f540
-MD5 0936d9679c876c19da4e2e005696b3d1 ChangeLog 3280
-RMD160 c6e17550b1e0cf1ffb2ebd0c1f10485abb62a45b ChangeLog 3280
-SHA256 a3fd3d3a662540e827ac2e76c125f22eba72f6b3772b2abd250cdd957335f540 ChangeLog 3280
+EBUILD dumb-0.9.3-r1.ebuild 2033 RMD160 ea6ee22fe2160bce5dbeb792bba63a2b4de05c4e SHA1 dc7accbfff3fe5b9de61d7a7762eccf04eba9d5b SHA256 32a81a27c1423cd6ced6bd5f6477ad1dc986cb7af3fa71b9d20428569ce50b8b
+MD5 e4ce9607a6048590e96dabb4e185c5e9 dumb-0.9.3-r1.ebuild 2033
+RMD160 ea6ee22fe2160bce5dbeb792bba63a2b4de05c4e dumb-0.9.3-r1.ebuild 2033
+SHA256 32a81a27c1423cd6ced6bd5f6477ad1dc986cb7af3fa71b9d20428569ce50b8b dumb-0.9.3-r1.ebuild 2033
+EBUILD dumb-0.9.3.ebuild 1990 RMD160 ea91788b504583abb6085daa8fbdd55f44d4ec16 SHA1 98627353f57a57ad2fa50563d4d37d4cb4532515 SHA256 31b058bce8d5dbf2451da9fa114f203a7084b94932af04d557a601d32af345c2
+MD5 75189492049128819fd2d33c80ef76e5 dumb-0.9.3.ebuild 1990
+RMD160 ea91788b504583abb6085daa8fbdd55f44d4ec16 dumb-0.9.3.ebuild 1990
+SHA256 31b058bce8d5dbf2451da9fa114f203a7084b94932af04d557a601d32af345c2 dumb-0.9.3.ebuild 1990
+MISC ChangeLog 3486 RMD160 2f4b2c450af7589fbbe86cf5b0532e1d89065fda SHA1 526b7e3f76eefa60692bf3bd132388bb553c81f8 SHA256 38c459950fe174eff00a1ca59aa857bc675963830b4310afac7b8ab39521fcf7
+MD5 8b7199d69db0ec891efa6cb4e2ba7305 ChangeLog 3486
+RMD160 2f4b2c450af7589fbbe86cf5b0532e1d89065fda ChangeLog 3486
+SHA256 38c459950fe174eff00a1ca59aa857bc675963830b4310afac7b8ab39521fcf7 ChangeLog 3486
 MISC metadata.xml 251 RMD160 57bef9027e07a80633e99023903f4de9332f52d4 SHA1 da26e36e44561eb0d30b22bf6787705ae5c3d4b3 SHA256 c6bc54aeb1244159055765e01a1d89c4bf47fa956a3e065de5f4d4b7b24a6753
 MD5 19526790f2a5b32ab58a25bc2a57a5f7 metadata.xml 251
 RMD160 57bef9027e07a80633e99023903f4de9332f52d4 metadata.xml 251
@@ -33,3 +41,6 @@ SHA256 ff2100214d9af4414a2f6949aefd83c6a3a1a6f56bb3e1fede0a7e9748fcc819 files/di
 MD5 ad45d8d84916429b8d79a4d0629428ca files/digest-dumb-0.9.3 232
 RMD160 b5ff69992752d86b5179e796ec53e9d6645569ad files/digest-dumb-0.9.3 232
 SHA256 b538cb3ba647a4fe787431819d852f8fe4465c87f85e7aed61d3d0664719b6a2 files/digest-dumb-0.9.3 232
+MD5 ad45d8d84916429b8d79a4d0629428ca files/digest-dumb-0.9.3-r1 232
+RMD160 b5ff69992752d86b5179e796ec53e9d6645569ad files/digest-dumb-0.9.3-r1 232
+SHA256 b538cb3ba647a4fe787431819d852f8fe4465c87f85e7aed61d3d0664719b6a2 files/digest-dumb-0.9.3-r1 232
diff --git a/media-libs/dumb/dumb-0.9.3-r1.ebuild b/media-libs/dumb/dumb-0.9.3-r1.ebuild
new file mode 100644
index 000000000000..a6837e50facf
--- /dev/null
+++ b/media-libs/dumb/dumb-0.9.3-r1.ebuild
@@ -0,0 +1,67 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3-r1.ebuild,v 1.1 2006/08/03 15:44:19 joker Exp $
+
+IUSE="debug"
+
+inherit eutils
+
+DESCRIPTION="IT/XM/S3M/MOD player library with click removal and IT filters"
+HOMEPAGE="http://dumb.sourceforge.net/"
+SRC_URI="mirror://sourceforge/dumb/${P}.tar.gz"
+
+KEYWORDS="alpha amd64 ia64 ppc sparc x86"
+LICENSE="DUMB-0.9.2"
+SLOT="0"
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	cat << EOF > make/config.txt
+include make/unix.inc
+ALL_TARGETS := core core-examples core-headers
+PREFIX := /usr
+EOF
+
+	epatch "${FILESDIR}"/${PN}-0.9.2-PIC.patch
+	epatch "${FILESDIR}"/${P}_CVE-2006-3668.patch
+	sed -i '/= -s/d' Makefile || die "sed failed"
+	cp Makefile Makefile.rdy
+}
+
+src_compile() {
+	emake OFLAGS="${CFLAGS}" all || die "emake failed"
+}
+
+src_install() {
+	dobin examples/{dumbout,dumb2wav}
+	dolib.so lib/unix/libdumb.so
+
+	use debug && dolib.so lib/unix/libdumbd.so
+
+	insinto /usr/include
+	doins include/dumb.h
+
+	dodoc readme.txt release.txt docs/* || die "dodoc failed"
+}
+
+pkg_postinst() {
+	einfo
+	einfo "DUMB's core has been installed. This will enable you to convert module"
+	einfo "files to PCM data (ready for sending to /dev/dsp, writing to a .wav"
+	einfo "file, piping through oggenc, etc.)."
+	einfo
+	einfo "If you are using Allegro, you will also want to 'emerge aldumb'. This"
+	einfo "provides you with a convenient API for playing module files through"
+	einfo "Allegro's sound system, and also enables DUMB to integrate with"
+	einfo "Allegro's datafile system so you can add modules to datafiles."
+	einfo
+	einfo "As a developer, when you distribute your game and write your docs, be"
+	einfo "aware that 'dumb' and 'aldumb' actually come from the same download."
+	einfo "People who don't use Gentoo will only have to download and install one"
+	einfo "package. See /usr/share/doc/${PF}/readme.txt.gz for details on"
+	einfo "how DUMB would be compiled manually."
+	einfo
+}
diff --git a/media-libs/dumb/dumb-0.9.3.ebuild b/media-libs/dumb/dumb-0.9.3.ebuild
index d756d1df3d9a..ff0cb37e2681 100644
--- a/media-libs/dumb/dumb-0.9.3.ebuild
+++ b/media-libs/dumb/dumb-0.9.3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2006 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3.ebuild,v 1.9 2006/07/22 15:54:47 tcort Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3.ebuild,v 1.10 2006/08/03 15:44:19 joker Exp $
 
 IUSE="debug"
 
@@ -10,7 +10,7 @@ DESCRIPTION="IT/XM/S3M/MOD player library with click removal and IT filters"
 HOMEPAGE="http://dumb.sourceforge.net/"
 SRC_URI="mirror://sourceforge/dumb/${P}.tar.gz"
 
-KEYWORDS="alpha amd64 ia64 ppc sparc x86"
+KEYWORDS="~alpha ~amd64 ~ia64 ~ppc ~sparc ~x86"
 LICENSE="DUMB-0.9.2"
 SLOT="0"
 
diff --git a/media-libs/dumb/files/digest-dumb-0.9.3-r1 b/media-libs/dumb/files/digest-dumb-0.9.3-r1
new file mode 100644
index 000000000000..803226265cb8
--- /dev/null
+++ b/media-libs/dumb/files/digest-dumb-0.9.3-r1
@@ -0,0 +1,3 @@
+MD5 f48da5b990aa8aa822d3b6a951baf5c2 dumb-0.9.3.tar.gz 167379
+RMD160 53c7931fec71dd4e67e19c4acf38c0f9202e5698 dumb-0.9.3.tar.gz 167379
+SHA256 8d44fbc9e57f3bac9f761c3b12ce102d47d717f0dd846657fb988e0bb5d1ea33 dumb-0.9.3.tar.gz 167379
diff --git a/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch b/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch
new file mode 100644
index 000000000000..09d2fb68f4cb
--- /dev/null
+++ b/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch
@@ -0,0 +1,16 @@
+Index: libdumb-0.9.3/src/it/itread.c
+===================================================================
+--- libdumb-0.9.3.orig/src/it/itread.c	2006-07-21 11:05:48.000000000 +0200
++++ libdumb-0.9.3/src/it/itread.c	2006-07-21 11:07:22.000000000 +0200
+@@ -292,6 +292,11 @@
+ 
+ 	envelope->flags = dumbfile_getc(f);
+ 	envelope->n_nodes = dumbfile_getc(f);
++	if(envelope->n_nodes > 25) {
++		TRACE("IT error: wrong number of envelope nodes (%d)\n", envelope->n_nodes);
++		envelope->n_nodes = 0;
++		return -1;
++	}
+ 	envelope->loop_start = dumbfile_getc(f);
+ 	envelope->loop_end = dumbfile_getc(f);
+ 	envelope->sus_loop_start = dumbfile_getc(f);