Add patch to resolve buffer overflow. Bug 329031.

Package-Manager: portage-2.2.0_alpha90/cvs/Linux x86_64

4 files changed, 94 insertions, 5 deletions

diff --git a/net-libs/libvncserver/ChangeLog b/net-libs/libvncserver/ChangeLog
index 1aa257538f02..cd6963757a3e 100644
--- a/net-libs/libvncserver/ChangeLog
+++ b/net-libs/libvncserver/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-libs/libvncserver
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/ChangeLog,v 1.50 2012/03/08 02:49:25 floppym Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/ChangeLog,v 1.51 2012/03/08 03:32:17 floppym Exp $
+
+*libvncserver-0.9.8.2-r1 (08 Mar 2012)
+
+  08 Mar 2012; Mike Gilbert <floppym@gentoo.org>
+  +files/libvncserver-memcpy.patch, +libvncserver-0.9.8.2-r1.ebuild:
+  Add patch to resolve buffer overflow. Bug 329031.
 
   08 Mar 2012; Mike Gilbert <floppym@gentoo.org> metadata.xml:
   Make myself the maintainer.
diff --git a/net-libs/libvncserver/Manifest b/net-libs/libvncserver/Manifest
index df9f6cfbbfe0..bd878d1426af 100644
--- a/net-libs/libvncserver/Manifest
+++ b/net-libs/libvncserver/Manifest
@@ -1,16 +1,18 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX libvncserver-memcpy.patch 819 RMD160 9730a2afe9472a15220ff33237a411fa482987d7 SHA1 93e49b11047197caa4d036b2a69e7570cc36474d SHA256 f371eb0ded83043df5625bf1ef18e40c2362579cef58cda1932922e85b8c111c
 DIST LibVNCServer-0.9.7.tar.gz 1105538 RMD160 50325d0827a0e65e9da91991011e2a1b05c491e2 SHA1 681b0f3d000ad8c18d3643e1148e1ae5052c8a9a SHA256 2adb60ebb64706df088418cfb01691d9c273040fc286618e021e51ac61a77571
 DIST LibVNCServer-0.9.8.2.tar.gz 1238439 RMD160 0dbb7bd53f0298be948a2b47a5f900eb6543102e SHA1 26995fd92fed9ddeecf40a4bdf0067fdae8c647c SHA256 2d243cd4b8d7f09a26b5d65e74375cedc85f3298621540a0724bde7e0fa1eaff
 EBUILD libvncserver-0.9.7.ebuild 1396 RMD160 aed1f63e4932f6f830b0b9dabeedd92b182a80cd SHA1 725a7e57b9e522d4594497876f3f936b2ae22174 SHA256 0596eb3dde3204cedfa0a5fdc836fdf9a99f2266cacd74c9c85f744515551a22
+EBUILD libvncserver-0.9.8.2-r1.ebuild 1463 RMD160 ce5462577f400403598a5eca2afcefa119c99611 SHA1 90531621c78ff58f3cc4fa23070abbfe2940d0ec SHA256 9fabb4ee445904d2d18dda98dc7ded2997c57d085d15faf534d1178c7d7adb3d
 EBUILD libvncserver-0.9.8.2.ebuild 1392 RMD160 e45829e5ba29d8177a3b074635559b9955bc6385 SHA1 442b1a28ad7b05b60c428a79e237c8f5558a7243 SHA256 06c6d9664f23cab9366898dd7c46d97354e25f655c9c557ab1547f5fb87b74ed
-MISC ChangeLog 6082 RMD160 5ca22777583d4141f2bd6b5f106353e33f4bcf97 SHA1 b21d68d4634f057b3984761141e6fe1a8430d474 SHA256 73b18d0d1a194c8c18af81f70313f8549613cd697ec925cb2a4989986a6f6a70
+MISC ChangeLog 6293 RMD160 791b68a7ff62ecd3c330b57e4def15645a8ecbbd SHA1 00643d9e56017c29fceb80703df06ee853a865c1 SHA256 da4ed48fc375a8a2a7c47952a57bf4efbec3b5f5a369aba55b9946bbe5a9fdaa
 MISC metadata.xml 757 RMD160 e805b4b210be0e9c4308d47c90f1c1aca11af4d6 SHA1 c2e85ef12289b24461200de35d63b9473ca31415 SHA256 f6415250b3799cf21be025b55b3e80643e99eaacdac4383cb31e7e42e5c02b03
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.17 (GNU/Linux)
 
-iF4EAREIAAYFAk9YHjoACgkQC77qH+pIQ6TW6gD+N3WZmcOYpkSffIyCFUhDz2k3
-CzqsmdTltfn/AQEq8iIA/it88upAfi2nqFNsLGch7HE/aHEFqD6QOHid6tVE+1i3
-=4N+S
+iF4EAREIAAYFAk9YKEcACgkQC77qH+pIQ6Q47AEAl6kxrdoAiWhms6QcUTyVLZgA
+Qi+iYY1geVqlK0Q/plUBAJd66zOyahTOY/sEWKYp1YIK/i8PNrFCkct0rHFZY18h
+=dql0
 -----END PGP SIGNATURE-----
diff --git a/net-libs/libvncserver/files/libvncserver-memcpy.patch b/net-libs/libvncserver/files/libvncserver-memcpy.patch
new file mode 100644
index 000000000000..af5289e68d21
--- /dev/null
+++ b/net-libs/libvncserver/files/libvncserver-memcpy.patch
@@ -0,0 +1,23 @@
+Fix a buffer overflow on platforms where sizeof(long) > sizeof(int).
+https://bugs.gentoo.org/show_bug.cgi?id=329031
+
+--- libvncserver/tightvnc-filetransfer/filetransfermsg.c
++++ libvncserver/tightvnc-filetransfer/filetransfermsg.c
+@@ -393,7 +393,7 @@
+ CreateFileDownloadZeroSizeDataMsg(unsigned long mTime)
+ {
+ 	FileTransferMsg fileDownloadZeroSizeDataMsg;
+-	int length = sz_rfbFileDownloadDataMsg + sizeof(int);
++	int length = sz_rfbFileDownloadDataMsg + sizeof(mTime);
+ 	rfbFileDownloadDataMsg *pFDD = NULL;
+ 	char *pFollow = NULL;
+ 	
+@@ -413,7 +413,7 @@
+ 	pFDD->compressedSize = Swap16IfLE(0);
+ 	pFDD->realSize = Swap16IfLE(0);
+ 	
+-	memcpy(pFollow, &mTime, sizeof(unsigned long));
++	memcpy(pFollow, &mTime, sizeof(mTime));
+ 
+ 	fileDownloadZeroSizeDataMsg.data	= pData;
+ 	fileDownloadZeroSizeDataMsg.length	= length;
diff --git a/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild b/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild
new file mode 100644
index 000000000000..635ba25ad8c7
--- /dev/null
+++ b/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild,v 1.1 2012/03/08 03:32:17 floppym Exp $
+
+EAPI="4"
+
+inherit eutils libtool
+
+DESCRIPTION="library for creating vnc servers"
+HOMEPAGE="http://libvncserver.sourceforge.net/"
+SRC_URI="http://libvncserver.sourceforge.net/LibVNCServer-${PV/_}.tar.gz
+	mirror://sourceforge/libvncserver/LibVNCServer-${PV/_}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd ~amd64-linux ~x86-linux"
+IUSE="no24bpp crypt gnutls ipv6 +jpeg test threads +zlib"
+
+DEPEND="crypt? ( dev-libs/libgcrypt )
+	gnutls? ( net-libs/gnutls )
+	jpeg? ( virtual/jpeg )
+	zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}"/LibVNCServer-${PV/_}
+
+src_prepare() {
+	sed -i -r \
+		-e '/^CFLAGS =/d' \
+		-e "/^SUBDIRS/s:\<($(use test || echo 'test|')client_examples|examples)\>::g" \
+		Makefile.in || die
+
+	# Bug 329031.
+	epatch "${FILESDIR}/${PN}-memcpy.patch"
+
+	elibtoolize
+}
+
+src_configure() {
+	econf \
+		--without-x11vnc \
+		$(use_with !no24bpp 24bpp) \
+		$(use_with crypt gcrypt) \
+		$(use_with ipv6) \
+		$(use_with jpeg) \
+		$(use_with threads pthread) \
+		$(use_with zlib)
+}
+
+src_compile() {
+	default
+	emake -C examples noinst_PROGRAMS=storepasswd
+}
+
+src_install() {
+	emake install DESTDIR="${D}"
+	dodoc AUTHORS ChangeLog NEWS README TODO
+}