dev-libs/libcroco: revbump for security fixes (CVE-2017-7960, CVE-2017-7961)

Gentoo-bug: 618012
Package-Manager: Portage-2.3.5, Repoman-2.3.2

3 files changed, 141 insertions, 0 deletions

diff --git a/dev-libs/libcroco/files/0.6.12-CVE-2017-7960.patch b/dev-libs/libcroco/files/0.6.12-CVE-2017-7960.patch
new file mode 100644
index 000000000000..50095d50b898
--- /dev/null
+++ b/dev-libs/libcroco/files/0.6.12-CVE-2017-7960.patch
@@ -0,0 +1,40 @@
+From 898e3a8c8c0314d2e6b106809a8e3e93cf9d4394 Mon Sep 17 00:00:00 2001
+From: Ignacio Casal Quinteiro
+Date: Sun, 16 Apr 2017 13:13:43 +0200
+Subject: [PATCH 1/3] input: check end of input before reading a byte
+
+When reading bytes we weren't check that the index wasn't
+out of bound and this could produce an invalid read which
+could deal to a security bug.
+---
+leio: Snipped cosmetic chunks
+
+diff --git a/src/cr-input.c b/src/cr-input.c
+index 49000b1..3b63a88 100644
+--- a/src/cr-input.c
++++ b/src/cr-input.c
+@@ -404,6 +404,8 @@ cr_input_get_nb_bytes_left (CRInput const * a_this)
+ enum CRStatus
+ cr_input_read_byte (CRInput * a_this, guchar * a_byte)
+ {
++        gulong nb_bytes_left = 0;
++
+         g_return_val_if_fail (a_this && PRIVATE (a_this)
+                               && a_byte, CR_BAD_PARAM_ERROR);
+ 
+@@ -413,6 +415,12 @@ cr_input_read_byte (CRInput * a_this, guchar * a_byte)
+         if (PRIVATE (a_this)->end_of_input == TRUE)
+                 return CR_END_OF_INPUT_ERROR;
+ 
++        nb_bytes_left = cr_input_get_nb_bytes_left (a_this);
++
++        if (nb_bytes_left < 1) {
++                return CR_END_OF_INPUT_ERROR;
++        }
++
+         *a_byte = PRIVATE (a_this)->in_buf[PRIVATE (a_this)->next_byte_index];
+ 
+         if (PRIVATE (a_this)->nb_bytes -
+-- 
+2.10.1
+
diff --git a/dev-libs/libcroco/files/0.6.12-CVE-2017-7961.patch b/dev-libs/libcroco/files/0.6.12-CVE-2017-7961.patch
new file mode 100644
index 000000000000..65a08f4ebabc
--- /dev/null
+++ b/dev-libs/libcroco/files/0.6.12-CVE-2017-7961.patch
@@ -0,0 +1,42 @@
+From 9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Mon Sep 17 00:00:00 2001
+From: Ignacio Casal Quinteiro <qignacio@amazon.com>
+Date: Sun, 16 Apr 2017 13:56:09 +0200
+Subject: [PATCH 3/3] tknzr: support only max long rgb values
+
+This fixes a possible out of bound when reading rgbs which
+are longer than the support MAXLONG
+---
+ src/cr-tknzr.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/cr-tknzr.c b/src/cr-tknzr.c
+index 1a7cfeb..1548c35 100644
+--- a/src/cr-tknzr.c
++++ b/src/cr-tknzr.c
+@@ -1279,6 +1279,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
+         status = cr_tknzr_parse_num (a_this, &num);
+         ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
+ 
++        if (num->val > G_MAXLONG) {
++                status = CR_PARSING_ERROR;
++                goto error;
++        }
++
+         red = num->val;
+         cr_num_destroy (num);
+         num = NULL;
+@@ -1298,6 +1303,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
+                 status = cr_tknzr_parse_num (a_this, &num);
+                 ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
+ 
++                if (num->val > G_MAXLONG) {
++                        status = CR_PARSING_ERROR;
++                        goto error;
++                }
++
+                 PEEK_BYTE (a_this, 1, &next_bytes[0]);
+                 if (next_bytes[0] == '%') {
+                         SKIP_CHARS (a_this, 1);
+-- 
+2.10.1
+
diff --git a/dev-libs/libcroco/libcroco-0.6.12-r1.ebuild b/dev-libs/libcroco/libcroco-0.6.12-r1.ebuild
new file mode 100644
index 000000000000..4d6b093b70a7
--- /dev/null
+++ b/dev-libs/libcroco/libcroco-0.6.12-r1.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+GNOME2_LA_PUNT="yes"
+
+inherit gnome2 multilib-minimal
+
+DESCRIPTION="Generic Cascading Style Sheet (CSS) parsing and manipulation toolkit"
+HOMEPAGE="https://git.gnome.org/browse/libcroco/"
+
+LICENSE="LGPL-2"
+SLOT="0.6"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="test"
+
+RDEPEND="
+	>=dev-libs/glib-2.34.3:2[${MULTILIB_USEDEP}]
+	>=dev-libs/libxml2-2.9.1-r4[${MULTILIB_USEDEP}]
+"
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc-am
+	>=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PV}-CVE-2017-7960.patch
+	"${FILESDIR}"/${PV}-CVE-2017-7961.patch
+)
+
+src_prepare() {
+	if ! use test; then
+		# don't waste time building tests
+		sed 's/^\(SUBDIRS .*\=.*\)tests\(.*\)$/\1\2/' -i Makefile.am Makefile.in \
+			|| die "sed failed"
+	fi
+
+	gnome2_src_prepare
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	gnome2_src_configure \
+		--disable-static \
+		$([[ ${CHOST} == *-darwin* ]] && echo --disable-Bsymbolic)
+
+	if multilib_is_native_abi; then
+		ln -s "${S}"/docs/reference/html docs/reference/html || die
+	fi
+}
+
+multilib_src_install() {
+	gnome2_src_install
+}
+
+multilib_src_install_all() {
+	DOCS="AUTHORS ChangeLog HACKING NEWS README TODO"
+	einstalldocs
+}