diff options
| author | snj <snj> | 2005-11-27 21:18:50 +0000 |
|---|---|---|
| committer | snj <snj> | 2005-11-27 21:18:50 +0000 |
| commit | 4a2d6abe0e061b4700f9beab35fe1e647048ec86 (patch) | |
| tree | 3e59e866f217c0a7f23e6e8d9e5bd4acabc9be61 | |
| parent | 6f89b53fec88e7a832eab6a4da3322f98feeaf82 (diff) | |
| download | pkgsrc-4a2d6abe0e061b4700f9beab35fe1e647048ec86.tar.gz | |
Pullup ticket 926 - requested by Lubomir Sedlacik
security fix for gtk2
Apply patch to fix two security issues in the bundled gdk-pixbuf library.
| -rw-r--r-- | x11/gtk2/Makefile | 3 | ||||
| -rw-r--r-- | x11/gtk2/distinfo | 3 | ||||
| -rw-r--r-- | x11/gtk2/patches/patch-ai | 27 |
3 files changed, 31 insertions, 2 deletions
diff --git a/x11/gtk2/Makefile b/x11/gtk2/Makefile index 1ea021d2919..9f45f26025e 100644 --- a/x11/gtk2/Makefile +++ b/x11/gtk2/Makefile @@ -1,8 +1,9 @@ -# $NetBSD: Makefile,v 1.93 2005/09/26 11:47:24 jmmv Exp $ +# $NetBSD: Makefile,v 1.93.2.1 2005/11/27 21:18:50 snj Exp $ # DISTNAME= gtk+-2.6.10 PKGNAME= ${DISTNAME:S/gtk/gtk2/} +PKGREVISION= 1 CATEGORIES= x11 MASTER_SITES= ftp://ftp.gtk.org/pub/gtk/v2.6/ \ ftp://ftp.cs.umn.edu/pub/gimp/gtk/v2.6/ \ diff --git a/x11/gtk2/distinfo b/x11/gtk2/distinfo index 6bd84921ed8..acf8adc79f6 100644 --- a/x11/gtk2/distinfo +++ b/x11/gtk2/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.50 2005/08/25 21:04:11 jmmv Exp $ +$NetBSD: distinfo,v 1.50.2.1 2005/11/27 21:18:50 snj Exp $ SHA1 (gtk+-2.6.10.tar.bz2) = 9ba627683e0dc4bceb5fb900c1ee687638d95fcd RMD160 (gtk+-2.6.10.tar.bz2) = 5bb2e4de406e0e6ccf5c66ec48f6ba3e5b0911ff @@ -11,3 +11,4 @@ SHA1 (patch-ae) = 1fdeeef405b2045f26335f0bb607e3c3d24b3ae6 SHA1 (patch-af) = 6797fd34be0a34368f6edede2321562678b112ff SHA1 (patch-ag) = dc4d72a39e426b880ca69ba8bc499fdaf42e0da8 SHA1 (patch-ah) = 486d6601d6dba04830a8645c6a5791755e6538d9 +SHA1 (patch-ai) = d38e23521afb800898e8db930ffdb5ce1f2da198 diff --git a/x11/gtk2/patches/patch-ai b/x11/gtk2/patches/patch-ai new file mode 100644 index 00000000000..925f2b8c768 --- /dev/null +++ b/x11/gtk2/patches/patch-ai @@ -0,0 +1,27 @@ +$NetBSD: patch-ai,v 1.10.2.1 2005/11/27 21:18:50 snj Exp $ + +Security fixes for CVE-2005-2975 and CVE-2005-3186. + +--- gdk-pixbuf/io-xpm.c.orig 2005-08-18 16:10:56.000000000 +0200 ++++ gdk-pixbuf/io-xpm.c 2005-11-26 09:46:35.000000000 +0100 +@@ -1167,7 +1167,8 @@ file_buffer (enum buf_op op, gpointer ha + /* Fall through to the xpm_read_string. */ + + case op_body: +- xpm_read_string (h->infile, &h->buffer, &h->buffer_size); ++ if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size)) ++ return NULL; + return h->buffer; + + default: +@@ -1262,7 +1263,9 @@ pixbuf_create_from_xpm (const gchar * (* + _("XPM has invalid number of chars per pixel")); + return NULL; + } +- if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) { ++ if (n_col <= 0 || ++ n_col >= G_MAXINT / (cpp + 1) || ++ n_col >= G_MAXINT / sizeof (XPMColor)) { + g_set_error (error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, |