Corrected my last change. The original patch for CVE-2006-4810 was

correct, only the pkgsrc version somehow managed to get wrong.

PKGREVISION++

3 files changed, 11 insertions, 31 deletions

diff --git a/devel/gtexinfo/Makefile b/devel/gtexinfo/Makefile
index a30a5e68cf1..73388444959 100644
--- a/devel/gtexinfo/Makefile
+++ b/devel/gtexinfo/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.66 2006/11/18 15:49:02 adrianp Exp $
+# $NetBSD: Makefile,v 1.67 2007/01/08 08:50:51 rillig Exp $
 
 DISTNAME=		texinfo-4.8
 PKGNAME=		g${DISTNAME}
-PKGREVISION=		6
+PKGREVISION=		7
 CATEGORIES=		devel sysutils
 MASTER_SITES=		${MASTER_SITE_GNU:=texinfo/}
 EXTRACT_SUFX=		.tar.bz2
diff --git a/devel/gtexinfo/distinfo b/devel/gtexinfo/distinfo
index a6d439501ba..fea44f6fa8a 100644
--- a/devel/gtexinfo/distinfo
+++ b/devel/gtexinfo/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.26 2007/01/08 08:21:47 rillig Exp $
+$NetBSD: distinfo,v 1.27 2007/01/08 08:50:51 rillig Exp $
 
 SHA1 (texinfo-4.8.tar.bz2) = b19e906f7220294c1e8b087d583c50f5c4d7c420
 RMD160 (texinfo-4.8.tar.bz2) = 5cb82cd240d1f22da813c7142df8828b4f6f1ea4
@@ -10,4 +10,4 @@ SHA1 (patch-ac) = 01baf8634edcecab0b5edaeddf1e38811cab490d
 SHA1 (patch-ad) = c5c3374322eb8a2c8dfc7871971b73194ab1b14c
 SHA1 (patch-aj) = d9071c62c993550d253c9e1889880d4fccf7d278
 SHA1 (patch-ak) = 2cef2ae464ddb5324acae000420017d4faf7b145
-SHA1 (patch-al) = 5cc3cb9b11ffea22be157bf5d653a92df58f198c
+SHA1 (patch-al) = 5cbae19a93752d37eac70dee454af716b7b35a9c
diff --git a/devel/gtexinfo/patches/patch-al b/devel/gtexinfo/patches/patch-al
index 0936e41a04c..1e7f9955065 100644
--- a/devel/gtexinfo/patches/patch-al
+++ b/devel/gtexinfo/patches/patch-al
@@ -1,14 +1,9 @@
-$NetBSD: patch-al,v 1.4 2007/01/08 08:21:48 rillig Exp $
+$NetBSD: patch-al,v 1.5 2007/01/08 08:50:51 rillig Exp $
 
 Security fix for CAN-2005-3001 and CVE-2006-4810
 
-Note: The "official" patch for CVE-2006-4810 is wrong. The "fixed" code
-assigns a "long" to a "char *". Furthermore, the code was completely
-broken anyway. Maybe that's why it has been removed in the current CVS
-version.
-
 --- util/texindex.c.orig	2004-04-11 19:56:47.000000000 +0200
-+++ util/texindex.c	2007-01-08 09:02:20.000000000 +0100
++++ util/texindex.c	2007-01-08 09:41:42.000000000 +0100
 @@ -387,14 +387,15 @@ For more information about these matters
  /* Return a name for temporary file COUNT. */
  
@@ -52,31 +47,16 @@ version.
  }
  
  
-@@ -827,17 +835,19 @@ long
- readline (struct linebuffer *linebuffer, FILE *stream)
- {
-   char *buffer = linebuffer->buffer;
--  char *p = linebuffer->buffer;
--  char *end = p + linebuffer->size;
-+  char *p = buffer;
-+  char *end = buffer + linebuffer->size;
- 
-   while (1)
-     {
-+      /* invariant: buffer <= p && p <= end */
-+      /* invariant: buffer + linebuffer->size == end */
-+      /* invariant: buffer == linebuffer->buffer */
-       int c = getc (stream);
-       if (p == end)
+@@ -837,7 +845,7 @@ readline (struct linebuffer *linebuffer,
          {
            buffer = (char *) xrealloc (buffer, linebuffer->size *= 2);
--          p += buffer - linebuffer->buffer;
+           p += buffer - linebuffer->buffer;
 -          end += buffer - linebuffer->buffer;
 +          end = buffer + linebuffer->size;
            linebuffer->buffer = buffer;
          }
        if (c < 0 || c == '\n')
-@@ -882,7 +892,7 @@ sort_offline (char *infile, off_t total,
+@@ -882,7 +890,7 @@ sort_offline (char *infile, off_t total,
  
    for (i = 0; i < ntemps; i++)
      {
@@ -85,7 +65,7 @@ version.
        FILE *ostream = fopen (outname, "w");
        long tempsize = 0;
  
-@@ -930,7 +940,7 @@ fail:
+@@ -930,7 +938,7 @@ fail:
  
    for (i = 0; i < ntemps; i++)
      {
@@ -94,7 +74,7 @@ version.
        sort_in_core (tempfiles[i], MAX_IN_CORE_SORT, newtemp);
        if (!keep_tempfiles)
          unlink (tempfiles[i]);
-@@ -1400,7 +1410,7 @@ merge_files (char **infiles, int nfiles,
+@@ -1400,7 +1408,7 @@ merge_files (char **infiles, int nfiles,
        int nf = MAX_DIRECT_MERGE;
        if (i + 1 == ntemps)
          nf = nfiles - i * MAX_DIRECT_MERGE;