summaryrefslogtreecommitdiff
path: root/editors
diff options
context:
space:
mode:
authorhauke <hauke@pkgsrc.org>2012-04-27 13:53:46 +0000
committerhauke <hauke@pkgsrc.org>2012-04-27 13:53:46 +0000
commitde900cd1645bfd6121ea125819180309ad1fdafc (patch)
tree3b6f94435085fc1600312f35d6d18f16970db189 /editors
parent99dc9c311a0077bf524317a8db2dfcc57e7dea15 (diff)
downloadpkgsrc-de900cd1645bfd6121ea125819180309ad1fdafc.tar.gz
Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>
Diffstat (limited to 'editors')
-rw-r--r--editors/xemacs/Makefile4
-rw-r--r--editors/xemacs/distinfo5
-rw-r--r--editors/xemacs/patches/patch-aj45
-rw-r--r--editors/xemacs/patches/patch-src_glyphs-eimage.c123
-rw-r--r--editors/xemacs/patches/patch-src_lisp.h18
5 files changed, 146 insertions, 49 deletions
diff --git a/editors/xemacs/Makefile b/editors/xemacs/Makefile
index 1950794f7ad..28b24f993ba 100644
--- a/editors/xemacs/Makefile
+++ b/editors/xemacs/Makefile
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.102 2012/04/25 11:56:42 hauke Exp $
+# $NetBSD: Makefile,v 1.103 2012/04/27 13:53:46 hauke Exp $
PKGNAME?= ${DISTNAME}
COMMENT?= XEmacs text editor version 21
DISTNAME= xemacs-21.4.22
-PKGREVISION= 6
+PKGREVISION= 7
CATEGORIES= editors
MASTER_SITES= ${MASTER_SITE_XEMACS:=${DISTNAME:C/[.][^.]*$//}/}
diff --git a/editors/xemacs/distinfo b/editors/xemacs/distinfo
index d519a4367ff..6e02c3bf307 100644
--- a/editors/xemacs/distinfo
+++ b/editors/xemacs/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2011/01/19 16:04:00 tnn Exp $
+$NetBSD: distinfo,v 1.17 2012/04/27 13:53:46 hauke Exp $
SHA1 (xemacs/xemacs-21.4.22.tar.gz) = 24ed9b13d80c53c06bba60c7bb68387f692b7373
RMD160 (xemacs/xemacs-21.4.22.tar.gz) = f7d71d3607c3301760df8f7ae5a93d1d37df56ba
@@ -12,6 +12,7 @@ SHA1 (patch-af) = 97cd3d340f349a645a7be9a683879528d9f4c5f2
SHA1 (patch-ag) = 0ccbead4be5da92e73a15432ff1b063da13cf0b4
SHA1 (patch-ah) = 9a02b989a6d45cdfead22ea703acceca722cf313
SHA1 (patch-ai) = ea752473a56d20907201763966ecdeaaeffac84a
-SHA1 (patch-aj) = 8e8eaaa0eece7a5ee09a7645ae05db35efa081bb
SHA1 (patch-ak) = bfbd285a1cc7d4e93a2fc884e03492dec9302e55
SHA1 (patch-al) = 247826009110453a868525e711e084b7dee49664
+SHA1 (patch-src_glyphs-eimage.c) = f013013d467d32dfac63287dd5a565153855a751
+SHA1 (patch-src_lisp.h) = 7b4c7984cfbfe1e3a30aac2009f777b8d95c013c
diff --git a/editors/xemacs/patches/patch-aj b/editors/xemacs/patches/patch-aj
deleted file mode 100644
index bf834c8e5b8..00000000000
--- a/editors/xemacs/patches/patch-aj
+++ /dev/null
@@ -1,45 +0,0 @@
-$NetBSD: patch-aj,v 1.3 2011/01/19 16:04:01 tnn Exp $
-
---- src/glyphs-eimage.c.orig 2007-08-20 19:52:28.000000000 +0000
-+++ src/glyphs-eimage.c
-@@ -937,8 +937,8 @@ png_instantiate (Lisp_Object image_insta
- {
- int y;
- unsigned char **row_pointers;
-- height = info_ptr->height;
-- width = info_ptr->width;
-+ height = png_get_image_height(png_ptr, info_ptr);
-+ width = png_get_image_width(png_ptr, info_ptr);
-
- /* Wow, allocate all the memory. Truly, exciting. */
- unwind.eimage = xnew_array_and_zero (unsigned char, width * height * 3);
-@@ -990,22 +990,22 @@ png_instantiate (Lisp_Object image_insta
- /* Now that we're using EImage, ask for 8bit RGB triples for any type
- of image*/
- /* convert palette images to full RGB */
-- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
-+ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_PALETTE)
- png_set_expand (png_ptr);
- /* send grayscale images to RGB too */
-- if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY ||
-- info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
-+ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY ||
-+ png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY_ALPHA)
- png_set_gray_to_rgb (png_ptr);
- /* we can't handle alpha values */
-- if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
-+ if (png_get_color_type(png_ptr, info_ptr) & PNG_COLOR_MASK_ALPHA)
- png_set_strip_alpha (png_ptr);
- /* tell libpng to strip 16 bit depth files down to 8 bits */
-- if (info_ptr->bit_depth == 16)
-+ if (png_get_bit_depth(png_ptr, info_ptr) == 16)
- png_set_strip_16 (png_ptr);
- /* if the image is < 8 bits, pad it out */
-- if (info_ptr->bit_depth < 8)
-+ if (png_get_bit_depth(png_ptr, info_ptr) < 8)
- {
-- if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY)
-+ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY)
- png_set_expand (png_ptr);
- else
- png_set_packing (png_ptr);
diff --git a/editors/xemacs/patches/patch-src_glyphs-eimage.c b/editors/xemacs/patches/patch-src_glyphs-eimage.c
new file mode 100644
index 00000000000..ae70f5acaba
--- /dev/null
+++ b/editors/xemacs/patches/patch-src_glyphs-eimage.c
@@ -0,0 +1,123 @@
+$NetBSD: patch-src_glyphs-eimage.c,v 1.1 2012/04/27 13:53:46 hauke Exp $
+
+Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>
+
+Adapt to new libpng 1.5 interfaces
+
+--- src/glyphs-eimage.c.orig 2007-08-20 19:52:28.000000000 +0000
++++ src/glyphs-eimage.c
+@@ -407,6 +407,7 @@ jpeg_instantiate (Lisp_Object image_inst
+ */
+
+ {
++ UINT_64_BIT pixels_sq;
+ int jpeg_gray = 0; /* if we're dealing with a grayscale */
+ /* Step 4: set parameters for decompression. */
+
+@@ -429,7 +430,10 @@ jpeg_instantiate (Lisp_Object image_inst
+ jpeg_start_decompress (&cinfo);
+
+ /* Step 6: Read in the data and put into EImage format (8bit RGB triples)*/
+-
++ pixels_sq =
++ (UINT_64_BIT) cinfo.output_width * (UINT_64_BIT) cinfo.output_height;
++ if (pixels_sq > ((size_t) -1) / 3)
++ signal_image_error ("JPEG image too large to instantiate", instantiator);
+ unwind.eimage = (unsigned char*) xmalloc (cinfo.output_width * cinfo.output_height * 3);
+ if (!unwind.eimage)
+ signal_image_error("Unable to allocate enough memory for image", instantiator);
+@@ -671,6 +675,7 @@ gif_instantiate (Lisp_Object image_insta
+ {
+ ColorMapObject *cmo = unwind.giffile->SColorMap;
+ int i, j, row, pass, interlace, slice;
++ UINT_64_BIT pixels_sq;
+ unsigned char *eip;
+ /* interlaced gifs have rows in this order:
+ 0, 8, 16, ..., 4, 12, 20, ..., 2, 6, 10, ..., 1, 3, 5, ... */
+@@ -679,6 +684,9 @@ gif_instantiate (Lisp_Object image_insta
+
+ height = unwind.giffile->SHeight;
+ width = unwind.giffile->SWidth;
++ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++ if (pixels_sq > ((size_t) -1) / (3 * unwind.giffile->ImageCount))
++ signal_image_error ("GIF image too large to instantiate", instantiator);
+ unwind.eimage = (unsigned char*)
+ xmalloc (width * height * 3 * unwind.giffile->ImageCount);
+ if (!unwind.eimage)
+@@ -937,11 +945,15 @@ png_instantiate (Lisp_Object image_insta
+ {
+ int y;
+ unsigned char **row_pointers;
+- height = info_ptr->height;
+- width = info_ptr->width;
+-
++ UINT_64_BIT pixels_sq;
++ height = png_get_image_height(png_ptr, info_ptr);
++ width = png_get_image_width(png_ptr, info_ptr);
++
++ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++ if (pixels_sq > ((size_t) -1) / 3)
++ signal_image_error ("PNG image too large to instantiate", instantiator);
+ /* Wow, allocate all the memory. Truly, exciting. */
+- unwind.eimage = xnew_array_and_zero (unsigned char, width * height * 3);
++ unwind.eimage = xnew_array_and_zero (unsigned char, pixels_sq * 3);
+ /* libpng expects that the image buffer passed in contains a
+ picture to draw on top of if the png has any transparencies.
+ This could be a good place to pass that in... */
+@@ -990,22 +1002,22 @@ png_instantiate (Lisp_Object image_insta
+ /* Now that we're using EImage, ask for 8bit RGB triples for any type
+ of image*/
+ /* convert palette images to full RGB */
+- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
++ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_PALETTE)
+ png_set_expand (png_ptr);
+ /* send grayscale images to RGB too */
+- if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY ||
+- info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
++ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY ||
++ png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY_ALPHA)
+ png_set_gray_to_rgb (png_ptr);
+ /* we can't handle alpha values */
+- if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
++ if (png_get_color_type(png_ptr, info_ptr) & PNG_COLOR_MASK_ALPHA)
+ png_set_strip_alpha (png_ptr);
+ /* tell libpng to strip 16 bit depth files down to 8 bits */
+- if (info_ptr->bit_depth == 16)
++ if (png_get_bit_depth(png_ptr, info_ptr) == 16)
+ png_set_strip_16 (png_ptr);
+ /* if the image is < 8 bits, pad it out */
+- if (info_ptr->bit_depth < 8)
++ if (png_get_bit_depth(png_ptr, info_ptr) < 8)
+ {
+- if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY)
++ if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY)
+ png_set_expand (png_ptr);
+ else
+ png_set_packing (png_ptr);
+@@ -1268,6 +1280,7 @@ tiff_instantiate (Lisp_Object image_inst
+
+ uint32 *raster;
+ unsigned char *ep;
++ UINT_64_BIT pixels_sq;
+
+ assert (!NILP (data));
+
+@@ -1290,12 +1303,16 @@ tiff_instantiate (Lisp_Object image_inst
+
+ TIFFGetField (unwind.tiff, TIFFTAG_IMAGEWIDTH, &width);
+ TIFFGetField (unwind.tiff, TIFFTAG_IMAGELENGTH, &height);
+- unwind.eimage = (unsigned char *) xmalloc (width * height * 3);
++ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++ if (pixels_sq >= 1 << 29)
++ signal_image_error ("TIFF image too large to instantiate", instantiator);
++ unwind.eimage = (unsigned char *) xmalloc (pixels_sq * 3);
++
+
+ /* #### This is little more than proof-of-concept/function testing.
+ It needs to be reimplemented via scanline reads for both memory
+ compactness. */
+- raster = (uint32*) _TIFFmalloc (width * height * sizeof (uint32));
++ raster = (uint32*) _TIFFmalloc ((tsize_t) (pixels_sq * sizeof (uint32)));
+ if (raster != NULL)
+ {
+ int i,j;
diff --git a/editors/xemacs/patches/patch-src_lisp.h b/editors/xemacs/patches/patch-src_lisp.h
new file mode 100644
index 00000000000..4e5482d8d76
--- /dev/null
+++ b/editors/xemacs/patches/patch-src_lisp.h
@@ -0,0 +1,18 @@
+$NetBSD: patch-src_lisp.h,v 1.1 2012/04/27 13:53:46 hauke Exp $
+
+Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>
+
+--- src/lisp.h.orig 2005-02-01 03:55:02.000000000 +0000
++++ src/lisp.h
+@@ -265,6 +265,11 @@ void assert_failed (const char *, int, c
+ /*#define REGISTER register*/
+ /*#endif*/
+
++#if SIZEOF_LONG == 8
++#define UINT_64_BIT unsigned long
++#elif SIZEOF_LONG_LONG == 8
++#define UINT_64_BIT unsigned long long
++#endif
+
+ /* EMACS_INT is the underlying integral type into which a Lisp_Object must fit.
+ In particular, it must be large enough to contain a pointer.