* Add fix for CVE-2014-3421, CVE-2014-3422 and CVE-2014-3424 as emacs24.

* Add comments to some of patch files.

Bump PKGREVISION.

8 files changed, 242 insertions, 9 deletions

diff --git a/editors/emacs23/Makefile b/editors/emacs23/Makefile
index c6862970d0e..f09a548315e 100644
--- a/editors/emacs23/Makefile
+++ b/editors/emacs23/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.15 2014/05/31 15:56:26 wiz Exp $
+# $NetBSD: Makefile,v 1.16 2014/07/09 03:18:44 taca Exp $
 
 CONFLICTS+=	emacs23-nox11-[0-9]*
 
 .include "../../editors/emacs23/Makefile.common"
-PKGREVISION=	26
+PKGREVISION=	27
 
 .include "options.mk"
 
diff --git a/editors/emacs23/distinfo b/editors/emacs23/distinfo
index 44292a6089d..c1fb9ccf427 100644
--- a/editors/emacs23/distinfo
+++ b/editors/emacs23/distinfo
@@ -1,16 +1,19 @@
-$NetBSD: distinfo,v 1.3 2014/05/16 14:12:29 tron Exp $
+$NetBSD: distinfo,v 1.4 2014/07/09 03:18:44 taca Exp $
 
 SHA1 (emacs-23.4.tar.gz) = 0a78466fff52d1f43c0db0ea66651a0b13b7e473
 RMD160 (emacs-23.4.tar.gz) = 5fb7e4cd4270a524b8723ad86a145a0e47336bf7
 Size (emacs-23.4.tar.gz) = 47721193 bytes
-SHA1 (patch-aa) = 951c1d9fe90fbe2c2366ba230106f8d165068d50
+SHA1 (patch-aa) = 57c7f47843ee17a8761678b38701d6236108a6e0
 SHA1 (patch-ab) = d8b8cdaf3cc63be042a9972392740c5eccc06d49
 SHA1 (patch-ad) = e37f73048273801b8fd330d6897346b1f6e55fe9
 SHA1 (patch-ae) = 116394051b3e2f4220ff5a3de3402923857940b9
 SHA1 (patch-ag) = f462ad22762469360d90060afbc73e660e9f7db5
 SHA1 (patch-bf) = 9ff58581e7b9c865397729169fadd3baecc4a1e3
+SHA1 (patch-lisp_emacs-lisp_find-gc.el) = f6531e8c44789392527792e819ab3b23e53c4e60
 SHA1 (patch-lisp_files.el) = e10c6949029ca7933ea632693843a911b7e010c2
-SHA1 (patch-src_config.in) = c1f7b608dc49da704571a71f96067a0ffac01df9
+SHA1 (patch-lisp_gnus_gnus-fun.el) = a8ec0ffa065a40b3b5666aba567679b72e8c2d75
+SHA1 (patch-lisp_net_tramp.el) = f268a3dbf95ed5bec9162c4413a6aee53bee8d2b
+SHA1 (patch-src_config.in) = a4d1a718b7d560c5e55beaeb1a2eb214cad3b104
 SHA1 (patch-src_image.c) = 2712e1df3d5eac9e919163d47a2a331ac0bd0b9a
-SHA1 (patch-src_m_amdx86-64.h) = 0928f4e80c456e5b94a74cfeb3589e411a134507
+SHA1 (patch-src_m_amdx86-64.h) = fd4c791c7d9213381bc73294ef998297923d952b
 SHA1 (patch-src_xgselect.c) = 4a0b246eae2e43fc1e544210fc97c0170e3cffdc
diff --git a/editors/emacs23/patches/patch-aa b/editors/emacs23/patches/patch-aa
index 12db9e5aecc..c24b692bc37 100644
--- a/editors/emacs23/patches/patch-aa
+++ b/editors/emacs23/patches/patch-aa
@@ -1,4 +1,7 @@
-$NetBSD: patch-aa,v 1.1 2013/02/17 04:59:42 dholland Exp $
+$NetBSD: patch-aa,v 1.2 2014/07/09 03:18:44 taca Exp $
+
+* Add support for DragonFly.
+* Honor GAMEOWN.
 
 --- work/emacs-23.2/configure.in~	2010-05-08 12:09:12.000000000 +0900
 +++ ./configure.in	2010-05-12 20:23:07.000000000 +0900
diff --git a/editors/emacs23/patches/patch-lisp_emacs-lisp_find-gc.el b/editors/emacs23/patches/patch-lisp_emacs-lisp_find-gc.el
new file mode 100644
index 00000000000..97a7c24ff7f
--- /dev/null
+++ b/editors/emacs23/patches/patch-lisp_emacs-lisp_find-gc.el
@@ -0,0 +1,120 @@
+$NetBSD: patch-lisp_emacs-lisp_find-gc.el,v 1.1 2014/07/09 03:18:44 taca Exp $
+
+Fix for CVE-2014-3422.
+
+--- lisp/emacs-lisp/find-gc.el.orig	2012-01-11 12:35:01.000000000 +0000
++++ lisp/emacs-lisp/find-gc.el
+@@ -24,14 +24,15 @@
+ 
+ ;; Produce in find-gc-unsafe-list the set of all functions that may invoke GC.
+ ;; This expects the Emacs sources to live in find-gc-source-directory.
+-;; It creates a temporary working directory /tmp/esrc.
+ 
+ ;;; Code:
+ 
+ (defvar find-gc-unsafe-list nil
+   "The list of unsafe functions is placed here by `find-gc-unsafe'.")
+ 
+-(defvar find-gc-source-directory)
++(defvar find-gc-source-directory
++  (file-name-as-directory (expand-file-name "src" source-directory))
++  "Directory containing Emacs C sources.")
+ 
+ (defvar find-gc-subrs-callers nil
+   "Alist of users of subrs, from GC testing.
+@@ -60,14 +61,14 @@ Each entry has the form (FUNCTION . FUNC
+     "indent.c" "search.c" "regex.c" "undo.c"
+     "alloc.c" "data.c" "doc.c" "editfns.c"
+     "callint.c" "eval.c" "fns.c" "print.c" "lread.c"
+-    "abbrev.c" "syntax.c" "unexec.c"
++    "syntax.c" "unexec.c"
+     "bytecode.c" "process.c" "callproc.c" "doprnt.c"
+-    "x11term.c" "x11fns.c"))
++    "xterm.c" "xfns.c"))
+ 
+ 
+ (defun find-gc-unsafe ()
+   "Return a list of unsafe functions--that is, which can call GC.
+-Also store it in `find-gc-unsafe'."
++Also store it in `find-gc-unsafe-list'."
+   (trace-call-tree nil)
+   (trace-use-tree)
+   (find-unsafe-funcs 'Fgarbage_collect)
+@@ -103,47 +104,38 @@ Also store it in `find-gc-unsafe'."
+ 
+ 
+ 
+-(defun trace-call-tree (&optional already-setup)
++(defun trace-call-tree (&optional ignored)
+   (message "Setting up directories...")
+-  (or already-setup
+-      (progn
+-	;; Gee, wouldn't a built-in "system" function be handy here.
+-	(call-process "csh" nil nil nil "-c" "rm -rf /tmp/esrc")
+-	(call-process "csh" nil nil nil "-c" "mkdir /tmp/esrc")
+-	(call-process "csh" nil nil nil "-c"
+-		      (format "ln -s %s/*.[ch] /tmp/esrc"
+-			      find-gc-source-directory))))
+-  (with-current-buffer (get-buffer-create "*Trace Call Tree*")
+-    (setq find-gc-subrs-called nil)
+-    (let ((case-fold-search nil)
+-	  (files find-gc-source-files)
+-	  name entry)
+-      (while files
+-	(message "Compiling %s..." (car files))
+-	(call-process "csh" nil nil nil "-c"
+-		      (format "gcc -dr -c /tmp/esrc/%s -o /dev/null"
+-			      (car files)))
+-	(erase-buffer)
+-	(insert-file-contents (concat "/tmp/esrc/" (car files) ".rtl"))
+-	(while (re-search-forward ";; Function \\|(call_insn " nil t)
+-	  (if (= (char-after (- (point) 3)) ?o)
+-	      (progn
+-		(looking-at "[a-zA-Z0-9_]+")
+-		(setq name (intern (buffer-substring (match-beginning 0)
+-						     (match-end 0))))
+-		(message "%s : %s" (car files) name)
+-		(setq entry (list name)
+-		      find-gc-subrs-called (cons entry find-gc-subrs-called)))
+-	    (if (looking-at ".*\n?.*\"\\([A-Za-z0-9_]+\\)\"")
++  (setq find-gc-subrs-called nil)
++  (let ((case-fold-search nil)
++	(default-directory find-gc-source-directory)
++	(files find-gc-source-files)
++	name entry rtlfile)
++    (dolist (file files)
++      (message "Compiling %s..." file)
++      (call-process "gcc" nil nil nil "-I" "." "-I" "../lib"
++		    "-fdump-rtl-expand" "-o" null-device "-c" file)
++      (setq rtlfile
++	    (file-expand-wildcards (format "%s.*.expand" file) t))
++      (if (/= 1 (length rtlfile))
++	  (message "Error compiling `%s'?" file)
++	(with-temp-buffer
++	  (insert-file-contents (setq rtlfile (car rtlfile)))
++	  (delete-file rtlfile)
++	  (while (re-search-forward ";; Function \\|(call_insn " nil t)
++	    (if (= (char-after (- (point) 3)) ?o)
+ 		(progn
+-		  (setq name (intern (buffer-substring (match-beginning 1)
+-						       (match-end 1))))
+-		  (or (memq name (cdr entry))
+-		      (setcdr entry (cons name (cdr entry))))))))
+-	(delete-file (concat "/tmp/esrc/" (car files) ".rtl"))
+-	(setq files (cdr files)))))
+-)
+-
++		  (looking-at "[a-zA-Z0-9_]+")
++		  (setq name (intern (match-string 0)))
++		  (message "%s : %s" (car files) name)
++		  (setq entry (list name)
++			find-gc-subrs-called
++			(cons entry find-gc-subrs-called)))
++	      (if (looking-at ".*\n?.*\"\\([A-Za-z0-9_]+\\)\"")
++		  (progn
++		    (setq name (intern (match-string 1)))
++		    (or (memq name (cdr entry))
++			(setcdr entry (cons name (cdr entry)))))))))))))
+ 
+ (defun trace-use-tree ()
+   (setq find-gc-subrs-callers (mapcar 'list (mapcar 'car find-gc-subrs-called)))
diff --git a/editors/emacs23/patches/patch-lisp_gnus_gnus-fun.el b/editors/emacs23/patches/patch-lisp_gnus_gnus-fun.el
new file mode 100644
index 00000000000..3ef1f1b07dc
--- /dev/null
+++ b/editors/emacs23/patches/patch-lisp_gnus_gnus-fun.el
@@ -0,0 +1,32 @@
+$NetBSD: patch-lisp_gnus_gnus-fun.el,v 1.1 2014/07/09 03:18:44 taca Exp $
+
+Fix for CVE-2014-3421.
+
+--- lisp/gnus/gnus-fun.el.orig	2012-01-11 12:35:01.000000000 +0000
++++ lisp/gnus/gnus-fun.el
+@@ -261,19 +261,21 @@ colors of the displayed X-Faces."
+   (shell-command "xawtv-remote snap ppm")
+   (let ((file nil)
+ 	result)
++    (tempfile (make-temp-file "gnus-face-" nil ".ppm"))
+     (while (null (setq file (directory-files "/tftpboot/sparky/tmp"
+ 					     t "snap.*ppm")))
+       (sleep-for 1))
+     (setq file (car file))
+     (shell-command
+-     (format "pnmcut -left 110 -top 30 -width 144 -height 144 '%s' | pnmscale -width 48 -height 48 | ppmtopgm > /tmp/gnus.face.ppm"
+-	     file))
++     (format "pnmcut -left 110 -top 30 -width 144 -height 144 '%s' | pnmscale 
++-width 48 -height 48 | ppmtopgm >> %s"
++	     file tempfile))
+     (let ((gnus-convert-image-to-face-command
+ 	   (format "cat '%%s' | ppmquant %%d | ppmchange %s | pnmtopng"
+ 		   (gnus-fun-ppm-change-string))))
+-      (setq result (gnus-face-from-file "/tmp/gnus.face.ppm")))
++      (setq result (gnus-face-from-file tempfile)))
+     (delete-file file)
+-    ;;(delete-file "/tmp/gnus.face.ppm")
++    ;;(delete-file tempfile)    ; FIXME why are we not deleting it?!
+     result))
+ 
+ (defun gnus-fun-ppm-change-string ()
diff --git a/editors/emacs23/patches/patch-lisp_net_tramp.el b/editors/emacs23/patches/patch-lisp_net_tramp.el
new file mode 100644
index 00000000000..6b255b93932
--- /dev/null
+++ b/editors/emacs23/patches/patch-lisp_net_tramp.el
@@ -0,0 +1,71 @@
+$NetBSD$
+
+Fix for CVE-2014-3424.
+
+--- lisp/net/tramp.el.orig	2012-01-11 12:35:01.000000000 +0000
++++ lisp/net/tramp.el
+@@ -1687,9 +1687,9 @@ means to use always cached values for th
+   "Remote host for this *tramp* buffer.")
+ 
+ (defconst tramp-uudecode
+-  "(echo begin 600 /tmp/tramp.$$; tail +2) | uudecode
+-cat /tmp/tramp.$$
+-rm -f /tmp/tramp.$$"
++  "(echo begin 600 %t; tail -n +2) | uudecode
++cat %t
++rm -f %t"
+   "Shell function to implement `uudecode' to standard output.
+ Many systems support `uudecode -o /dev/stdout' or `uudecode -o -'
+ for this or `uudecode -p', but some systems don't, and for them
+@@ -7173,7 +7173,7 @@ Each item is a list that looks like this
+ 
+ \(FORMAT ENCODING DECODING\)
+ 
+-FORMAT is  symbol describing the encoding/decoding format.  It can be
++FORMAT is a symbol describing the encoding/decoding format.  It can be
+ `b64' for base64 encoding, `uu' for uu encoding, or `pack' for simple packing.
+ 
+ ENCODING and DECODING can be strings, giving commands, or symbols,
+@@ -7220,9 +7220,11 @@ filename will be put into the command li
+ specifier is not present, the input should be read from standard
+ input.
+ 
+-If they are variables, this variable is a string containing a Perl
+-implementation for this functionality.  This Perl program will be transferred
+-to the remote host, and it is available as shell function with the same name.")
++If they are variables, this variable is a string containing a
++Perl or Shell implementation for this functionality.  This
++program will be transferred to the remote host, and it is
++available as shell function with the same name.  A \"%t\" format
++specifier in the variable value denotes a temporary file.
+ 
+ (defun tramp-find-inline-encoding (vec)
+   "Find an inline transfer encoding that works.
+@@ -7286,10 +7288,25 @@ Goes through the list `tramp-local-codin
+ 		    (throw 'wont-work-remote nil))
+ 
+ 		  (when (not (stringp rem-dec))
+-		    (let ((name (symbol-name rem-dec)))
++		    (let ((name (symbol-name rem-dec))
++			  (value (symbol-value rem-dec))
++			  tmpfile)
+ 		      (while (string-match (regexp-quote "-") name)
+ 			(setq name (replace-match "_" nil t name)))
+-		      (tramp-maybe-send-script vec (symbol-value rem-dec) name)
++		      (when (string-match "%t" value)
++			(setq tmpfile
++			      (make-temp-name
++			       (expand-file-name
++				tramp-temp-name-prefix
++				(tramp-get-remote-tmpdir vec)))
++			      value
++			      (format-spec
++			       value
++			       (format-spec-make
++				?t
++				(tramp-file-name-handler
++				 'file-remote-p tmpfile 'localname)))))
++		      (tramp-maybe-send-script vec value name)
+ 		      (setq rem-dec name)))
+ 		  (tramp-message
+ 		   vec 5
diff --git a/editors/emacs23/patches/patch-src_config.in b/editors/emacs23/patches/patch-src_config.in
index 764ad2e96e1..8f83adb9e4b 100644
--- a/editors/emacs23/patches/patch-src_config.in
+++ b/editors/emacs23/patches/patch-src_config.in
@@ -1,4 +1,6 @@
-$NetBSD: patch-src_config.in,v 1.1 2013/02/17 04:59:43 dholland Exp $
+$NetBSD: patch-src_config.in,v 1.2 2014/07/09 03:18:44 taca Exp $
+
+Add support for DragonFly.
 
 --- src/config.in.orig	2011-11-26 03:20:20.000000000 +0000
 +++ src/config.in
diff --git a/editors/emacs23/patches/patch-src_m_amdx86-64.h b/editors/emacs23/patches/patch-src_m_amdx86-64.h
index 3df691f3c88..eb1642db0db 100644
--- a/editors/emacs23/patches/patch-src_m_amdx86-64.h
+++ b/editors/emacs23/patches/patch-src_m_amdx86-64.h
@@ -1,4 +1,6 @@
-$NetBSD: patch-src_m_amdx86-64.h,v 1.1 2013/02/17 04:59:43 dholland Exp $
+$NetBSD: patch-src_m_amdx86-64.h,v 1.2 2014/07/09 03:18:44 taca Exp $
+
+Add support for DragonFly.
 
 --- src/m/amdx86-64.h.orig	2011-11-26 03:20:20.000000000 +0000
 +++ src/m/amdx86-64.h