Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>

5 files changed, 146 insertions, 49 deletions

diff --git a/editors/xemacs/Makefile b/editors/xemacs/Makefile
index 1950794f7ad..28b24f993ba 100644
--- a/editors/xemacs/Makefile
+++ b/editors/xemacs/Makefile
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.102 2012/04/25 11:56:42 hauke Exp $
+# $NetBSD: Makefile,v 1.103 2012/04/27 13:53:46 hauke Exp $
 
 PKGNAME?=	${DISTNAME}
 COMMENT?=	XEmacs text editor version 21
 
 DISTNAME=	xemacs-21.4.22
-PKGREVISION=	6
+PKGREVISION=	7
 CATEGORIES=	editors
 MASTER_SITES=	${MASTER_SITE_XEMACS:=${DISTNAME:C/[.][^.]*$//}/}
 
diff --git a/editors/xemacs/distinfo b/editors/xemacs/distinfo
index d519a4367ff..6e02c3bf307 100644
--- a/editors/xemacs/distinfo
+++ b/editors/xemacs/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2011/01/19 16:04:00 tnn Exp $
+$NetBSD: distinfo,v 1.17 2012/04/27 13:53:46 hauke Exp $
 
 SHA1 (xemacs/xemacs-21.4.22.tar.gz) = 24ed9b13d80c53c06bba60c7bb68387f692b7373
 RMD160 (xemacs/xemacs-21.4.22.tar.gz) = f7d71d3607c3301760df8f7ae5a93d1d37df56ba
@@ -12,6 +12,7 @@ SHA1 (patch-af) = 97cd3d340f349a645a7be9a683879528d9f4c5f2
 SHA1 (patch-ag) = 0ccbead4be5da92e73a15432ff1b063da13cf0b4
 SHA1 (patch-ah) = 9a02b989a6d45cdfead22ea703acceca722cf313
 SHA1 (patch-ai) = ea752473a56d20907201763966ecdeaaeffac84a
-SHA1 (patch-aj) = 8e8eaaa0eece7a5ee09a7645ae05db35efa081bb
 SHA1 (patch-ak) = bfbd285a1cc7d4e93a2fc884e03492dec9302e55
 SHA1 (patch-al) = 247826009110453a868525e711e084b7dee49664
+SHA1 (patch-src_glyphs-eimage.c) = f013013d467d32dfac63287dd5a565153855a751
+SHA1 (patch-src_lisp.h) = 7b4c7984cfbfe1e3a30aac2009f777b8d95c013c
diff --git a/editors/xemacs/patches/patch-aj b/editors/xemacs/patches/patch-aj
deleted file mode 100644
index bf834c8e5b8..00000000000
--- a/editors/xemacs/patches/patch-aj
+++ /dev/null
@@ -1,45 +0,0 @@
-$NetBSD: patch-aj,v 1.3 2011/01/19 16:04:01 tnn Exp $
-
---- src/glyphs-eimage.c.orig	2007-08-20 19:52:28.000000000 +0000
-+++ src/glyphs-eimage.c
-@@ -937,8 +937,8 @@ png_instantiate (Lisp_Object image_insta
-   {
-     int y;
-     unsigned char **row_pointers;
--    height = info_ptr->height;
--    width = info_ptr->width;
-+    height = png_get_image_height(png_ptr, info_ptr);
-+    width = png_get_image_width(png_ptr, info_ptr);
- 
-     /* Wow, allocate all the memory.  Truly, exciting. */
-     unwind.eimage = xnew_array_and_zero (unsigned char, width * height * 3);
-@@ -990,22 +990,22 @@ png_instantiate (Lisp_Object image_insta
-     /* Now that we're using EImage, ask for 8bit RGB triples for any type
-        of image*/
-     /* convert palette images to full RGB */
--    if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
-+    if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_PALETTE)
-       png_set_expand (png_ptr);
-     /* send grayscale images to RGB too */
--    if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY ||
--        info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
-+    if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY ||
-+        png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY_ALPHA)
-       png_set_gray_to_rgb (png_ptr);
-     /* we can't handle alpha values */
--    if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
-+    if (png_get_color_type(png_ptr, info_ptr) & PNG_COLOR_MASK_ALPHA)
-       png_set_strip_alpha (png_ptr);
-     /* tell libpng to strip 16 bit depth files down to 8 bits */
--    if (info_ptr->bit_depth == 16)
-+    if (png_get_bit_depth(png_ptr, info_ptr) == 16)
-       png_set_strip_16 (png_ptr);
-     /* if the image is < 8 bits, pad it out */
--    if (info_ptr->bit_depth < 8)
-+    if (png_get_bit_depth(png_ptr, info_ptr) < 8)
-       {
--	if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY)
-+	if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY)
- 	  png_set_expand (png_ptr);
- 	else
- 	  png_set_packing (png_ptr);
diff --git a/editors/xemacs/patches/patch-src_glyphs-eimage.c b/editors/xemacs/patches/patch-src_glyphs-eimage.c
new file mode 100644
index 00000000000..ae70f5acaba
--- /dev/null
+++ b/editors/xemacs/patches/patch-src_glyphs-eimage.c
@@ -0,0 +1,123 @@
+$NetBSD: patch-src_glyphs-eimage.c,v 1.1 2012/04/27 13:53:46 hauke Exp $
+
+Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>
+
+Adapt to new libpng 1.5 interfaces
+
+--- src/glyphs-eimage.c.orig	2007-08-20 19:52:28.000000000 +0000
++++ src/glyphs-eimage.c
+@@ -407,6 +407,7 @@ jpeg_instantiate (Lisp_Object image_inst
+    */
+ 
+   {
++    UINT_64_BIT pixels_sq;
+     int jpeg_gray = 0;		/* if we're dealing with a grayscale */
+     /* Step 4: set parameters for decompression.   */
+ 
+@@ -429,7 +430,10 @@ jpeg_instantiate (Lisp_Object image_inst
+     jpeg_start_decompress (&cinfo);
+ 
+     /* Step 6: Read in the data and put into EImage format (8bit RGB triples)*/
+-
++    pixels_sq =
++      (UINT_64_BIT) cinfo.output_width * (UINT_64_BIT) cinfo.output_height;
++    if (pixels_sq > ((size_t) -1) / 3)
++      signal_image_error ("JPEG image too large to instantiate", instantiator);
+     unwind.eimage = (unsigned char*) xmalloc (cinfo.output_width * cinfo.output_height * 3);
+     if (!unwind.eimage)
+       signal_image_error("Unable to allocate enough memory for image", instantiator);
+@@ -671,6 +675,7 @@ gif_instantiate (Lisp_Object image_insta
+   {
+     ColorMapObject *cmo = unwind.giffile->SColorMap;
+     int i, j, row, pass, interlace, slice;
++    UINT_64_BIT pixels_sq;
+     unsigned char *eip;
+     /* interlaced gifs have rows in this order:
+        0, 8, 16, ..., 4, 12, 20, ..., 2, 6, 10, ..., 1, 3, 5, ...  */
+@@ -679,6 +684,9 @@ gif_instantiate (Lisp_Object image_insta
+ 
+     height = unwind.giffile->SHeight;
+     width = unwind.giffile->SWidth;
++    pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++    if (pixels_sq > ((size_t) -1) / (3 * unwind.giffile->ImageCount))
++      signal_image_error ("GIF image too large to instantiate", instantiator);
+     unwind.eimage = (unsigned char*)
+       xmalloc (width * height * 3 * unwind.giffile->ImageCount);
+     if (!unwind.eimage)
+@@ -937,11 +945,15 @@ png_instantiate (Lisp_Object image_insta
+   {
+     int y;
+     unsigned char **row_pointers;
+-    height = info_ptr->height;
+-    width = info_ptr->width;
+-
++    UINT_64_BIT pixels_sq;
++    height = png_get_image_height(png_ptr, info_ptr);
++    width = png_get_image_width(png_ptr, info_ptr);
++
++    pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++    if (pixels_sq > ((size_t) -1) / 3)
++      signal_image_error ("PNG image too large to instantiate", instantiator);
+     /* Wow, allocate all the memory.  Truly, exciting. */
+-    unwind.eimage = xnew_array_and_zero (unsigned char, width * height * 3);
++    unwind.eimage = xnew_array_and_zero (unsigned char, pixels_sq * 3);
+     /* libpng expects that the image buffer passed in contains a
+        picture to draw on top of if the png has any transparencies.
+        This could be a good place to pass that in... */
+@@ -990,22 +1002,22 @@ png_instantiate (Lisp_Object image_insta
+     /* Now that we're using EImage, ask for 8bit RGB triples for any type
+        of image*/
+     /* convert palette images to full RGB */
+-    if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
++    if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_PALETTE)
+       png_set_expand (png_ptr);
+     /* send grayscale images to RGB too */
+-    if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY ||
+-        info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
++    if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY ||
++        png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY_ALPHA)
+       png_set_gray_to_rgb (png_ptr);
+     /* we can't handle alpha values */
+-    if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
++    if (png_get_color_type(png_ptr, info_ptr) & PNG_COLOR_MASK_ALPHA)
+       png_set_strip_alpha (png_ptr);
+     /* tell libpng to strip 16 bit depth files down to 8 bits */
+-    if (info_ptr->bit_depth == 16)
++    if (png_get_bit_depth(png_ptr, info_ptr) == 16)
+       png_set_strip_16 (png_ptr);
+     /* if the image is < 8 bits, pad it out */
+-    if (info_ptr->bit_depth < 8)
++    if (png_get_bit_depth(png_ptr, info_ptr) < 8)
+       {
+-	if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY)
++	if (png_get_color_type(png_ptr, info_ptr) == PNG_COLOR_TYPE_GRAY)
+ 	  png_set_expand (png_ptr);
+ 	else
+ 	  png_set_packing (png_ptr);
+@@ -1268,6 +1280,7 @@ tiff_instantiate (Lisp_Object image_inst
+ 
+     uint32 *raster;
+     unsigned char *ep;
++    UINT_64_BIT pixels_sq;
+ 
+     assert (!NILP (data));
+ 
+@@ -1290,12 +1303,16 @@ tiff_instantiate (Lisp_Object image_inst
+ 
+     TIFFGetField (unwind.tiff, TIFFTAG_IMAGEWIDTH, &width);
+     TIFFGetField (unwind.tiff, TIFFTAG_IMAGELENGTH, &height);
+-    unwind.eimage = (unsigned char *) xmalloc (width * height * 3);
++    pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
++    if (pixels_sq >= 1 << 29)
++      signal_image_error ("TIFF image too large to instantiate", instantiator);
++    unwind.eimage = (unsigned char *) xmalloc (pixels_sq * 3);
++
+ 
+     /* #### This is little more than proof-of-concept/function testing.
+        It needs to be reimplemented via scanline reads for both memory
+        compactness. */
+-    raster = (uint32*) _TIFFmalloc (width * height * sizeof (uint32));
++    raster = (uint32*) _TIFFmalloc ((tsize_t) (pixels_sq * sizeof (uint32)));
+     if (raster != NULL)
+       {
+ 	int i,j;
diff --git a/editors/xemacs/patches/patch-src_lisp.h b/editors/xemacs/patches/patch-src_lisp.h
new file mode 100644
index 00000000000..4e5482d8d76
--- /dev/null
+++ b/editors/xemacs/patches/patch-src_lisp.h
@@ -0,0 +1,18 @@
+$NetBSD: patch-src_lisp.h,v 1.1 2012/04/27 13:53:46 hauke Exp $
+
+Fix CVE-2009-2688, via <https://bugzilla.redhat.com/show_bug.cgi?id=511994>
+
+--- src/lisp.h.orig	2005-02-01 03:55:02.000000000 +0000
++++ src/lisp.h
+@@ -265,6 +265,11 @@ void assert_failed (const char *, int, c
+ /*#define REGISTER register*/
+ /*#endif*/
+ 
++#if SIZEOF_LONG == 8
++#define UINT_64_BIT unsigned long
++#elif SIZEOF_LONG_LONG == 8
++#define UINT_64_BIT unsigned long long
++#endif
+ 
+ /* EMACS_INT is the underlying integral type into which a Lisp_Object must fit.
+    In particular, it must be large enough to contain a pointer.