-make this pkg work with pkg-1.4.x

 The fix is a hack. There is code to deal with png versions, but it is
 not complete for 1.4.x, and fooled by bl3 wrappers renaming
 the library behind the pkg's back.
-patch format string problems leading to possible buffer overflow
 (CVE-2010-4259), from Redhat bug#659359
bump PKGREV

5 files changed, 86 insertions, 3 deletions

diff --git a/fonts/fontforge/Makefile b/fonts/fontforge/Makefile
index 532c032c4b7..72cc6870d22 100644
--- a/fonts/fontforge/Makefile
+++ b/fonts/fontforge/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.67 2010/10/10 18:44:53 wiz Exp $
+# $NetBSD: Makefile,v 1.68 2010/12/07 16:58:12 drochner Exp $
 
 DISTNAME=	fontforge_full-${VERSION}
 PKGNAME=	fontforge-${VERSION}
-PKGREVISION=	3
+PKGREVISION=	4
 CATEGORIES=	fonts editors
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=fontforge/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/fonts/fontforge/distinfo b/fonts/fontforge/distinfo
index fad6e8fe31e..19d14497def 100644
--- a/fonts/fontforge/distinfo
+++ b/fonts/fontforge/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.53 2010/10/10 18:44:53 wiz Exp $
+$NetBSD: distinfo,v 1.54 2010/12/07 16:58:12 drochner Exp $
 
 SHA1 (fontforge_full-20100501.tar.bz2) = 483425116c6af6ad90e37f9ada0c28e34f251ec3
 RMD160 (fontforge_full-20100501.tar.bz2) = 4dee2ecdbd32bf3854105f195984d9cabf198fd8
@@ -7,3 +7,6 @@ SHA1 (patch-aa) = e6846a21c973aaa265bb46ba63d145d5f9c00714
 SHA1 (patch-ab) = ec93a47051186bcb901fd145edffad7c457c33fd
 SHA1 (patch-ae) = ca532490137e83ff328ad32c0102d57bed7bb453
 SHA1 (patch-ai) = 4b30556509007d1c74ccdfc9d27f7f23f30bbdb1
+SHA1 (patch-aj) = cb38a2569357af3aa3c1f728afaf4d19f1c0f1ce
+SHA1 (patch-ak) = b158179cb8a8cedb2f507c7864d482278105dd39
+SHA1 (patch-al) = f34104791646030bb76df20e5ddb88bf21842b02
diff --git a/fonts/fontforge/patches/patch-aj b/fonts/fontforge/patches/patch-aj
new file mode 100644
index 00000000000..c909d006c68
--- /dev/null
+++ b/fonts/fontforge/patches/patch-aj
@@ -0,0 +1,13 @@
+$NetBSD: patch-aj,v 1.1 2010/12/07 16:58:12 drochner Exp $
+
+--- gutils/gimagereadpng.c.orig	2010-04-29 03:53:22.000000000 +0000
++++ gutils/gimagereadpng.c
+@@ -78,7 +78,7 @@ return( 0 );
+     }
+ 
+ #  if !defined(_LIBPNG12)
+-    libpng = dlopen("libpng" SO_EXT,RTLD_LAZY);
++    libpng = dlopen("libpng14" SO_EXT,RTLD_LAZY);
+ #    ifdef SO_2_EXT
+     if ( libpng==NULL )
+ 	libpng = dlopen("libpng" SO_2_EXT,RTLD_LAZY);
diff --git a/fonts/fontforge/patches/patch-ak b/fonts/fontforge/patches/patch-ak
new file mode 100644
index 00000000000..ad2a94b1c5b
--- /dev/null
+++ b/fonts/fontforge/patches/patch-ak
@@ -0,0 +1,13 @@
+$NetBSD: patch-ak,v 1.1 2010/12/07 16:58:12 drochner Exp $
+
+--- gutils/gimagewritepng.c.orig	2010-04-29 17:52:54.000000000 +0000
++++ gutils/gimagewritepng.c
+@@ -66,7 +66,7 @@ static int loadpng() {
+ return( 0 );
+     }
+ #  if !defined(_LIBPNG12)
+-    libpng = dlopen("libpng" SO_EXT,RTLD_LAZY);
++    libpng = dlopen("libpng14" SO_EXT,RTLD_LAZY);
+ #    ifdef SO_2_EXT
+     if ( libpng==NULL )
+ 	libpng = dlopen("libpng" SO_2_EXT,RTLD_LAZY);
diff --git a/fonts/fontforge/patches/patch-al b/fonts/fontforge/patches/patch-al
new file mode 100644
index 00000000000..92b0c073218
--- /dev/null
+++ b/fonts/fontforge/patches/patch-al
@@ -0,0 +1,54 @@
+$NetBSD: patch-al,v 1.1 2010/12/07 16:58:12 drochner Exp $
+
+CVE-2010-4259
+
+--- fontforge/fvimportbdf.c.orig	2010-04-16 03:02:02.000000000 +0000
++++ fontforge/fvimportbdf.c
+@@ -560,7 +560,7 @@ static int slurp_header(FILE *bdf, int *
+ 	}
+     
+ 	if ( strcmp(tok,"FONT")==0 ) {
+-	    if ( sscanf(buf,"-%*[^-]-%[^-]-%[^-]-%[^-]-%*[^-]-", family, weight, italic )!=0 ) {
++	    if ( sscanf(buf,"-%*[^-]-%99[^-]-%99[^-]-%99[^-]-%*[^-]-", family, weight, italic )!=0 ) {
+ 		char *pt=buf;
+ 		int dcnt=0;
+ 		while ( *pt=='-' && dcnt<7 ) { ++pt; ++dcnt; }
+@@ -616,26 +616,30 @@ static int slurp_header(FILE *bdf, int *
+ 	    sscanf(buf, "%d", &defs->metricsset );
+ 	else if ( strcmp(tok,"VVECTOR")==0 )
+ 	    sscanf(buf, "%*d %d", &defs->vertical_origin );
++	/* For foundry, fontname and encname, only copy up to the buffer size */
+ 	else if ( strcmp(tok,"FOUNDRY")==0 )
+-	    sscanf(buf, "%[^\"]", foundry );
++	    sscanf(buf, "%99[^\"]", foundry );
+ 	else if ( strcmp(tok,"FONT_NAME")==0 )
+-	    sscanf(buf, "%[^\"]", fontname );
++	    sscanf(buf, "%99[^\"]", fontname );
+ 	else if ( strcmp(tok,"CHARSET_REGISTRY")==0 )
+-	    sscanf(buf, "%[^\"]", encname );
++	    sscanf(buf, "%99[^\"]", encname );
+ 	else if ( strcmp(tok,"CHARSET_ENCODING")==0 ) {
+ 	    enc = 0;
+ 	    if ( sscanf(buf, " %d", &enc )!=1 )
+ 		sscanf(buf, "%d", &enc );
++	/* These properties should be copied up to the buffer length too */
+ 	} else if ( strcmp(tok,"FAMILY_NAME")==0 ) {
+-	    strcpy(family,buf);
++	    strncpy(family,buf,99);
+ 	} else if ( strcmp(tok,"FULL_NAME")==0 || strcmp(tok,"FACE_NAME")==0 ) {
+-	    strcpy(full,buf);
++	    strncpy(full,buf,99);
+ 	} else if ( strcmp(tok,"WEIGHT_NAME")==0 )
+-	    strcpy(weight,buf);
++	    strncpy(weight,buf,99);
+ 	else if ( strcmp(tok,"SLANT")==0 )
+-	    strcpy(italic,buf);
++	    strncpy(italic,buf,99);
+ 	else if ( strcmp(tok,"COPYRIGHT")==0 ) {
+-	    strcpy(comments,buf);
++		/* LS: Assume the size of the passed-in buffer is 1000, see below in
++		 * COMMENT */
++	    strncpy(comments,buf,999);
+ 	    found_copyright = true;
+ 	} else if ( strcmp(tok,"COMMENT")==0 && !found_copyright ) {
+ 	    char *pt = comments+strlen(comments);