diff options
| author | drochner <drochner@pkgsrc.org> | 2009-12-23 14:21:48 +0000 |
|---|---|---|
| committer | drochner <drochner@pkgsrc.org> | 2009-12-23 14:21:48 +0000 |
| commit | 8e2f559b781b170e53a409051d411f0c38e796f8 (patch) | |
| tree | 41d6250e125bca8c6e69e7efaa30126b03486a50 /graphics/xfig | |
| parent | b6fe8891f77251b1b64a9923c26fdbedece49720 (diff) | |
| download | pkgsrc-8e2f559b781b170e53a409051d411f0c38e796f8.tar.gz | |
add a patch from
https://bugzilla.redhat.com/show_bug.cgi?id=543905
to fix CVE-2009-4227
(Stack-based buffer overflow by loading malformed .FIG files)
Diffstat (limited to 'graphics/xfig')
| -rw-r--r-- | graphics/xfig/Makefile | 4 | ||||
| -rw-r--r-- | graphics/xfig/distinfo | 3 | ||||
| -rw-r--r-- | graphics/xfig/patches/patch-an | 53 |
3 files changed, 57 insertions, 3 deletions
diff --git a/graphics/xfig/Makefile b/graphics/xfig/Makefile index 7bfba28f38e..e674b081d63 100644 --- a/graphics/xfig/Makefile +++ b/graphics/xfig/Makefile @@ -1,8 +1,8 @@ -# $NetBSD: Makefile,v 1.59 2009/11/30 13:50:38 itohy Exp $ +# $NetBSD: Makefile,v 1.60 2009/12/23 14:21:48 drochner Exp $ DISTNAME= xfig.3.2.5b.full PKGNAME= xfig-3.2.5b -PKGREVISION= 4 +PKGREVISION= 5 CATEGORIES= graphics MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=mcj/} diff --git a/graphics/xfig/distinfo b/graphics/xfig/distinfo index da418d99a4c..46279dac64e 100644 --- a/graphics/xfig/distinfo +++ b/graphics/xfig/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.21 2009/11/04 15:34:08 gdt Exp $ +$NetBSD: distinfo,v 1.22 2009/12/23 14:21:48 drochner Exp $ SHA1 (xfig.3.2.5b.full.tar.gz) = 0730d7e6bc217c0de02682efb0078821512bb542 RMD160 (xfig.3.2.5b.full.tar.gz) = aad4cfd808c116d34218e9890a898652e4f52ab6 @@ -13,3 +13,4 @@ SHA1 (patch-ai) = bd3f0c40e542aae1cfd739dbe0c0f096ddfdefcf SHA1 (patch-ak) = fcc358a595590ea3136d71bd9f61449d54914c46 SHA1 (patch-al) = ca20d3ec7bcf2ac24fd0a415495f805add23142d SHA1 (patch-am) = 72adbda34425fda49f2072a3d40a3d942e07e1ba +SHA1 (patch-an) = 4bfce8dbd420bc4b4d8efa5b01a39e3a9ce03ca6 diff --git a/graphics/xfig/patches/patch-an b/graphics/xfig/patches/patch-an new file mode 100644 index 00000000000..0d46f18f50e --- /dev/null +++ b/graphics/xfig/patches/patch-an @@ -0,0 +1,53 @@ +$NetBSD: patch-an,v 1.1 2009/12/23 14:21:48 drochner Exp $ + +--- f_readold.c.orig 2007-03-29 00:23:14.000000000 +0000 ++++ f_readold.c +@@ -471,7 +471,7 @@ read_1_3_textobject(FILE *fp) + F_text *t; + int n; + int dum; +- char buf[128]; ++ char buf[512]; + PR_SIZE tx_dim; + + if ((t = create_text()) == NULL) +@@ -485,22 +485,34 @@ read_1_3_textobject(FILE *fp) + t->pen_style = -1; + t->angle = 0.0; + t->next = NULL; ++ if (!fgets(buf, sizeof(buf), fp)) { ++ file_msg("Incomplete text data"); ++ free((char *) t); ++ return (NULL); ++ } ++ ++ /* Note using strlen(buf) here will waste a few bytes, as the ++ various text attributes are counted into this length too. */ ++ if ((t->cstring = new_string(strlen(buf))) == NULL) ++ return (NULL); ++ + /* ascent and length will be recalculated later */ +- n = fscanf(fp, " %d %d %d %d %d %d %d %[^\n]", ++ n = sscanf(buf, " %d %d %d %d %d %d %d %[^\n]", + &t->font, &dum, &dum, &t->ascent, &t->length, +- &t->base_x, &t->base_y, buf); ++ &t->base_x, &t->base_y, t->cstring); + if (n != 8) { + file_msg("Incomplete text data"); ++ free(t->cstring); + free((char *) t); + return (NULL); + } +- if ((t->cstring = new_string(strlen(buf))) == NULL) { ++ ++ if (!strlen(t->cstring)) { ++ free(t->cstring); + free((char *) t); + file_msg("Empty text string at line %d.", line_no); + return (NULL); + } +- /* put string in structure */ +- strcpy(t->cstring, buf); + + /* get the font struct */ + t->zoom = zoomscale; |