add 2 patches from upstream:

1e92e5235ded0415d555aa86066b8e4041ee5a53
and
4757cdf73d3675478d645a3ec8250ba02168a230
to fix integer overflow, leading to heap-based buffer overflow
in the ppm image reader (CVE-2012-4433)
bump PKGREV

3 files changed, 112 insertions, 3 deletions

diff --git a/graphics/gegl/Makefile b/graphics/gegl/Makefile
index ea3b23eac68..a1a62340965 100644
--- a/graphics/gegl/Makefile
+++ b/graphics/gegl/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.40 2012/10/08 23:00:54 adam Exp $
+# $NetBSD: Makefile,v 1.41 2012/11/06 14:03:00 drochner Exp $
 
 DISTNAME=	gegl-0.2.0
-PKGREVISION=	6
+PKGREVISION=	7
 CATEGORIES=	graphics
 MASTER_SITES=	ftp://ftp.gimp.org/pub/gegl/${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=	.tar.bz2
diff --git a/graphics/gegl/distinfo b/graphics/gegl/distinfo
index 85c0e72dd4f..22f7f533fa0 100644
--- a/graphics/gegl/distinfo
+++ b/graphics/gegl/distinfo
@@ -1,6 +1,7 @@
-$NetBSD: distinfo,v 1.12 2012/05/10 04:32:18 dholland Exp $
+$NetBSD: distinfo,v 1.13 2012/11/06 14:03:00 drochner Exp $
 
 SHA1 (gegl-0.2.0.tar.bz2) = 764cc66cb3c7b261b8fc18a6268a0e264a91d573
 RMD160 (gegl-0.2.0.tar.bz2) = cc10365cff27dd42b002bf305f82de54d8c158fa
 Size (gegl-0.2.0.tar.bz2) = 7502040 bytes
+SHA1 (patch-CVE-2012-4433) = 0dd9f9714f92a511469433dcde1195371fcce580
 SHA1 (patch-aa) = 0f46061f7b0c213abfe422124839eec29780d039
diff --git a/graphics/gegl/patches/patch-CVE-2012-4433 b/graphics/gegl/patches/patch-CVE-2012-4433
new file mode 100644
index 00000000000..803c03f0ba7
--- /dev/null
+++ b/graphics/gegl/patches/patch-CVE-2012-4433
@@ -0,0 +1,108 @@
+$NetBSD: patch-CVE-2012-4433,v 1.1 2012/11/06 14:03:00 drochner Exp $
+
+see https://bugzilla.redhat.com/show_bug.cgi?id=856300
+
+--- operations/external/ppm-load.c.orig	2012-03-29 20:05:50.000000000 +0000
++++ operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+ 
+ typedef enum {
+   PIXMAP_ASCII  = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+ 
+ typedef struct {
+ 	map_type   type;
+-	gint       width;
+-	gint       height;
++	glong      width;
++	glong      height;
+         gsize      numsamples; /* width * height * channels */
+         gsize      bpc;        /* bytes per channel */
+ 	guchar    *data;
+@@ -82,12 +83,33 @@ ppm_load_read_header(FILE       *fp,
+       }
+ 
+     /* Get Width and Height */
+-    img->width  = strtol (header,&ptr,0);
+-    img->height = atoi (ptr);
+-    img->numsamples = img->width * img->height * CHANNEL_COUNT;
++    errno = 0;
++    img->width  = strtol (header,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading width: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: width is negative");
++        return FALSE;
++      }
++
++    img->height = strtol (ptr,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading height: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: height is negative");
++        return FALSE;
++      }
+ 
+     fgets (header,MAX_CHARS_IN_ROW,fp);
+-    maxval = strtol (header,&ptr,0);
++    maxval = strtol (header,&ptr,10);
+ 
+     if ((maxval != 255) && (maxval != 65535))
+       {
+@@ -109,6 +131,16 @@ ppm_load_read_header(FILE       *fp,
+       g_warning ("%s: Programmer stupidity error", G_STRLOC);
+     }
+ 
++    /* Later on, img->numsamples is multiplied with img->bpc to allocate
++     * memory. Ensure it doesn't overflow. */
++    if (!img->width || !img->height ||
++        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
++      {
++        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
++        return FALSE;
++      }
++    img->numsamples = img->width * img->height * CHANNEL_COUNT;
++
+     return TRUE;
+ }
+ 
+@@ -229,12 +261,24 @@ process (GeglOperation       *operation,
+   if (!ppm_load_read_header (fp, &img))
+     goto out;
+ 
+-  rect.height = img.height;
+-  rect.width = img.width;
+-
+   /* Allocating Array Size */
++
++  /* Should use g_try_malloc(), but this causes crashes elsewhere because the
++   * error signalled by returning FALSE isn't properly acted upon. Therefore
++   * g_malloc() is used here which aborts if the requested memory size can't be
++   * allocated causing a controlled crash. */
+   img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+ 
++  /* No-op without g_try_malloc(), see above. */
++  if (! img.data)
++    {
++      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
++      goto out;
++    }
++
++  rect.height = img.height;
++  rect.width = img.width;
++
+   switch (img.bpc)
+     {
+     case 1: