Apply the official KDE patches for CAN-2005-1046.

http://www.kde.org/info/security/advisory-20050421-1.txt
Bump PKGREVISION.

9 files changed, 733 insertions, 44 deletions

diff --git a/x11/kdelibs3/Makefile b/x11/kdelibs3/Makefile
index 119a25d0085..4845c4709fc 100644
--- a/x11/kdelibs3/Makefile
+++ b/x11/kdelibs3/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.83 2005/04/28 23:39:35 jlam Exp $
+# $NetBSD: Makefile,v 1.84 2005/05/01 04:35:39 markd Exp $
 
 DISTNAME=	kdelibs-${_KDE_VERSION}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	x11
 COMMENT=	Support libraries for the KDE integrated X11 desktop
 
diff --git a/x11/kdelibs3/distinfo b/x11/kdelibs3/distinfo
index faa131c0013..96ead01b339 100644
--- a/x11/kdelibs3/distinfo
+++ b/x11/kdelibs3/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.54 2005/04/18 16:54:00 drochner Exp $
+$NetBSD: distinfo,v 1.55 2005/05/01 04:35:39 markd Exp $
 
 SHA1 (kdelibs-3.4.0.tar.bz2) = ca3ded4105a500dae5170ccf85cd62af98b33961
 RMD160 (kdelibs-3.4.0.tar.bz2) = 75917f60d115d770b5a8aa3922591e118c6bfdf0
@@ -20,9 +20,12 @@ SHA1 (patch-cf) = 0409b64ee00f355bfc2056e596b519a241fcf522
 SHA1 (patch-cg) = e68fc3f4147b1c4760669318319e59bcf67cea51
 SHA1 (patch-da) = f84186eb73af08023f7d9960c2086a60d5042e14
 SHA1 (patch-db) = 3235276a2aad256e59d2c83d49785cb672433abc
-SHA1 (patch-dc) = c4976f2883d35d7dd366c356eeac07d17d672068
-SHA1 (patch-dd) = 161bf22a8e4178fd01e08f98be3a6534a6c74895
-SHA1 (patch-de) = 6765fbda3d248e164d5694fe54fb85c7a28d6a34
+SHA1 (patch-dc) = be18891ac90f164c145140f8286c5bc281fcf70b
+SHA1 (patch-dd) = 7bfa26bfa6962f4ebaaf4015c3c76a769998c062
+SHA1 (patch-de) = 08732b0fac0630b60ebcd92e7b566a323a0eb790
 SHA1 (patch-df) = 4c7c73e8942e6842f58420bbe5b9491e7116002d
-SHA1 (patch-dg) = de05b75ab2f7d41fb0feaccd74cb460ef8a3412c
+SHA1 (patch-dg) = a10324f6c8e82672a62af45113887e14ea80f344
 SHA1 (patch-dh) = 9981f590f83e4543e2e3478b607aed36afe373c5
+SHA1 (patch-di) = 6bbf926ec725cd3b931a9afc5e209cd3bed054cb
+SHA1 (patch-dj) = a90296d5453d4b7f776338c29300e3c475473d6b
+SHA1 (patch-dk) = c365d357c4bbc65238e04795d9012d1f3ebb54fe
diff --git a/x11/kdelibs3/patches/patch-dc b/x11/kdelibs3/patches/patch-dc
index eb84c4b0013..c6fb0ad14e7 100644
--- a/x11/kdelibs3/patches/patch-dc
+++ b/x11/kdelibs3/patches/patch-dc
@@ -1,44 +1,432 @@
-$NetBSD: patch-dc,v 1.1 2005/04/12 11:00:03 drochner Exp $
+$NetBSD: patch-dc,v 1.2 2005/05/01 04:35:40 markd Exp $
 
---- kimgio/pcx.cpp.orig	2004-11-22 04:48:27.000000000 +0100
+--- kimgio/pcx.cpp.orig	2004-11-22 16:48:27.000000000 +1300
 +++ kimgio/pcx.cpp
-@@ -134,7 +134,8 @@ static void readImage1( QDataStream &s )
+@@ -1,5 +1,5 @@
+ /* This file is part of the KDE project
+-   Copyright (C) 2002-2003 Nadeem Hasan <nhasan@kde.org>
++   Copyright (C) 2002-2005 Nadeem Hasan <nhasan@kde.org>
+ 
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+@@ -44,6 +44,11 @@ static QDataStream &operator>>( QDataStr
+   s >> ph.HScreenSize;
+   s >> ph.VScreenSize;
+ 
++  // Skip the rest of the header
++  Q_UINT8 byte;
++  while ( s.device()->at() < 128 )
++    s >> byte;
++
+   return s;
+ }
+ 
+@@ -85,25 +90,22 @@ static QDataStream &operator<<( QDataStr
+   return s;
+ }
+ 
+-static PCXHEADER header;
+-static QImage img;
+-static Q_UINT16 w, h;
+-
+-void PCXHEADER::reset()
++PCXHEADER::PCXHEADER()
+ {
++  // Initialize all data to zero
+   QByteArray dummy( 128 );
+   dummy.fill( 0 );
+   QDataStream s( dummy, IO_ReadOnly );
+   s >> *this;
+ }
+ 
+-static void readLine( QDataStream &s, QByteArray &buf )
++static void readLine( QDataStream &s, QByteArray &buf, const PCXHEADER &header )
+ {
+   Q_UINT32 i=0;
+   Q_UINT32 size = buf.size();
+   Q_UINT8 byte, count;
+ 
+-  if ( header.Encoding == 1 )
++  if ( header.isCompressed() )
+   {
+     // Uncompress the image data
+     while ( i < size )
+@@ -130,13 +132,14 @@ static void readLine( QDataStream &s, QB
+   }
+ }
+ 
+-static void readImage1( QDataStream &s )
++static void readImage1( QImage &img, QDataStream &s, const PCXHEADER &header )
  {
    QByteArray buf( header.BytesPerLine );
  
 -  img.create( w, h, 1, 2, QImage::BigEndian );
-+  if( !img.create( w, h, 1, 2, QImage::BigEndian ))
++  if(!img.create( header.width(), header.height(), 1, 2, QImage::BigEndian ))
 +    return;
  
-   for ( int y=0; y<h; ++y )
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
    {
-@@ -160,7 +161,8 @@ static void readImage4( QDataStream &s )
+     if ( s.atEnd() )
+     {
+@@ -144,10 +147,11 @@ static void readImage1( QDataStream &s )
+       return;
+     }
+ 
+-    readLine( s, buf );
+-
+-    for ( int x=0; x<header.BytesPerLine; ++x )
+-      *( img.scanLine( y )+x ) = buf[ x ];
++    readLine( s, buf, header );
++    uchar *p = img.scanLine( y );
++    unsigned int bpl = QMIN((header.width()+7)/8, header.BytesPerLine);
++    for ( unsigned int x=0; x< bpl; ++x )
++      p[ x ] = buf[x];
+   }
+ 
+   // Set the color palette
+@@ -155,14 +159,15 @@ static void readImage1( QDataStream &s )
+   img.setColor( 1, qRgb( 255, 255, 255 ) );
+ }
+ 
+-static void readImage4( QDataStream &s )
++static void readImage4( QImage &img, QDataStream &s, const PCXHEADER &header )
+ {
    QByteArray buf( header.BytesPerLine*4 );
-   QByteArray pixbuf( w );
+-  QByteArray pixbuf( w );
++  QByteArray pixbuf( header.width() );
  
 -  img.create( w, h, 8, 16, QImage::IgnoreEndian );
-+  if( !img.create( w, h, 8, 16, QImage::IgnoreEndian ))
++  if(!img.create( header.width(), header.height(), 8, 16 ))
 +    return;
  
-   for ( int y=0; y<h; ++y )
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
    {
-@@ -196,7 +198,8 @@ static void readImage8( QDataStream &s )
+     if ( s.atEnd() )
+     {
+@@ -171,20 +176,19 @@ static void readImage4( QDataStream &s )
+     }
+ 
+     pixbuf.fill( 0 );
+-    readLine( s, buf );
++    readLine( s, buf, header );
+ 
+     for ( int i=0; i<4; i++ )
+     {
+       Q_UINT32 offset = i*header.BytesPerLine;
+-      for ( int x=0; x<w; ++x )
++      for ( unsigned int x=0; x<header.width(); ++x )
+         if ( buf[ offset + ( x/8 ) ] & ( 128 >> ( x%8 ) ) )
+           pixbuf[ x ] += ( 1 << i );
+     }
+ 
+     uchar *p = img.scanLine( y );
+-
+-    for ( int x=0; x<w; ++x )
+-      *p++ = pixbuf[ x ];
++    for ( unsigned int x=0; x<header.width(); ++x )
++      p[ x ] = pixbuf[ x ];
+   }
+ 
+   // Read the palette
+@@ -192,13 +196,14 @@ static void readImage4( QDataStream &s )
+     img.setColor( i, header.ColorMap.color( i ) );
+ }
+ 
+-static void readImage8( QDataStream &s )
++static void readImage8( QImage &img, QDataStream &s, const PCXHEADER &header )
  {
    QByteArray buf( header.BytesPerLine );
  
 -  img.create( w, h, 8, 256, QImage::IgnoreEndian );
-+  if( !img.create( w, h, 8, 256, QImage::IgnoreEndian ))
++  if(!img.create( header.width(), header.height(), 8, 256 ))
 +    return;
  
-   for ( int y=0; y<h; ++y )
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
    {
-@@ -236,7 +239,8 @@ static void readImage24( QDataStream &s 
+     if ( s.atEnd() )
+     {
+@@ -206,19 +211,19 @@ static void readImage8( QDataStream &s )
+       return;
+     }
+ 
+-    readLine( s, buf );
++    readLine( s, buf, header );
+ 
+     uchar *p = img.scanLine( y );
+-
+-    for ( int x=0; x<header.BytesPerLine; ++x )
+-      *p++ = buf[ x ];
++    unsigned int bpl = QMIN(header.BytesPerLine, header.width());
++    for ( unsigned int x=0; x<bpl; ++x )
++      p[ x ] = buf[ x ];
+   }
+ 
+   Q_UINT8 flag;
+   s >> flag;
+-  kdDebug() << "Flag: " << flag << endl;
++  kdDebug( 399 ) << "Palette Flag: " << flag << endl;
+ 
+-  if ( flag == 12 && header.Version == 5 )
++  if ( flag == 12 && ( header.Version == 5 || header.Version == 2 ) )
+   {
+     // Read the palette
+     Q_UINT8 r, g, b;
+@@ -230,15 +235,16 @@ static void readImage8( QDataStream &s )
+   }
+ }
+ 
+-static void readImage24( QDataStream &s )
++static void readImage24( QImage &img, QDataStream &s, const PCXHEADER &header )
+ {
+   QByteArray r_buf( header.BytesPerLine );
    QByteArray g_buf( header.BytesPerLine );
    QByteArray b_buf( header.BytesPerLine );
  
 -  img.create( w, h, 32 );
-+  if( !img.create( w, h, 32 ))
++  if(!img.create( header.width(), header.height(), 32 ))
 +    return;
  
-   for ( int y=0; y<h; ++y )
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
+   {
+     if ( s.atEnd() )
+     {
+@@ -246,14 +252,13 @@ static void readImage24( QDataStream &s 
+       return;
+     }
+ 
+-    readLine( s, r_buf );
+-    readLine( s, g_buf );
+-    readLine( s, b_buf );
++    readLine( s, r_buf, header );
++    readLine( s, g_buf, header );
++    readLine( s, b_buf, header );
+ 
+     uint *p = ( uint * )img.scanLine( y );
+-
+-    for ( int x=0; x<header.BytesPerLine; ++x )
+-      *p++ = qRgb( r_buf[ x ], g_buf[ x ], b_buf[ x ] );
++    for ( unsigned int x=0; x<header.width(); ++x )
++      p[ x ] = qRgb( r_buf[ x ], g_buf[ x ], b_buf[ x ] );
+   }
+ }
+ 
+@@ -268,6 +273,8 @@ KDE_EXPORT void kimgio_pcx_read( QImageI
+     return;
+   }
+ 
++  PCXHEADER header;
++
+   s >> header;
+ 
+   if ( header.Manufacturer != 10 || s.atEnd())
+@@ -276,10 +283,8 @@ KDE_EXPORT void kimgio_pcx_read( QImageI
+     return;
+   }
+ 
+-  w = ( header.XMax-header.XMin ) + 1;
+-  h = ( header.YMax-header.YMin ) + 1;
+-
+-  img.reset();
++  int w = header.width();
++  int h = header.height();
+ 
+   kdDebug( 399 ) << "Manufacturer: " << header.Manufacturer << endl;
+   kdDebug( 399 ) << "Version: " << header.Version << endl;
+@@ -288,30 +293,27 @@ KDE_EXPORT void kimgio_pcx_read( QImageI
+   kdDebug( 399 ) << "Width: " << w << endl;
+   kdDebug( 399 ) << "Height: " << h << endl;
+   kdDebug( 399 ) << "Window: " << header.XMin << "," << header.XMax << "," 
+-            << header.YMin << "," << header.YMax << endl;
++                 << header.YMin << "," << header.YMax << endl;
+   kdDebug( 399 ) << "BytesPerLine: " << header.BytesPerLine << endl;
+   kdDebug( 399 ) << "NPlanes: " << header.NPlanes << endl;
+ 
+-  // Skip the rest of the header
+-  Q_UINT8 byte;
+-  while ( s.device()->at() < 128 )
+-    s >> byte;
++  QImage img;
+ 
+   if ( header.Bpp == 1 && header.NPlanes == 1 )
    {
+-    readImage1( s );
++    readImage1( img, s, header );
+   }
+   else if ( header.Bpp == 1 && header.NPlanes == 4 )
+   {
+-    readImage4( s );
++    readImage4( img, s, header );
+   }
+   else if ( header.Bpp == 8 && header.NPlanes == 1 )
+   {
+-    readImage8( s );
++    readImage8( img, s, header );
+   }
+   else if ( header.Bpp == 8 && header.NPlanes == 3 )
+   {
+-    readImage24( s );
++    readImage24( img, s, header );
+   }
+ 
+   kdDebug( 399 ) << "Image Bytes: " << img.numBytes() << endl;
+@@ -359,7 +361,7 @@ static void writeLine( QDataStream &s, Q
+   }
+ }
+ 
+-static void writeImage1( QDataStream &s )
++static void writeImage1( QImage &img, QDataStream &s, PCXHEADER &header )
+ {
+   img = img.convertBitOrder( QImage::BigEndian );
+ 
+@@ -367,29 +369,27 @@ static void writeImage1( QDataStream &s 
+   header.NPlanes = 1;
+   header.BytesPerLine = img.bytesPerLine();
+ 
+-  header.ColorMap.setColor( 0, qRgb( 0, 0, 0 ) );
+-  header.ColorMap.setColor( 1, qRgb( 255, 255, 255 ) );
+-
+   s << header;
+ 
+   QByteArray buf( header.BytesPerLine );
+ 
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
+   {
+     Q_UINT8 *p = img.scanLine( y );
+ 
++    // Invert as QImage uses reverse palette for monochrome images?
+     for ( int i=0; i<header.BytesPerLine; ++i )
+-      buf[ i ] = p[ i ];
++      buf[ i ] = ~p[ i ];
+ 
+     writeLine( s, buf );
+   }
+ }
+ 
+-static void writeImage4( QDataStream &s )
++static void writeImage4( QImage &img, QDataStream &s, PCXHEADER &header )
+ {
+   header.Bpp = 1;
+   header.NPlanes = 4;
+-  header.BytesPerLine = w/8;
++  header.BytesPerLine = header.width()/8;
+ 
+   for ( int i=0; i<16; ++i )
+     header.ColorMap.setColor( i, img.color( i ) );
+@@ -401,14 +401,14 @@ static void writeImage4( QDataStream &s 
+   for ( int i=0; i<4; ++i )
+       buf[ i ].resize( header.BytesPerLine );
+ 
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
+   {
+     Q_UINT8 *p = img.scanLine( y );
+ 
+     for ( int i=0; i<4; ++i )
+       buf[ i ].fill( 0 );
+ 
+-    for ( int x=0; x<w; ++x )
++    for ( unsigned int x=0; x<header.width(); ++x )
+     {
+       for ( int i=0; i<4; ++i )
+         if ( *( p+x ) & ( 1 << i ) )
+@@ -420,7 +420,7 @@ static void writeImage4( QDataStream &s 
+   }
+ }
+ 
+-static void writeImage8( QDataStream &s )
++static void writeImage8( QImage &img, QDataStream &s, PCXHEADER &header )
+ {
+   header.Bpp = 8;
+   header.NPlanes = 1;
+@@ -430,7 +430,7 @@ static void writeImage8( QDataStream &s 
+ 
+   QByteArray buf( header.BytesPerLine );
+ 
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
+   {
+     Q_UINT8 *p = img.scanLine( y );
+ 
+@@ -449,23 +449,23 @@ static void writeImage8( QDataStream &s 
+     s << RGB( img.color( i ) );
+ }
+ 
+-static void writeImage24( QDataStream &s )
++static void writeImage24( QImage &img, QDataStream &s, PCXHEADER &header )
+ {
+   header.Bpp = 8;
+   header.NPlanes = 3;
+-  header.BytesPerLine = w;
++  header.BytesPerLine = header.width();
+ 
+   s << header;
+ 
+-  QByteArray r_buf( w );
+-  QByteArray g_buf( w );
+-  QByteArray b_buf( w );
++  QByteArray r_buf( header.width() );
++  QByteArray g_buf( header.width() );
++  QByteArray b_buf( header.width() );
+ 
+-  for ( int y=0; y<h; ++y )
++  for ( int y=0; y<header.height(); ++y )
+   {
+     uint *p = ( uint * )img.scanLine( y );
+ 
+-    for ( int x=0; x<w; ++x )
++    for ( unsigned int x=0; x<header.width(); ++x )
+     {
+       QRgb rgb = *p++;
+       r_buf[ x ] = qRed( rgb );
+@@ -484,10 +484,10 @@ KDE_EXPORT void kimgio_pcx_write( QImage
+   QDataStream s( io->ioDevice() );
+   s.setByteOrder( QDataStream::LittleEndian );
+ 
+-  img = io->image();
++  QImage img = io->image();
+ 
+-  w = img.width();
+-  h = img.height();
++  int w = img.width();
++  int h = img.height();
+ 
+   kdDebug( 399 ) << "Width: " << w << endl;
+   kdDebug( 399 ) << "Height: " << h << endl;
+@@ -495,6 +495,8 @@ KDE_EXPORT void kimgio_pcx_write( QImage
+   kdDebug( 399 ) << "BytesPerLine: " << img.bytesPerLine() << endl;
+   kdDebug( 399 ) << "Num Colors: " << img.numColors() << endl;
+ 
++  PCXHEADER header;
++
+   header.Manufacturer = 10;
+   header.Version = 5;
+   header.Encoding = 1;
+@@ -509,19 +511,19 @@ KDE_EXPORT void kimgio_pcx_write( QImage
+ 
+   if ( img.depth() == 1 )
+   {
+-    writeImage1( s );
++    writeImage1( img, s, header );
+   }
+   else if ( img.depth() == 8 && img.numColors() <= 16 )
+   {
+-    writeImage4( s );
++    writeImage4( img, s, header );
+   }
+   else if ( img.depth() == 8 )
+   {
+-    writeImage8( s );
++    writeImage8( img, s, header );
+   }
+   else if ( img.depth() == 32 )
+   {
+-    writeImage24( s );
++    writeImage24( img, s, header );
+   }
+ 
+   io->setStatus( 0 );
diff --git a/x11/kdelibs3/patches/patch-dd b/x11/kdelibs3/patches/patch-dd
index e56dc386f43..ca16f1c9e10 100644
--- a/x11/kdelibs3/patches/patch-dd
+++ b/x11/kdelibs3/patches/patch-dd
@@ -1,12 +1,13 @@
-$NetBSD: patch-dd,v 1.1 2005/04/12 11:00:03 drochner Exp $
+$NetBSD: patch-dd,v 1.2 2005/05/01 04:35:40 markd Exp $
 
---- kimgio/tiffr.cpp.orig	2004-11-22 04:52:18.000000000 +0100
+--- kimgio/tiffr.cpp.orig	2004-11-22 16:52:18.000000000 +1300
 +++ kimgio/tiffr.cpp
-@@ -84,6 +84,9 @@ KDE_EXPORT void kimgio_tiff_read( QImage
+@@ -84,6 +84,10 @@ KDE_EXPORT void kimgio_tiff_read( QImage
              return;
  
  	QImage image( width, height, 32 );
 +	if( image.isNull()) {
++		TIFFClose( tiff );
 +		return;
 +	}
  	data = (uint32 *)image.bits();
diff --git a/x11/kdelibs3/patches/patch-de b/x11/kdelibs3/patches/patch-de
index 39595bfd53e..8f1866fce7b 100644
--- a/x11/kdelibs3/patches/patch-de
+++ b/x11/kdelibs3/patches/patch-de
@@ -1,8 +1,70 @@
-$NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
+$NetBSD: patch-de,v 1.2 2005/05/01 04:35:40 markd Exp $
 
---- kimgio/xcf.cpp.orig	2004-11-22 04:48:27.000000000 +0100
+--- kimgio/xcf.cpp.orig	2004-11-22 16:48:27.000000000 +1300
 +++ kimgio/xcf.cpp
-@@ -401,7 +401,8 @@ bool XCFImageFormat::loadLayer(QDataStre
+@@ -234,10 +234,10 @@ bool XCFImageFormat::loadImageProperties
+ 					property.readBytes(tag, size);
+ 
+ 					Q_UINT32 flags;
+-					char* data;
++					char* data=0;
+ 					property >> flags >> data;
+ 
+-					if (strcmp(tag, "gimp-comment") == 0)
++					if (tag && strncmp(tag, "gimp-comment", strlen("gimp-comment")) == 0)
+ 						xcf_image.image.setText("Comment", 0, data);
+ 
+ 					delete[] tag;
+@@ -257,6 +257,9 @@ bool XCFImageFormat::loadImageProperties
+ 
+ 				case PROP_COLORMAP:
+ 					property >> xcf_image.num_colors;
++                                        if(xcf_image.num_colors < 0 || xcf_image.num_colors > 65535)
++                                            return false;
++
+ 					xcf_image.palette.reserve(xcf_image.num_colors);
+ 
+ 					for (int i = 0; i < xcf_image.num_colors; i++) {
+@@ -307,6 +310,9 @@ bool XCFImageFormat::loadProperty(QDataS
+ 			return false;
+ 		}
+ 
++                if(size > 65535 || size < 4)
++                    return false;
++
+ 		size = 3 * (size - 4) + 4;
+ 		data = new char[size];
+ 
+@@ -336,19 +342,21 @@ bool XCFImageFormat::loadProperty(QDataS
+ 		}
+ 
+ 		size = 0;
+-	} else
+-		xcf_io.readBytes(data, size);
++	} else {
++                xcf_io >> size;
++                if(size >256000)
++                    return false;
++                data = new char[size];
++		xcf_io.readRawBytes(data, size);
++        }
+ 
+ 	if (xcf_io.device()->status() != IO_Ok) {
+ 		kdDebug(399) << "XCF: read failure on property " << type << " data, size " << size << endl;
+ 		return false;
+ 	}
+ 
+-	if (size != 0) {
+-		bytes.resize(size);
+-		for (uint i = 0; i < size; i++)
+-			bytes[i] = data[i];
+-		delete[] data;
++	if (size != 0 && data) {
++                bytes.assign(data,size);
+ 	}
+ 
+ 	return true;
+@@ -401,7 +409,8 @@ bool XCFImageFormat::loadLayer(QDataStre
  	// Allocate the individual tile QImages based on the size and type
  	// of this layer.
  
@@ -12,7 +74,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  	xcf_io.device()->at(layer.hierarchy_offset);
  
  	// As tiles are loaded, they are copied into the layers tiles by
-@@ -425,7 +426,8 @@ bool XCFImageFormat::loadLayer(QDataStre
+@@ -425,7 +434,8 @@ bool XCFImageFormat::loadLayer(QDataStre
  	// of the QImage.
  
  	if (!xcf_image.initialized) {
@@ -22,7 +84,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  		copyLayerToImage(xcf_image);
  		xcf_image.initialized = true;
  	} else
-@@ -516,7 +518,7 @@ bool XCFImageFormat::loadLayerProperties
+@@ -516,7 +526,7 @@ bool XCFImageFormat::loadLayerProperties
   * QImage structures for each of them.
   * \param xcf_image contains the current layer.
   */
@@ -31,7 +93,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  {
  	Layer& layer(xcf_image.layer);
  
-@@ -556,48 +558,67 @@ void XCFImageFormat::composeTiles(XCFIma
+@@ -556,48 +566,67 @@ void XCFImageFormat::composeTiles(XCFIma
  			switch (layer.type) {
  				case RGB_GIMAGE:
  					layer.image_tiles[j][i] = QImage(tile_width, tile_height, 32, 0);
@@ -99,7 +161,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  }
  
  
-@@ -1072,7 +1093,7 @@ void XCFImageFormat::assignMaskBytes(Lay
+@@ -1072,7 +1101,7 @@ void XCFImageFormat::assignMaskBytes(Lay
   * For indexed images, translucency is an all or nothing effect.
   * \param xcf_image contains image info and bottom-most layer.
   */
@@ -108,7 +170,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  {
  	// (Aliases to make the code look a little better.)
  	Layer& layer(xcf_image.layer);
-@@ -1082,12 +1103,16 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1082,12 +1111,16 @@ void XCFImageFormat::initializeImage(XCF
  		case RGB_GIMAGE:
  			if (layer.opacity == OPAQUE_OPACITY) {
  				image.create( xcf_image.width, xcf_image.height, 32);
@@ -125,7 +187,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  			image.fill(qRgba(255, 255, 255, 0));
  			// Turning this on prevents fill() from affecting the alpha channel,
  			// by the way.
-@@ -1097,6 +1122,8 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1097,6 +1130,8 @@ void XCFImageFormat::initializeImage(XCF
  		case GRAY_GIMAGE:
  			if (layer.opacity == OPAQUE_OPACITY) {
  				image.create(xcf_image.width, xcf_image.height, 8, 256);
@@ -134,7 +196,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  				setGrayPalette(image);
  				image.fill(255);
  				break;
-@@ -1104,6 +1131,8 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1104,6 +1139,8 @@ void XCFImageFormat::initializeImage(XCF
  
  		case GRAYA_GIMAGE:
  			image.create(xcf_image.width, xcf_image.height, 32);
@@ -143,7 +205,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  			image.fill(qRgba(255, 255, 255, 0));
  			image.setAlphaBuffer(true);
  			break;
-@@ -1125,12 +1154,16 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1125,12 +1162,16 @@ void XCFImageFormat::initializeImage(XCF
  				image.create(xcf_image.width, xcf_image.height,
  						1, xcf_image.num_colors,
  						QImage::LittleEndian);
@@ -160,7 +222,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  				image.fill(0);
  				setPalette(xcf_image, image);
  			}
-@@ -1147,6 +1180,8 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1147,6 +1188,8 @@ void XCFImageFormat::initializeImage(XCF
  				image.create(xcf_image.width, xcf_image.height,
  						1, xcf_image.num_colors,
  						QImage::LittleEndian);
@@ -169,7 +231,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  				image.fill(0);
  				setPalette(xcf_image, image);
  				image.setAlphaBuffer(true);
-@@ -1160,6 +1195,8 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1160,6 +1203,8 @@ void XCFImageFormat::initializeImage(XCF
  				xcf_image.palette[0] = qRgba(255, 255, 255, 0);
  				image.create( xcf_image.width, xcf_image.height,
  						8, xcf_image.num_colors);
@@ -178,7 +240,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  				image.fill(0);
  				setPalette(xcf_image, image);
  				image.setAlphaBuffer(true);
-@@ -1168,6 +1205,8 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1168,6 +1213,8 @@ void XCFImageFormat::initializeImage(XCF
  				// true color. (There is no equivalent PNG representation output
  				// from The GIMP as of v1.2.)
  				image.create(xcf_image.width, xcf_image.height, 32);
@@ -187,7 +249,7 @@ $NetBSD: patch-de,v 1.1 2005/04/12 11:00:03 drochner Exp $
  				image.fill(qRgba(255, 255, 255, 0));
  				image.setAlphaBuffer(true);
  			}
-@@ -1176,6 +1215,7 @@ void XCFImageFormat::initializeImage(XCF
+@@ -1176,6 +1223,7 @@ void XCFImageFormat::initializeImage(XCF
  
  	image.setDotsPerMeterX((int)(xcf_image.x_resolution * INCHESPERMETER));
  	image.setDotsPerMeterY((int)(xcf_image.y_resolution * INCHESPERMETER));
diff --git a/x11/kdelibs3/patches/patch-dg b/x11/kdelibs3/patches/patch-dg
index 3eaefcac86f..5993f193222 100644
--- a/x11/kdelibs3/patches/patch-dg
+++ b/x11/kdelibs3/patches/patch-dg
@@ -1,13 +1,89 @@
-$NetBSD: patch-dg,v 1.1 2005/04/12 11:00:03 drochner Exp $
+$NetBSD: patch-dg,v 1.2 2005/05/01 04:35:40 markd Exp $
 
---- kimgio/xview.cpp.orig	2004-11-22 04:52:18.000000000 +0100
+--- kimgio/xview.cpp.orig	2004-11-22 16:52:18.000000000 +1300
 +++ kimgio/xview.cpp
-@@ -62,6 +62,8 @@ KDE_EXPORT void kimgio_xv_read( QImageIO
+@@ -7,6 +7,7 @@
+ 
+ #include <stdio.h>
+ #include <string.h>
++#include <stdlib.h>
+ #include <qimage.h>
+ 
+ #include <kdelibs_export.h>
+@@ -15,6 +16,9 @@
+ 
+ #define BUFSIZE 1024
+ 
++static const int b_255_3[]= {0,85,170,255},  // index*255/3
++           rg_255_7[]={0,36,72,109,145,182,218,255}; // index *255/7
++
+ KDE_EXPORT void kimgio_xv_read( QImageIO *_imageio )
+ {      
+ 	int x=-1;
+@@ -50,10 +54,14 @@ KDE_EXPORT void kimgio_xv_read( QImageIO
+ 	sscanf(str, "%d %d %d", &x, &y, &maxval);
+ 
+ 	if (maxval != 255) return;
++	int blocksize = x*y;
++        if(x < 0 || y < 0 || blocksize < x || blocksize < y)
++            return;
+ 
+ 	// now follows a binary block of x*y bytes. 
+-	int blocksize = x*y;
+-	char *block = new char[ blocksize ];
++	char *block = (char*) malloc(blocksize);
++        if(!block)
++            return;
+ 
+ 	if (iodev->readBlock(block, blocksize) != blocksize ) 
+ 	{
+@@ -62,6 +70,10 @@ KDE_EXPORT void kimgio_xv_read( QImageIO
  
  	// Create the image
  	QImage image( x, y, 8, maxval + 1, QImage::BigEndian );
-+	if( image.isNull())
++	if( image.isNull()) {
++                free(block);
 +		return;
++        }
  
  	// how do the color handling? they are absolute 24bpp
  	// or at least can be calculated as such.
+@@ -69,29 +81,9 @@ KDE_EXPORT void kimgio_xv_read( QImageIO
+ 
+ 	for ( int j = 0; j < 256; j++ )
+ 	{
+-// ----------- OLIVER EIDEN
+-// 	That is the old-code !
+-/*		r =  ((int) ((j >> 5) & 0x07)) << 5;
+-		g =  ((int) ((j >> 2) & 0x07)) << 5;
+-		b =  ((int) ((j >> 0) & 0x03)) << 6;*/
+-
+-
+-// 	That is the code-how xv, decode 3-3-2 pixmaps, it is slighly different,
+-//	but yields much better visuals results
+-/*		r =  (((int) ((j >> 5) & 0x07)) *255) / 7;
+-		g =  (((int) ((j >> 2) & 0x07)) *255) / 7;
+-		b =  (((int) ((j >> 0) & 0x03)) *255) / 3;*/
+-
+-//	This is the same as xv, with multiplications/divisions replaced by indexing
+-
+-//      Look-up table to avoid multiplications and divisons
+-	static int b_255_3[]= {0,85,170,255},  // index*255/3
+-		   rg_255_7[]={0,36,72,109,145,182,218,255}; // index *255/7
+-
+ 		r =  rg_255_7[((j >> 5) & 0x07)];
+ 		g =  rg_255_7[((j >> 2) & 0x07)];
+ 		b =  b_255_3[((j >> 0) & 0x03)];
+-// ---------------
+ 		image.setColor( j, qRgb( r, g, b ) );
+ 	}
+ 
+@@ -104,7 +96,7 @@ KDE_EXPORT void kimgio_xv_read( QImageIO
+ 	_imageio->setImage( image );
+ 	_imageio->setStatus( 0 );
+ 
+-	delete [] block;
++	free(block);
+ 	return;
+ }
+ 
diff --git a/x11/kdelibs3/patches/patch-di b/x11/kdelibs3/patches/patch-di
new file mode 100644
index 00000000000..0b9a4a0f98a
--- /dev/null
+++ b/x11/kdelibs3/patches/patch-di
@@ -0,0 +1,39 @@
+$NetBSD: patch-di,v 1.1 2005/05/01 04:35:40 markd Exp $
+
+--- kimgio/pcx.h.orig	2003-01-04 13:48:25.000000000 +1300
++++ kimgio/pcx.h
+@@ -49,7 +49,7 @@ class Palette
+       rgb[ i ] = RGB( color );
+     }
+ 
+-    QRgb color( int i )
++    QRgb color( int i ) const
+     {
+       return qRgb( rgb[ i ].r, rgb[ i ].g, rgb[ i ].b );
+     }
+@@ -60,12 +60,11 @@ class Palette
+ class PCXHEADER
+ {
+   public:
+-    PCXHEADER()
+-    {
+-      reset();
+-    }
++    PCXHEADER();
+ 
+-    void reset();
++    inline int width() const { return ( XMax-XMin ) + 1; }
++    inline int height() const { return ( YMax-YMin ) + 1; }
++    inline bool isCompressed() const { return ( Encoding==1 ); }
+ 
+     Q_UINT8  Manufacturer;    // Constant Flag, 10 = ZSoft .pcx
+     Q_UINT8  Version;         // Version information·
+@@ -99,7 +98,7 @@ class PCXHEADER
+                               // found only in PB IV/IV Plus
+     Q_UINT16 VScreenSize;     // Vertical screen size in pixels. New field
+                               // found only in PB IV/IV Plus
+-};
++} KDE_PACKED;
+ 
+ #endif // PCX_H
+ 
diff --git a/x11/kdelibs3/patches/patch-dj b/x11/kdelibs3/patches/patch-dj
new file mode 100644
index 00000000000..9111601de2c
--- /dev/null
+++ b/x11/kdelibs3/patches/patch-dj
@@ -0,0 +1,65 @@
+$NetBSD: patch-dj,v 1.1 2005/05/01 04:35:40 markd Exp $
+
+--- kimgio/psd.cpp.orig	2004-12-16 22:59:07.000000000 +1300
++++ kimgio/psd.cpp
+@@ -66,6 +66,19 @@ namespace {	// Private.
+ 		s >> header.color_mode;
+ 		return s;
+ 	}
++        static bool seekBy(QDataStream& s, unsigned int bytes)
++        {
++                char buf[4096];
++                while (bytes) {
++                        unsigned int num= QMIN(bytes,sizeof(buf));
++                        unsigned int l = num;
++                        s.readRawBytes(buf, l);
++                        if(l != num)
++                          return false;
++                        bytes -= num;
++                }
++                return true;
++        }
+ 
+ 	// Check that the header is a valid PSD.
+ 	static bool IsValid( const PSDHeader & header )
+@@ -149,10 +162,8 @@ namespace {	// Private.
+ 		if( compression ) {
+ 		
+ 			// Skip row lengths.
+-			ushort w;
+-			for(uint i = 0; i < header.height * header.channel_count; i++) {
+-	  			s >> w;
+-			}	
++                        if(!seekBy(s, header.height*header.channel_count*sizeof(ushort)))
++                                return false;
+ 
+ 			// Read RLE data.						
+ 			for(uint channel = 0; channel < channel_num; channel++) {
+@@ -162,6 +173,8 @@ namespace {	// Private.
+ 				uint count = 0;
+ 				while( count < pixel_count ) {
+ 					uchar c;
++                                        if(s.atEnd())
++                                                return false;
+ 					s >> c;
+ 					uint len = c;
+ 					
+@@ -169,6 +182,9 @@ namespace {	// Private.
+ 						// Copy next len+1 bytes literally.
+ 						len++;
+ 						count += len;
++                                                if ( count > pixel_count )
++                                                        return false;
++
+ 						while( len != 0 ) {
+ 							s >> *ptr;
+ 							ptr += 4;
+@@ -181,6 +197,8 @@ namespace {	// Private.
+ 						len ^= 0xFF;
+ 						len += 2;
+ 						count += len;
++                                                if(s.atEnd() || count > pixel_count)
++                                                        return false;
+ 						uchar val;
+ 						s >> val;
+ 						while( len != 0 ) {
diff --git a/x11/kdelibs3/patches/patch-dk b/x11/kdelibs3/patches/patch-dk
new file mode 100644
index 00000000000..dc8d0a34ba6
--- /dev/null
+++ b/x11/kdelibs3/patches/patch-dk
@@ -0,0 +1,55 @@
+$NetBSD: patch-dk,v 1.1 2005/05/01 04:35:40 markd Exp $
+
+--- kimgio/rgb.cpp.orig	2005-02-04 12:33:17.000000000 +1300
++++ kimgio/rgb.cpp
+@@ -87,7 +87,9 @@ bool SGIImage::getRow(uchar *dest)
+ 	int n, i;
+ 	if (!m_rle) {
+ 		for (i = 0; i < m_xsize; i++) {
+-			*dest++ = uchar(*m_pos);
++			if(m_pos >= m_data.end())
++				return false;
++			dest[i] = uchar(*m_pos);
+ 			m_pos += m_bpc;
+ 		}
+ 		return true;
+@@ -120,7 +122,7 @@ bool SGIImage::readData(QImage& img)
+ {
+ 	QRgb *c;
+ 	Q_UINT32 *start = m_starttab;
+-	QCString lguard(m_xsize);
++	QByteArray lguard(m_xsize);
+ 	uchar *line = (uchar *)lguard.data();
+ 	unsigned x, y;
+ 
+@@ -128,7 +130,7 @@ bool SGIImage::readData(QImage& img)
+ 		m_pos = m_data.begin();
+ 
+ 	for (y = 0; y < m_ysize; y++) {
+-		c = reinterpret_cast<QRgb *>(img.scanLine(m_ysize - y - 1));
++		c = (QRgb *) img.scanLine(m_ysize - y - 1);
+ 		if (m_rle)
+ 			m_pos = m_data.begin() + *start++;
+ 		if (!getRow(line))
+@@ -166,11 +168,11 @@ bool SGIImage::readData(QImage& img)
+ 	}
+ 
+ 	for (y = 0; y < m_ysize; y++) {
+-		c = reinterpret_cast<QRgb *>(img.scanLine(m_ysize - y - 1));
+ 		if (m_rle)
+ 			m_pos = m_data.begin() + *start++;
+ 		if (!getRow(line))
+ 			return false;
++		c = (QRgb*) img.scanLine(m_ysize - y - 1);
+ 		for (x = 0; x < m_xsize; x++, c++)
+ 			*c = qRgba(qRed(*c), qGreen(*c), qBlue(*c), line[x]);
+ 	}
+@@ -270,7 +272,7 @@ bool SGIImage::readImage(QImage& img)
+ 	// sanity ckeck
+ 	if (m_rle)
+ 		for (uint o = 0; o < m_numrows; o++)
+-			if (m_starttab[o] + m_lengthtab[o] > m_data.size()) {
++			if (m_starttab[o] + m_lengthtab[o] >= m_data.size()) {
+ 				kdDebug(399) << "image corrupt (sanity check failed)" << endl;
+ 				return false;
+ 			}