diff options
-rw-r--r-- | fonts/fontforge/Makefile | 4 | ||||
-rw-r--r-- | fonts/fontforge/distinfo | 5 | ||||
-rw-r--r-- | fonts/fontforge/patches/patch-aj | 13 | ||||
-rw-r--r-- | fonts/fontforge/patches/patch-ak | 13 | ||||
-rw-r--r-- | fonts/fontforge/patches/patch-al | 54 |
5 files changed, 86 insertions, 3 deletions
diff --git a/fonts/fontforge/Makefile b/fonts/fontforge/Makefile index 532c032c4b7..72cc6870d22 100644 --- a/fonts/fontforge/Makefile +++ b/fonts/fontforge/Makefile @@ -1,8 +1,8 @@ -# $NetBSD: Makefile,v 1.67 2010/10/10 18:44:53 wiz Exp $ +# $NetBSD: Makefile,v 1.68 2010/12/07 16:58:12 drochner Exp $ DISTNAME= fontforge_full-${VERSION} PKGNAME= fontforge-${VERSION} -PKGREVISION= 3 +PKGREVISION= 4 CATEGORIES= fonts editors MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=fontforge/} EXTRACT_SUFX= .tar.bz2 diff --git a/fonts/fontforge/distinfo b/fonts/fontforge/distinfo index fad6e8fe31e..19d14497def 100644 --- a/fonts/fontforge/distinfo +++ b/fonts/fontforge/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.53 2010/10/10 18:44:53 wiz Exp $ +$NetBSD: distinfo,v 1.54 2010/12/07 16:58:12 drochner Exp $ SHA1 (fontforge_full-20100501.tar.bz2) = 483425116c6af6ad90e37f9ada0c28e34f251ec3 RMD160 (fontforge_full-20100501.tar.bz2) = 4dee2ecdbd32bf3854105f195984d9cabf198fd8 @@ -7,3 +7,6 @@ SHA1 (patch-aa) = e6846a21c973aaa265bb46ba63d145d5f9c00714 SHA1 (patch-ab) = ec93a47051186bcb901fd145edffad7c457c33fd SHA1 (patch-ae) = ca532490137e83ff328ad32c0102d57bed7bb453 SHA1 (patch-ai) = 4b30556509007d1c74ccdfc9d27f7f23f30bbdb1 +SHA1 (patch-aj) = cb38a2569357af3aa3c1f728afaf4d19f1c0f1ce +SHA1 (patch-ak) = b158179cb8a8cedb2f507c7864d482278105dd39 +SHA1 (patch-al) = f34104791646030bb76df20e5ddb88bf21842b02 diff --git a/fonts/fontforge/patches/patch-aj b/fonts/fontforge/patches/patch-aj new file mode 100644 index 00000000000..c909d006c68 --- /dev/null +++ b/fonts/fontforge/patches/patch-aj @@ -0,0 +1,13 @@ +$NetBSD: patch-aj,v 1.1 2010/12/07 16:58:12 drochner Exp $ + +--- gutils/gimagereadpng.c.orig 2010-04-29 03:53:22.000000000 +0000 ++++ gutils/gimagereadpng.c +@@ -78,7 +78,7 @@ return( 0 ); + } + + # if !defined(_LIBPNG12) +- libpng = dlopen("libpng" SO_EXT,RTLD_LAZY); ++ libpng = dlopen("libpng14" SO_EXT,RTLD_LAZY); + # ifdef SO_2_EXT + if ( libpng==NULL ) + libpng = dlopen("libpng" SO_2_EXT,RTLD_LAZY); diff --git a/fonts/fontforge/patches/patch-ak b/fonts/fontforge/patches/patch-ak new file mode 100644 index 00000000000..ad2a94b1c5b --- /dev/null +++ b/fonts/fontforge/patches/patch-ak @@ -0,0 +1,13 @@ +$NetBSD: patch-ak,v 1.1 2010/12/07 16:58:12 drochner Exp $ + +--- gutils/gimagewritepng.c.orig 2010-04-29 17:52:54.000000000 +0000 ++++ gutils/gimagewritepng.c +@@ -66,7 +66,7 @@ static int loadpng() { + return( 0 ); + } + # if !defined(_LIBPNG12) +- libpng = dlopen("libpng" SO_EXT,RTLD_LAZY); ++ libpng = dlopen("libpng14" SO_EXT,RTLD_LAZY); + # ifdef SO_2_EXT + if ( libpng==NULL ) + libpng = dlopen("libpng" SO_2_EXT,RTLD_LAZY); diff --git a/fonts/fontforge/patches/patch-al b/fonts/fontforge/patches/patch-al new file mode 100644 index 00000000000..92b0c073218 --- /dev/null +++ b/fonts/fontforge/patches/patch-al @@ -0,0 +1,54 @@ +$NetBSD: patch-al,v 1.1 2010/12/07 16:58:12 drochner Exp $ + +CVE-2010-4259 + +--- fontforge/fvimportbdf.c.orig 2010-04-16 03:02:02.000000000 +0000 ++++ fontforge/fvimportbdf.c +@@ -560,7 +560,7 @@ static int slurp_header(FILE *bdf, int * + } + + if ( strcmp(tok,"FONT")==0 ) { +- if ( sscanf(buf,"-%*[^-]-%[^-]-%[^-]-%[^-]-%*[^-]-", family, weight, italic )!=0 ) { ++ if ( sscanf(buf,"-%*[^-]-%99[^-]-%99[^-]-%99[^-]-%*[^-]-", family, weight, italic )!=0 ) { + char *pt=buf; + int dcnt=0; + while ( *pt=='-' && dcnt<7 ) { ++pt; ++dcnt; } +@@ -616,26 +616,30 @@ static int slurp_header(FILE *bdf, int * + sscanf(buf, "%d", &defs->metricsset ); + else if ( strcmp(tok,"VVECTOR")==0 ) + sscanf(buf, "%*d %d", &defs->vertical_origin ); ++ /* For foundry, fontname and encname, only copy up to the buffer size */ + else if ( strcmp(tok,"FOUNDRY")==0 ) +- sscanf(buf, "%[^\"]", foundry ); ++ sscanf(buf, "%99[^\"]", foundry ); + else if ( strcmp(tok,"FONT_NAME")==0 ) +- sscanf(buf, "%[^\"]", fontname ); ++ sscanf(buf, "%99[^\"]", fontname ); + else if ( strcmp(tok,"CHARSET_REGISTRY")==0 ) +- sscanf(buf, "%[^\"]", encname ); ++ sscanf(buf, "%99[^\"]", encname ); + else if ( strcmp(tok,"CHARSET_ENCODING")==0 ) { + enc = 0; + if ( sscanf(buf, " %d", &enc )!=1 ) + sscanf(buf, "%d", &enc ); ++ /* These properties should be copied up to the buffer length too */ + } else if ( strcmp(tok,"FAMILY_NAME")==0 ) { +- strcpy(family,buf); ++ strncpy(family,buf,99); + } else if ( strcmp(tok,"FULL_NAME")==0 || strcmp(tok,"FACE_NAME")==0 ) { +- strcpy(full,buf); ++ strncpy(full,buf,99); + } else if ( strcmp(tok,"WEIGHT_NAME")==0 ) +- strcpy(weight,buf); ++ strncpy(weight,buf,99); + else if ( strcmp(tok,"SLANT")==0 ) +- strcpy(italic,buf); ++ strncpy(italic,buf,99); + else if ( strcmp(tok,"COPYRIGHT")==0 ) { +- strcpy(comments,buf); ++ /* LS: Assume the size of the passed-in buffer is 1000, see below in ++ * COMMENT */ ++ strncpy(comments,buf,999); + found_copyright = true; + } else if ( strcmp(tok,"COMMENT")==0 && !found_copyright ) { + char *pt = comments+strlen(comments); |