From 7f3f36342fe89a4f97b994b53d6353d0b40cb470 Mon Sep 17 00:00:00 2001 From: Justin Lecher Date: Fri, 5 Dec 2014 08:05:53 +0000 Subject: [PATCH] media-libs/jasper: Import security fix from fedora for CVE-2014-9029, #531688 Package-Manager: portage-2.2.15/cvs/Linux x86_64 Manifest-Sign-Key: 0xB9D4F231BD1558AB! --- media-libs/jasper/ChangeLog | 9 +++- media-libs/jasper/Manifest | 35 +++++++------ .../jasper/files/jasper-1.701.0-GL-ac.patch | 11 ++++ .../jasper/files/jasper-1.701.0-GL.patch | 11 ++++ .../jasper/files/jasper-CVE-2014-9029.patch | 29 +++++++++++ .../jasper/files/jasper-pkgconfig.patch | 48 ++++++++++++++++++ media-libs/jasper/jasper-1.900.1-r7.ebuild | 50 +++++++++++++++++++ 7 files changed, 177 insertions(+), 16 deletions(-) create mode 100644 media-libs/jasper/files/jasper-1.701.0-GL-ac.patch create mode 100644 media-libs/jasper/files/jasper-1.701.0-GL.patch create mode 100644 media-libs/jasper/files/jasper-CVE-2014-9029.patch create mode 100644 media-libs/jasper/files/jasper-pkgconfig.patch create mode 100644 media-libs/jasper/jasper-1.900.1-r7.ebuild diff --git a/media-libs/jasper/ChangeLog b/media-libs/jasper/ChangeLog index 37e3489bd8ef..efae02fec4a6 100644 --- a/media-libs/jasper/ChangeLog +++ b/media-libs/jasper/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for media-libs/jasper # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.93 2014/11/03 11:28:07 jlec Exp $ +# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.94 2014/12/05 08:05:52 jlec Exp $ + +*jasper-1.900.1-r7 (05 Dec 2014) + + 05 Dec 2014; Justin Lecher +jasper-1.900.1-r7.ebuild, + +files/jasper-1.701.0-GL.patch, +files/jasper-1.701.0-GL-ac.patch, + +files/jasper-CVE-2014-9029.patch, +files/jasper-pkgconfig.patch: + Import security fix from fedora for CVE-2014-9029, #531688 03 Nov 2014; Justin Lecher -jasper-1.900.1-r5.ebuild: Drop old diff --git a/media-libs/jasper/Manifest b/media-libs/jasper/Manifest index 05c55c38a77e..42a3e28e6c8b 100644 --- a/media-libs/jasper/Manifest +++ b/media-libs/jasper/Manifest @@ -2,27 +2,32 @@ Hash: SHA512 AUX CVE-2011-4516+7.patch 1000 SHA256 4c8973cd8f46aabdccfab850b9fdbda0cc44b443a7fb9d22530b3725ca8e7eef SHA512 00e4b51becb6aed5e98d5e69146232e352a75fc97b5aa1958c2d5e3e27f09a87c7488b1a2b28f98388b4c700568241493e107e7506067eb82121dcab7e09bdb4 WHIRLPOOL 664404ba7488ddd4d2f4cfd90baad0a66ebd318a5110354a98cf5454dab7b3f01c56aff33c31d8ae5fce979b99c8eb2159b3636920656dc8c571fc55620e61eb +AUX jasper-1.701.0-GL-ac.patch 487 SHA256 f0c1794cca1fbee9f7a97f3b47b2a98250cb619526b3c7377b0958fb31b08bd7 SHA512 6f5aef3aba774308720deb5f844681c882d062b317196bdbc81499dd7f9d6fd380b849da3dc5d3b6699940c0090c23eaed43aff4e1aa28bca3e293970243afad WHIRLPOOL 09a905d0db771356976f67df8b049ef045f85062ba1f753b5f5921a8c8be3daefbe5addf2a496ef55fd68cf94a4348a4c2f9de6e84eef3b63860d51d3f95e147 +AUX jasper-1.701.0-GL.patch 553 SHA256 b99a48047f5ac8b8f8db4147a6938b8f918e0f671b76f8d17dc7068fda74d282 SHA512 6038d0a7fc3c3fb288d38eb7d87373aef15365dc2f11d4e985a30f4ba3e669238182f6fcad62e126d66ce51d9f255ec287919af17de0f2c28440c15e01d73994 WHIRLPOOL a460190fa4e20ed25143e649d197f3df67bcc372e55febbebbdea39b25f878036b5af9e2411383807d24fe58c07e997990e006d08d1126619f785c0b0258eec1 +AUX jasper-CVE-2014-9029.patch 1116 SHA256 a43747e7597a2a5108befd4acd31a582101a66096a752e61de853bc860d2a8e1 SHA512 20bac10654ea1b16d741bcc71ca91e484c4238cb285f551a19b1bac4c4cf8ec39bc33f8d3c42dbadd03e85eb667a8e286f208e9b20a5b39429bf8e4454bd9b16 WHIRLPOOL 63244c1a4601de0c3ddcee00edc259062f1effa5e58180ac7e207e8ff71bb019990de6abe4cb1cdefb41dded1a96380aa0dd7bb46f729000c57c1e04abea9bb0 +AUX jasper-pkgconfig.patch 1691 SHA256 325003c739023264f368db2ce30598038706f45a8ec8a5a1f81fa855496e0ed1 SHA512 3cb1fe20b34e46c2d04f17eac6e1831d226368e4a7037be8324eb469b0217e1ad0520bb9d321a0f7c510828ca8505c4c42d4c54045606d0e9f2dad81c8ee21eb WHIRLPOOL 13e97b718827a712a4ee65162e6adafec1672fd9f96e8d773124b91e43c4571d5ab0975802fbf44d10fa2d4f9a895ff1fbd6adeaf817c7e70cfa08198c9425cf DIST jasper-1.900.1-fixes-20120611.patch.bz2 26303 SHA256 8727c94843f141c311be54eed97eca18f96542f52b991df6f7d4f005bad2ec59 SHA512 36ec1735a89008fa6be16698f78ca5ec52d4ef34f10653ba3bf081c665c4e2d747cdbd7bfc0d56859ad4dc0fac166cf08248336d25d3ba8e7feb57e65d5c5ef6 WHIRLPOOL 341639dc208c44eefb18d14b16bc74591989e4ec0bf6426bee1ed161f1c997a23dad487ac821f2bf8e1ae16ae74d6174dce39a913b44b4e24628a7a1510395a7 DIST jasper-1.900.1.zip 1415752 SHA256 6b905a9c2aca2e275544212666eefc4eb44d95d0a57e4305457b407fe63f9494 SHA512 e3a3c803de848b50482f5bd693b1945197c6999285226c45b671855734d7bb2611fbe6f28cd8ba9c56a4ea59417795eba42d72516c9fec93b8fbaa21b8210cb6 WHIRLPOOL cd53901537bb8d32706e82326bf01f7f960af5172e2da738d1fcc9c5a4087829210a177d3df96617cf289e5db8ec97e06aa6cd60ada3b887db65418b90e9a86b EBUILD jasper-1.900.1-r6.ebuild 1370 SHA256 7659d2cfc8c2c19d3243996ed65d1e3ad0ac682c9105405a9fad72f30eab4ddb SHA512 67d6feceb821188c9553ddbf556c2efaa8af8e0c749b1ada527dbddc4edec6d3ea3c1cb99a372226834db976220a45460b15580241dc3bb166f0b7b6a001abd7 WHIRLPOOL 2b8c1969cfe23443674a6b6ca897e5aa2d46181f76571d207049252d9bef5d6c1e85008e4cd08133ea9d27a303c5d051c5c3bda2eea4bdc3198d1cdb22d023c7 -MISC ChangeLog 11519 SHA256 8a9188ff85078a9c8e41562bec920d7197a2c7d5302182811555ae5cbc78d2d7 SHA512 408586b9d82c49d30179c64abb5c21b7857c29e0243ba120a4a5d9c3a567c706a093119de54cdbaf285f36b5350be93b04a6a7c38ba48daeb624877a7893476d WHIRLPOOL 9ee5964bf200b9c68ea2332f4a5c14411a3fd26e42ac952beacfedee395eab8d3e6ce30b2ba62eea50c1d78dd2eaf3266c989fb6d29e3aedff555242e386f914 +EBUILD jasper-1.900.1-r7.ebuild 1529 SHA256 fd7f5e56dbd64032e85925342f2efd4860444f9a586261855188fce230919370 SHA512 5c9001c17917c3692ef34d039fabbf36fb3253d3299a40bdb725dac23acaba22e81ff3ec94fb227959619eb5044f5bea1fe3ea3f30bd0c7d068485ef5893c54b WHIRLPOOL 1126732a156b0b29ae600cd3a1c06ec8ec51feb2b7d60968ce2cc18772830af7691f7d17f77c1215ab0fe021f6b128b0c987e16467cbe461a4a4583c08a718bc +MISC ChangeLog 11826 SHA256 dcd96fafe267b99ca2c337aba2c70a8f255cc9a029307070e9093371b2b73fa7 SHA512 7d218910902607239df4fbf307c231519af2d1f97a0915db4c847878c1573243cffc7f95bef6b980630a48db21dee45d4cdac9d2c557b3a3eb86e29a1a027b0a WHIRLPOOL 361c92f3d5b93815671a2db379bba7bf904b80523b637ce52cf21741223e751cf01559f2b41c4a077fac9ec9b47e059c4dd47652ff5894802629530c15d9b34a MISC metadata.xml 158 SHA256 dae7918daac89b300804812d32584889aa1c4e8b9edeced06006900494457a6d SHA512 e4901a5df84502b46aa85ec01804ce680332cebe6148e4a9c8201a38935ee0d4a753bcdb3f18765b06019926a05bf099c0ed61395aa98211610ab7fdb8d7f895 WHIRLPOOL 2f12466ef66cc7b89ec428cd4b498b20f12ca6dbb219f180ac12985dfc4195882ea95809797828a720fe69a0e560d12de9c271f8aacaa06fba09c9c1ccd589e5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0 -iQJ8BAEBCgBmBQJUV2bIXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w +iQJ8BAEBCgBmBQJUgWdhXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyQ0JDQjFGMzBDQ0UxMjFGNENDNDgxMDdC -OUQ0RjIzMUJEMTU1OEFCAAoJELnU8jG9FVir8kAP+gNE6L0RTXRj0FeSy6yF4/wi -9RHH5UxSDRvU6K/Uf8kwgvZbVL1SJHEmbZfZ24o6D0huyQzIb8kos401M1b91Xu6 -dTDZoQ08fk/byfhRIt0tO+hGtIIwhKRYkFCsSvku1rexqcu3UAAf1pVKOSJWOPeY -dv1nzM1MvokLygEyhYYXPYwuOAweNaePMvhBy6X2XskjPNwDcqCB+/5cxDrfGK8O -pfPDp8FgZy4Am/u9ISRdBqt0krYw7tKNTozTl8Co77SfefJBT/4CoKv+iKTGxZFa -W5RnO7rePF8QvDiEpzZw6eK+hO/gGtQxmArbDRqMrjGrpiSSd4nvEsAOwWLd0Rvk -NrMLBJikXWqCVRIsi80RlnjSMarbeJQs+gtG3ycgniw9wGlnaGshVOuBUh/gPx7i -JGmyvEINGSxVmcHAdU83vlTLgq0xQIE5HeaEZytQF6yEFKGK1Vd5sv9oi0d/UGvt -UhhnrApq96BFKNdKuvffZ85qf4cpAUW4D+1uovJ08GLGBM/PPPKYq5CAnTpWOhy9 -d/sIxOGLOBwblrtOHOvJ9kYR4t0tZi65QXtH69PisJGQLfFjC45bdpOByGExQMpo -2ngBE4wr8Z4cLef11eUwa6Q4D6tfhtoUWpJQxblD8OG5W5o7gPUPfDKTxvp7YcAX -jdwr9HzCkjalGYta9Q+i -=ir6f +OUQ0RjIzMUJEMTU1OEFCAAoJELnU8jG9FVirUf4QAJ5Fb/uUkFcCxCx662k0nGyn +m50Iv1TfHI57QS9ds4bSlOphTySpdORYyK6P2SDIsTGt6b9ujPkNZj7OnUXDMEuT +dF+0gYf5UHzq6UaBq4M8JGVO8wvTrfX4giSc8Wve0tpOq84/AhjiVk02J5AkAxE1 +pkNBCoU/rgA69BnEiKvbAiK1NSVFMCJUpOly2FxU4x9CZHNyudL5ATnAkI1B2eMY ++a3nqr6MH+DT/SlZ+GkHv3hs0VfZRaVhWVUZBon/Qu3PC7wnvTM0FyPyrOOlHLNu +2KYY/keK9zRl1u5jjtZ0RNgUmgS6TUi7KZqm4kpX2ltUwDTxxAgYXa4wEsJNsF9/ +ph2J+T4eM7bU+JpUbGLOVlc37kM2Qzv/T+DH0pPAL3uja7e0S2WTmd0pldSs11Ew +FsayI81SR33shVevh28gp8CTPEmXpyfEdEiM9eCiIgY6HxvObkyaWRZlkp9Wtaxd +ZyAqUX8R58TTTQxddGIgVLTh3UcSh0XGXektDa9E4BCOOrb6s53y08UzONA9uwbk +Nn6EBKx2xyoQ20KhHwhIn9RuFsn3ZsrM3PWfNPH6EFyRBtEtzEH4QcdiNxrzNXJx +UkNnfs0ls7FtxNRsV0W36Q9O4YPoGKCsobkxzFvwKnzW64f0A3qPkd8NQfKu6/rW ++gq7ac3E6o1p8q4j7kkm +=P2si -----END PGP SIGNATURE----- diff --git a/media-libs/jasper/files/jasper-1.701.0-GL-ac.patch b/media-libs/jasper/files/jasper-1.701.0-GL-ac.patch new file mode 100644 index 000000000000..bf571433c0b8 --- /dev/null +++ b/media-libs/jasper/files/jasper-1.701.0-GL-ac.patch @@ -0,0 +1,11 @@ +--- jasper-1.701.0.GEO/configure.ac.GL 2006-02-20 19:58:02.000000000 -0600 ++++ jasper-1.701.0.GEO/configure.ac 2006-02-24 07:40:38.000000000 -0600 +@@ -242,7 +242,7 @@ + OPENGL_LIBS="" + if test $ENABLE_OPENGL = yes; then + if test $HAVE_OPENGL = no; then +- TMPLIBS="-lglut -lGL -lGLU $X_PRE_LIBS -lX11 -lXmu -lXi -lXext -lXt $X_EXTRA_LIBS $X_LIBS" ++ TMPLIBS="-lglut -lGL -lGLU" + AC_CHECK_LIB(glut, glutInit, [HAVE_OPENGL=yes; + OPENGL_LIBS=$TMPLIBS], HAVE_OPENGL=no, $TMPLIBS) + fi diff --git a/media-libs/jasper/files/jasper-1.701.0-GL.patch b/media-libs/jasper/files/jasper-1.701.0-GL.patch new file mode 100644 index 000000000000..ba199e226faf --- /dev/null +++ b/media-libs/jasper/files/jasper-1.701.0-GL.patch @@ -0,0 +1,11 @@ +--- jasper-1.701.0.GEO/configure.GL 2006-02-20 20:01:30.000000000 -0600 ++++ jasper-1.701.0.GEO/configure 2006-02-24 07:40:46.000000000 -0600 +@@ -9464,7 +9464,7 @@ + OPENGL_LIBS="" + if test $ENABLE_OPENGL = yes; then + if test $HAVE_OPENGL = no; then +- TMPLIBS="-lglut -lGL -lGLU $X_PRE_LIBS -lX11 -lXmu -lXi -lXext -lXt $X_EXTRA_LIBS $X_LIBS" ++ TMPLIBS="-lglut -lGL -lGLU" + echo "$as_me:$LINENO: checking for glutInit in -lglut" >&5 + echo $ECHO_N "checking for glutInit in -lglut... $ECHO_C" >&6 + if test "${ac_cv_lib_glut_glutInit+set}" = set; then diff --git a/media-libs/jasper/files/jasper-CVE-2014-9029.patch b/media-libs/jasper/files/jasper-CVE-2014-9029.patch new file mode 100644 index 000000000000..98a2035999be --- /dev/null +++ b/media-libs/jasper/files/jasper-CVE-2014-9029.patch @@ -0,0 +1,29 @@ +--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:45:44.000000000 +0100 ++++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:44:58.000000000 +0100 +@@ -1281,7 +1281,7 @@ static int jpc_dec_process_coc(jpc_dec_t + jpc_coc_t *coc = &ms->parms.coc; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, coc->compno) > dec->numcomps) { ++ if (JAS_CAST(int, coc->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in COC marker segment\n"); + return -1; + } +@@ -1307,7 +1307,7 @@ static int jpc_dec_process_rgn(jpc_dec_t + jpc_rgn_t *rgn = &ms->parms.rgn; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, rgn->compno) > dec->numcomps) { ++ if (JAS_CAST(int, rgn->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in RGN marker segment\n"); + return -1; + } +@@ -1356,7 +1356,7 @@ static int jpc_dec_process_qcc(jpc_dec_t + jpc_qcc_t *qcc = &ms->parms.qcc; + jpc_dec_tile_t *tile; + +- if (JAS_CAST(int, qcc->compno) > dec->numcomps) { ++ if (JAS_CAST(int, qcc->compno) >= dec->numcomps) { + jas_eprintf("invalid component number in QCC marker segment\n"); + return -1; + } diff --git a/media-libs/jasper/files/jasper-pkgconfig.patch b/media-libs/jasper/files/jasper-pkgconfig.patch new file mode 100644 index 000000000000..c8af5ca83f49 --- /dev/null +++ b/media-libs/jasper/files/jasper-pkgconfig.patch @@ -0,0 +1,48 @@ +diff -Naur jasper-1.900.1/configure.ac jasper-1.900.1.new/configure.ac +--- jasper-1.900.1/configure.ac 2007-01-19 21:47:11.000000000 +0000 ++++ jasper-1.900.1.new/configure.ac 2009-10-29 13:37:02.000000000 +0000 +@@ -399,6 +399,8 @@ + src/libjasper/pnm/Makefile + src/libjasper/ras/Makefile + src/msvc/Makefile ++pkgconfig/Makefile ++pkgconfig/jasper.pc + jasper.spec + ]) + AC_OUTPUT +diff -Naur jasper-1.900.1/Makefile.am jasper-1.900.1.new/Makefile.am +--- jasper-1.900.1/Makefile.am 2007-01-19 21:43:14.000000000 +0000 ++++ jasper-1.900.1.new/Makefile.am 2009-10-29 13:36:28.000000000 +0000 +@@ -64,7 +64,7 @@ + # Note: We need to put the derived file "jasper.spec" in the distribution + # in order to facilitate RPM building. + +-SUBDIRS = src ++SUBDIRS = src pkgconfig + + rpm: dist + for i in BUILD RPMS SRPMS SOURCES SPECS; do \ +diff -Naur jasper-1.900.1/pkgconfig/jasper.pc.in jasper-1.900.1.new/pkgconfig/jasper.pc.in +--- jasper-1.900.1/pkgconfig/jasper.pc.in 1970-01-01 01:00:00.000000000 +0100 ++++ jasper-1.900.1.new/pkgconfig/jasper.pc.in 2009-10-29 16:30:43.000000000 +0000 +@@ -0,0 +1,11 @@ ++prefix=@prefix@ ++exec_prefix=@exec_prefix@ ++libdir=@libdir@ ++includedir=@includedir@ ++ ++Name: Jasper ++Description: JPEG 2000 encoding and decoding library ++Version: @VERSION@ ++ ++Libs: -L${libdir} -ljasper ++Cflags: -I${includedir}/jasper +diff -Naur jasper-1.900.1/pkgconfig/Makefile.am jasper-1.900.1.new/pkgconfig/Makefile.am +--- jasper-1.900.1/pkgconfig/Makefile.am 1970-01-01 01:00:00.000000000 +0100 ++++ jasper-1.900.1.new/pkgconfig/Makefile.am 2009-10-29 13:38:59.000000000 +0000 +@@ -0,0 +1,5 @@ ++pkgconfigdir = $(libdir)/pkgconfig ++pkgconfig_DATA = jasper.pc ++ ++EXTRA_DIST = \ ++ jasper.pc.in diff --git a/media-libs/jasper/jasper-1.900.1-r7.ebuild b/media-libs/jasper/jasper-1.900.1-r7.ebuild new file mode 100644 index 000000000000..8957410a54a1 --- /dev/null +++ b/media-libs/jasper/jasper-1.900.1-r7.ebuild @@ -0,0 +1,50 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/jasper-1.900.1-r7.ebuild,v 1.1 2014/12/05 08:05:52 jlec Exp $ + +EAPI=5 + +# outdated './configure': breaks in 'USE=opengl ABI_X86="32 64"' case: +# uses /usr/lib64 for 32-bit ABI. +AUTOTOOLS_AUTORECONF=yes + +inherit autotools-multilib + +DESCRIPTION="software-based implementation of the codec specified in the JPEG-2000 Part-1 standard" +HOMEPAGE="http://www.ece.uvic.ca/~mdadams/jasper/" +SRC_URI=" + http://www.ece.uvic.ca/~mdadams/${PN}/software/${P}.zip + mirror://gentoo/${P}-fixes-20120611.patch.bz2" + +LICENSE="JasPer2.0" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x64-solaris ~x86-solaris" +IUSE="jpeg opengl static-libs" + +RDEPEND=" + jpeg? ( >=virtual/jpeg-0-r2:0[${MULTILIB_USEDEP}] ) + opengl? ( + >=virtual/opengl-7.0-r1:0[${MULTILIB_USEDEP}] + >=media-libs/freeglut-2.8.1:0[${MULTILIB_USEDEP}] + virtual/glu + )" +DEPEND="${RDEPEND} + app-arch/unzip" + +PATCHES=( + "${WORKDIR}"/${P}-fixes-20120611.patch + "${FILESDIR}"/${PN}-1.701.0-GL-ac.patch + "${FILESDIR}"/${PN}-1.701.0-GL.patch + "${FILESDIR}"/${PN}-CVE-2014-9029.patch + "${FILESDIR}"/${PN}-pkgconfig.patch + ) + +DOCS=( NEWS README doc/. ) + +src_configure() { + local myeconfargs=( + $(use_enable jpeg libjpeg) + $(use_enable opengl) + ) + autotools-multilib_src_configure +} -- 2.26.2