media-libs/gd: Fix CVE-2018-1000222

Thanks-to: Eddie Chapman <maracay@ehuk.net>
Bug: https://bugs.gentoo.org/664732
Package-Manager: Portage-2.3.49, Repoman-2.3.10

diff --git a/media-libs/gd/files/gd-2.2.5-CVE-2018-1000222.patch b/media-libs/gd/files/gd-2.2.5-CVE-2018-1000222.patch
new file mode 100644 (file)
index 0000000..80f9712
--- /dev/null
+++ b/media-libs/gd/files/gd-2.2.5-CVE-2018-1000222.patch
@@ -0,0 +1,73 @@
+From ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Sat, 14 Jul 2018 13:54:08 -0400
+Subject: [PATCH] bmp: check return value in gdImageBmpPtr
+
+Closes #447.
+---
+ src/gd_bmp.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/src/gd_bmp.c b/src/gd_bmp.c
+index bde0b9d3..78f40d9a 100644
+--- a/src/gd_bmp.c
++++ b/src/gd_bmp.c
+@@ -47,6 +47,8 @@ static int bmp_read_4bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
+ static int bmp_read_8bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp_hdr_t *header);
+ static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info);
+ 
++static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression);
++
+ #define BMP_DEBUG(s)
+ 
+ static int gdBMPPutWord(gdIOCtx *out, int w)
+@@ -87,8 +89,10 @@ BGD_DECLARE(void *) gdImageBmpPtr(gdImagePtr im, int *size, int compression)
+       void *rv;
+       gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
+       if (out == NULL) return NULL;
+-      gdImageBmpCtx(im, out, compression);
+-      rv = gdDPExtractData(out, size);
++      if (!_gdImageBmpCtx(im, out, compression))
++              rv = gdDPExtractData(out, size);
++      else
++              rv = NULL;
+       out->gd_free(out);
+       return rv;
+ }
+@@ -141,6 +145,11 @@ BGD_DECLARE(void) gdImageBmp(gdImagePtr im, FILE *outFile, int compression)
+               compression - whether to apply RLE or not.
+ */
+ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
++{
++      _gdImageBmpCtx(im, out, compression);
++}
++
++static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
+ {
+       int bitmap_size = 0, info_size, total_size, padding;
+       int i, row, xpos, pixel;
+@@ -148,6 +157,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
+       unsigned char *uncompressed_row = NULL, *uncompressed_row_start = NULL;
+       FILE *tmpfile_for_compression = NULL;
+       gdIOCtxPtr out_original = NULL;
++      int ret = 1;
+ 
+       /* No compression if its true colour or we don't support seek */
+       if (im->trueColor) {
+@@ -325,6 +335,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
+               out_original = NULL;
+       }
+ 
++      ret = 0;
+ cleanup:
+       if (tmpfile_for_compression) {
+ #ifdef _WIN32
+@@ -338,7 +349,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
+       if (out_original) {
+               out_original->gd_free(out_original);
+       }
+-      return;
++      return ret;
+ }
+ 
+ static int compress_row(unsigned char *row, int length)

diff --git a/media-libs/gd/gd-2.2.5-r1.ebuild b/media-libs/gd/gd-2.2.5-r1.ebuild
new file mode 100644 (file)
index 0000000..79f1957
--- /dev/null
+++ b/media-libs/gd/gd-2.2.5-r1.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit libtool ltprune multilib-minimal
+
+DESCRIPTION="A graphics library for fast image creation"
+HOMEPAGE="http://libgd.org/ http://www.boutell.com/gd/"
+SRC_URI="https://github.com/libgd/libgd/releases/download/${P}/lib${P}.tar.xz"
+
+LICENSE="gd IJG HPND BSD"
+SLOT="2/3"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="fontconfig jpeg png static-libs tiff truetype webp xpm zlib"
+
+# fontconfig has prefixed font paths, details see bug #518970
+REQUIRED_USE="prefix? ( fontconfig )"
+
+RDEPEND="fontconfig? ( >=media-libs/fontconfig-2.10.92[${MULTILIB_USEDEP}] )
+       jpeg? ( >=virtual/jpeg-0-r2:0=[${MULTILIB_USEDEP}] )
+       png? ( >=media-libs/libpng-1.6.10:0=[${MULTILIB_USEDEP}] )
+       tiff? ( media-libs/tiff:0[${MULTILIB_USEDEP}] )
+       truetype? ( >=media-libs/freetype-2.5.0.1[${MULTILIB_USEDEP}] )
+       webp? ( media-libs/libwebp:=[${MULTILIB_USEDEP}] )
+       xpm? ( >=x11-libs/libXpm-3.5.10-r1[${MULTILIB_USEDEP}] >=x11-libs/libXt-1.1.4[${MULTILIB_USEDEP}] )
+       zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )"
+DEPEND="${RDEPEND}
+       >=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]"
+
+S="${WORKDIR}/lib${P}"
+
+PATCHES=( "${FILESDIR}/${P}-CVE-2018-1000222.patch" )
+
+src_prepare() {
+       default
+       elibtoolize  # for shared library on Solaris
+}
+
+multilib_src_configure() {
+       # we aren't actually {en,dis}abling X here ... the configure
+       # script uses it just to add explicit -I/-L paths which we
+       # don't care about on Gentoo systems.
+       local myeconfargs=(
+               --disable-werror
+               --without-x
+               --without-liq
+               $(use_enable static-libs static)
+               $(use_with fontconfig)
+               $(use_with png)
+               $(use_with tiff)
+               $(use_with truetype freetype)
+               $(use_with jpeg)
+               $(use_with webp)
+               $(use_with xpm)
+               $(use_with zlib)
+       )
+       ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+       dodoc README.md
+       prune_libtool_files
+}