Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879.

Package-Manager: portage-2.1.10.39/cvs/Linux i686

diff --git a/media-libs/jasper/ChangeLog b/media-libs/jasper/ChangeLog
index 0c85ead0dade393a525659fe2b5cc62d0d01b46f..67da394efd209832cf5019d60fd9462b9121b6ee 100644 (file)
--- a/media-libs/jasper/ChangeLog
+++ b/media-libs/jasper/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-libs/jasper
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.59 2011/04/04 19:11:12 scarabeus Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.60 2011/12/17 20:51:25 phosphan Exp $
+
+*jasper-1.900.1-r4 (17 Dec 2011)
+
+  17 Dec 2011; Patrick Kursawe <phosphan@gentoo.org> +jasper-1.900.1-r4.ebuild,
+  +files/CVE-2011-4516+7.patch:
+  Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879.
 
   04 Apr 2011; Tomáš Chvátal <scarabeus@gentoo.org>
   jasper-1.900.1-r3.ebuild:

diff --git a/media-libs/jasper/Manifest b/media-libs/jasper/Manifest
index eba7ea11845112dc05c02f9dc6ac04b724510078..801ae1462d55431cb3dd2b9fa62f1c6577f8dbfd 100644 (file)
--- a/media-libs/jasper/Manifest
+++ b/media-libs/jasper/Manifest
@@ -1,15 +1,17 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
+Hash: SHA256
 
+AUX CVE-2011-4516+7.patch 1000 RMD160 9eec4a6dbe0a88278fce87c4522c856d1073060c SHA1 9661304f97c1bd5e13929f2f385cac0f9017f444 SHA256 4c8973cd8f46aabdccfab850b9fdbda0cc44b443a7fb9d22530b3725ca8e7eef
 DIST jasper-1.900.1-fixes-20081208.patch.bz2 8757 RMD160 bbd45e5aeb32b2575807824986dc2c39a14a46f0 SHA1 31517a7ebc9ce4d0d12a4b7c26133451979ae945 SHA256 5f696527707513fceff1617895afab9500f327262b1b03b330098d8dab3eb1bf
 DIST jasper-1.900.1.zip 1415752 RMD160 fb2c188abf5b8c297078ac1f913101734f72db5c SHA1 9c5735f773922e580bf98c7c7dfda9bbed4c5191 SHA256 6b905a9c2aca2e275544212666eefc4eb44d95d0a57e4305457b407fe63f9494
 EBUILD jasper-1.900.1-r3.ebuild 1226 RMD160 6a443a04884f8431740158db6b8189a639777b3f SHA1 4de5de572db2dd1e4f03cdd265116821b782fd3f SHA256 5be9ba7564acba7f6ec9647a1d5313491a68fbb81e5e737b7b364965258d7e3e
-MISC ChangeLog 7388 RMD160 88768ffb49a26dc38dfaad05827c43ea2fd8ccbe SHA1 c3c8d1faf771e46b842034e34c96ffac53868b8e SHA256 23a577f280bebec41b5c3c49344be082f9bb5b0b16c23bd752e7ae527510a4a7
+EBUILD jasper-1.900.1-r4.ebuild 1278 RMD160 43b765c00b3902afeef659ada919d42c01172150 SHA1 6b0f7440fb53dbc4e5dca8aaee3f372234abe211 SHA256 5ba00db7b153b1420dd5abc19d588f3c77e51622b7ba0c0b6a689691561a4d77
+MISC ChangeLog 7610 RMD160 f1e9fde052d6f3beab536ff47b8aea2aa52caff8 SHA1 6c163fbb7efae090855378e60f1f3de7076b5a48 SHA256 da59d48a61074ae1f746d74395f8e200e66de9f8bf2e223db1f977e3908a810a
 MISC metadata.xml 301 RMD160 91daefdb588e2984774e49daf182936ede2e29f4 SHA1 8d3f29760c4369cb43ae6bc5a8d3032ad1f68d28 SHA256 e10af83464344d5ff709f593848ca25638eb8cfed47fa49ef44b01fdc9a5db32
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.17 (GNU/Linux)
+Version: GnuPG v2.0.18 (GNU/Linux)
 
-iEYEARECAAYFAk2aF6UACgkQHB6c3gNBRYcrjQCfZl5bmfttH4lhOezCNWB30WNI
-k+kAoMEUNA+gNyzPfdhki31QBO5kjPGY
-=QDtc
+iF4EAREIAAYFAk7tANwACgkQfx9sOO7MmlxF4AD+N/KTdrYQJBLLc0BkoTKBI66T
+yMpG+u3YG5pQwW/IWjwA/02q1sdlpLjntKML/emgzfPeDY0G0NzJqcz/RN9L4KMD
+=gXux
 -----END PGP SIGNATURE-----

diff --git a/media-libs/jasper/files/CVE-2011-4516+7.patch b/media-libs/jasper/files/CVE-2011-4516+7.patch
new file mode 100644 (file)
index 0000000..1f1c7bb
--- /dev/null
+++ b/media-libs/jasper/files/CVE-2011-4516+7.patch
@@ -0,0 +1,24 @@
+diff -up jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409 jasper-1.900.1/src/libjasper/jpc/jpc_cs.c
+--- jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409   2011-10-25 17:25:39.000000000 +0200
++++ jasper-1.900.1/src/libjasper/jpc/jpc_cs.c  2011-10-25 17:29:14.379371908 +0200
+@@ -744,6 +744,10 @@ static int jpc_cox_getcompparms(jpc_ms_t
+               return -1;
+       }
+       compparms->numrlvls = compparms->numdlvls + 1;
++      if (compparms->numrlvls > JPC_MAXRLVLS) {
++              jpc_cox_destroycompparms(compparms);
++              return -1;
++      }
+       if (prtflag) {
+               for (i = 0; i < compparms->numrlvls; ++i) {
+                       if (jpc_getuint8(in, &tmp)) {
+@@ -1331,7 +1335,7 @@ static int jpc_crg_getparms(jpc_ms_t *ms
+       jpc_crgcomp_t *comp;
+       uint_fast16_t compno;
+       crg->numcomps = cstate->numcomps;
+-      if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(uint_fast16_t)))) {
++      if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(jpc_crgcomp_t)))) {
+               return -1;
+       }
+       for (compno = 0, comp = crg->comps; compno < cstate->numcomps;
+

diff --git a/media-libs/jasper/jasper-1.900.1-r4.ebuild b/media-libs/jasper/jasper-1.900.1-r4.ebuild
new file mode 100644 (file)
index 0000000..f5792a4
--- /dev/null
+++ b/media-libs/jasper/jasper-1.900.1-r4.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/jasper-1.900.1-r4.ebuild,v 1.1 2011/12/17 20:51:25 phosphan Exp $
+
+EAPI=3
+
+inherit libtool eutils
+
+DESCRIPTION="software-based implementation of the codec specified in the JPEG-2000 Part-1 standard"
+HOMEPAGE="http://www.ece.uvic.ca/~mdadams/jasper/"
+SRC_URI="http://www.ece.uvic.ca/~mdadams/jasper/software/jasper-${PV}.zip
+       mirror://gentoo/${P}-fixes-20081208.patch.bz2"
+
+LICENSE="JasPer2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x64-solaris ~x86-solaris"
+IUSE="jpeg opengl static-libs"
+
+RDEPEND="jpeg? ( virtual/jpeg )
+       opengl? ( virtual/opengl media-libs/freeglut )"
+DEPEND="${RDEPEND}
+       app-arch/unzip"
+
+src_prepare() {
+       epatch "${WORKDIR}"/${P}-fixes-20081208.patch
+       epatch "${FILESDIR}"/CVE-2011-4516+7.patch
+       elibtoolize
+}
+
+src_configure() {
+       econf \
+               $(use_enable jpeg libjpeg) \
+               $(use_enable opengl) \
+               $(use_enable static-libs static) \
+               --enable-shared
+}
+
+src_install() {
+       emake DESTDIR="${D}" install || die
+       dodoc NEWS README doc/*
+       find "${ED}" -name '*.la' -delete
+}