Security update

diff --git a/app-text/gv/ChangeLog b/app-text/gv/ChangeLog
index bb8dd8283a3d9774c58767e9f2a6778fe6f12ce1..660aea29213e9eef3da390f2fb0a2f6eaf8695af 100644 (file)
--- a/app-text/gv/ChangeLog
+++ b/app-text/gv/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for app-text/gv
 # Copyright 2002 Gentoo Technologies, Inc.; Distributed under the GPL
-# $Header: /var/cvsroot/gentoo-x86/app-text/gv/ChangeLog,v 1.4 2002/08/08 14:03:34 seemant Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/gv/ChangeLog,v 1.5 2002/10/03 09:25:07 aliz Exp $
+
+*gv-3.5.8-r2 (03 Oct 2002)
+
+  03 Oct 2002; Daneil Ahlberg <aliz@gentoo.org> gv-3.5.8-r2.ebuild :
+  Security update.
 
 *gv-3.5.8-r1 (1 Feb 2002)
 

diff --git a/app-text/gv/files/digest-gv-3.5.8-r2 b/app-text/gv/files/digest-gv-3.5.8-r2
new file mode 100644 (file)
index 0000000..64a808e
--- /dev/null
+++ b/app-text/gv/files/digest-gv-3.5.8-r2
@@ -0,0 +1 @@
+MD5 8f2f0bd97395d6cea52926ddee736da8 gv-3.5.8.tar.gz 369609

diff --git a/app-text/gv/files/gv-3.5.8-r2-gentoo.diff b/app-text/gv/files/gv-3.5.8-r2-gentoo.diff
new file mode 100644 (file)
index 0000000..4be1611
--- /dev/null
+++ b/app-text/gv/files/gv-3.5.8-r2-gentoo.diff
@@ -0,0 +1,81 @@
+diff -ur gv-3.5.8.orig/source/file.c gv-3.5.8/source/file.c
+--- gv-3.5.8.orig/source/file.c        1997-06-07 00:00:00.000000000 +0200
++++ gv-3.5.8/source/file.c     2002-09-26 23:56:00.000000000 +0200
+@@ -285,6 +285,22 @@
+ }
+ 
+ /*############################################################*/
++/* file_nameIsDangerous */
++/*############################################################*/
++
++char *file_charsAllowedInName = "+,-./:=@\\^_";
++
++int
++file_nameIsDangerous(fn)
++  char *fn;
++{
++  for (; *fn; fn++)
++    if (!isalnum(*fn) && !strchr(file_charsAllowedInName, *fn))
++      return(1);
++  return(0);
++}
++
++/*############################################################*/
+ /* file_pdfname2psname */
+ /* If the file ends in .pdf, change this to .ps.*/
+ /* Return pointer to temp copy if changed, else to input string. */
+diff -ur gv-3.5.8.orig/source/file.h gv-3.5.8/source/file.h
+--- gv-3.5.8.orig/source/file.h        1997-04-26 00:00:00.000000000 +0200
++++ gv-3.5.8/source/file.h     2002-09-26 23:28:38.000000000 +0200
+@@ -70,6 +70,14 @@
+ #endif
+ );
+ 
++extern char *file_charsAllowedInName;
++
++extern int                    file_nameIsDangerous (
++#if NeedFunctionPrototypes
++   char *
++#endif
++);
++
+ extern char*                  file_pdfname2psname (
+ #if NeedFunctionPrototypes
+    char *     /* name */
+diff -ur gv-3.5.8.orig/source/ps.c gv-3.5.8/source/ps.c
+--- gv-3.5.8.orig/source/ps.c  1997-06-07 00:00:00.000000000 +0200
++++ gv-3.5.8/source/ps.c       2002-09-27 00:29:35.000000000 +0200
+@@ -420,6 +420,16 @@
+       char cmd[512];
+       char s[512];
+       filename_unc=file_getTmpFilename(NULL,filename_raw);
++      if (file_nameIsDangerous(filename))
++      {
++        INFMESSAGE(the filename is dangerous)
++        sprintf(s, "The filename \"%s\" is dangerous: only alphanumeric "
++                "characters and \"%s\" are allowed.\n",
++                filename, file_charsAllowedInName);
++        NotePopupShowMessage(s);
++        ENDMESSAGE(psscan)
++        return(NULL);
++      }
+       sprintf(cmd,cmd_uncompress,filename,filename_unc);
+       INFMESSAGE(is compressed)
+       INFSMESSAGE(uncompress command,cmd)
+@@ -491,6 +501,16 @@
+       char cmd[512];
+       char s[512];
+       filename_dsc=file_getTmpFilename(NULL,filename_raw);
++      if (file_nameIsDangerous(filename))
++      {
++        INFMESSAGE(the filename is dangerous)
++        sprintf(s, "The filename \"%s\" is dangerous: only alphanumeric "
++                "characters and \"%s\" are allowed.\n",
++                filename, file_charsAllowedInName);
++        NotePopupShowMessage(s);
++        ENDMESSAGE(psscan)
++        return(NULL);
++      }
+       sprintf(cmd,cmd_scan_pdf,filename,filename_dsc);
+       INFMESSAGE(is PDF)
+       INFSMESSAGE(scan command,cmd)

diff --git a/app-text/gv/gv-3.5.8-r2.ebuild b/app-text/gv/gv-3.5.8-r2.ebuild
new file mode 100644 (file)
index 0000000..151a254
--- /dev/null
+++ b/app-text/gv/gv-3.5.8-r2.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2002 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License, v2 or later
+# $Header: /var/cvsroot/gentoo-x86/app-text/gv/gv-3.5.8-r2.ebuild,v 1.1 2002/10/03 09:25:07 aliz Exp $
+
+# this r1 is a major change. it uses sed instead of patches.
+# hopefully this will enable everyone to compile gv on widely
+# different configurations, eliminating the gv.man/gv._man problem
+
+S=${WORKDIR}/${P}
+DESCRIPTION="gv is a standard ghostscript frontend used e.g. by LyX"
+SRC_URI="ftp://ftpthep.physik.uni-mainz.de/pub/gv/unix/${P}.tar.gz"
+HOMEPAGE="http://wwwthep.physik.uni-mainz.de/~plass/gv/"
+
+SLOT="0"
+LICENSE="GPL-2"
+KEYWORDS="ppc x86"
+
+# There's probably more, but ghostscript also depends on it,
+# so I can't identify it
+DEPEND="virtual/x11
+       x11-libs/Xaw3d
+       app-text/ghostscript"
+
+src_unpack() {
+       unpack ${A}
+       cd ${S}
+       patch -p1 < ${FILESDIR}/${PF}-gentoo.diff
+}
+
+src_compile() {
+       
+       cp config.Unix 1
+       sed -e 's:usr/local:usr:' 1 > config.Unix
+       rm 1
+       
+       xmkmf || die
+       make Makefiles || die
+       
+       cd source
+
+       cp Makefile 1
+       cat 1 | sed -e 's/install.man:: gv.man/install.man::/' \
+               -e 's/all:: gv./\#all:: gv./' \
+               -e '/gv.man/ c \#removed by sed for ebuilding' > Makefile
+       rm 1
+       if [ ! "`grep gv.man Makefile`" = "" ];
+       then
+               echo "sed didn't completely remove gv.man references from the Makefile."
+               echo "We'll just run make and pray."
+               sleep 2s
+       fi
+       
+
+       cd ${S}
+       emake || die
+}
+
+src_install () {
+       
+       cd ${S}
+       make DESTDIR=${D} install || die
+       # make DESTDIR=${D} install.man  || die # don't use this!!!
+       make GV_DOCDIR=${D}/usr/share/doc/${PF} install.doc || die
+       
+       cd ${S}/doc
+       cp gv.man gv.man.1
+       doman gv.man.1
+}