From: Patrick Kursawe Date: Sat, 17 Dec 2011 20:51:25 +0000 (+0000) Subject: Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879. X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=48e740aca3ae275889cfb41b3dfeaa9b32c21703;p=gentoo.git Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879. Package-Manager: portage-2.1.10.39/cvs/Linux i686 --- diff --git a/media-libs/jasper/ChangeLog b/media-libs/jasper/ChangeLog index 0c85ead0dade..67da394efd20 100644 --- a/media-libs/jasper/ChangeLog +++ b/media-libs/jasper/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for media-libs/jasper # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.59 2011/04/04 19:11:12 scarabeus Exp $ +# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.60 2011/12/17 20:51:25 phosphan Exp $ + +*jasper-1.900.1-r4 (17 Dec 2011) + + 17 Dec 2011; Patrick Kursawe +jasper-1.900.1-r4.ebuild, + +files/CVE-2011-4516+7.patch: + Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879. 04 Apr 2011; Tomáš Chvátal jasper-1.900.1-r3.ebuild: diff --git a/media-libs/jasper/Manifest b/media-libs/jasper/Manifest index eba7ea118451..801ae1462d55 100644 --- a/media-libs/jasper/Manifest +++ b/media-libs/jasper/Manifest @@ -1,15 +1,17 @@ -----BEGIN PGP SIGNED MESSAGE----- -Hash: SHA1 +Hash: SHA256 +AUX CVE-2011-4516+7.patch 1000 RMD160 9eec4a6dbe0a88278fce87c4522c856d1073060c SHA1 9661304f97c1bd5e13929f2f385cac0f9017f444 SHA256 4c8973cd8f46aabdccfab850b9fdbda0cc44b443a7fb9d22530b3725ca8e7eef DIST jasper-1.900.1-fixes-20081208.patch.bz2 8757 RMD160 bbd45e5aeb32b2575807824986dc2c39a14a46f0 SHA1 31517a7ebc9ce4d0d12a4b7c26133451979ae945 SHA256 5f696527707513fceff1617895afab9500f327262b1b03b330098d8dab3eb1bf DIST jasper-1.900.1.zip 1415752 RMD160 fb2c188abf5b8c297078ac1f913101734f72db5c SHA1 9c5735f773922e580bf98c7c7dfda9bbed4c5191 SHA256 6b905a9c2aca2e275544212666eefc4eb44d95d0a57e4305457b407fe63f9494 EBUILD jasper-1.900.1-r3.ebuild 1226 RMD160 6a443a04884f8431740158db6b8189a639777b3f SHA1 4de5de572db2dd1e4f03cdd265116821b782fd3f SHA256 5be9ba7564acba7f6ec9647a1d5313491a68fbb81e5e737b7b364965258d7e3e -MISC ChangeLog 7388 RMD160 88768ffb49a26dc38dfaad05827c43ea2fd8ccbe SHA1 c3c8d1faf771e46b842034e34c96ffac53868b8e SHA256 23a577f280bebec41b5c3c49344be082f9bb5b0b16c23bd752e7ae527510a4a7 +EBUILD jasper-1.900.1-r4.ebuild 1278 RMD160 43b765c00b3902afeef659ada919d42c01172150 SHA1 6b0f7440fb53dbc4e5dca8aaee3f372234abe211 SHA256 5ba00db7b153b1420dd5abc19d588f3c77e51622b7ba0c0b6a689691561a4d77 +MISC ChangeLog 7610 RMD160 f1e9fde052d6f3beab536ff47b8aea2aa52caff8 SHA1 6c163fbb7efae090855378e60f1f3de7076b5a48 SHA256 da59d48a61074ae1f746d74395f8e200e66de9f8bf2e223db1f977e3908a810a MISC metadata.xml 301 RMD160 91daefdb588e2984774e49daf182936ede2e29f4 SHA1 8d3f29760c4369cb43ae6bc5a8d3032ad1f68d28 SHA256 e10af83464344d5ff709f593848ca25638eb8cfed47fa49ef44b01fdc9a5db32 -----BEGIN PGP SIGNATURE----- -Version: GnuPG v2.0.17 (GNU/Linux) +Version: GnuPG v2.0.18 (GNU/Linux) -iEYEARECAAYFAk2aF6UACgkQHB6c3gNBRYcrjQCfZl5bmfttH4lhOezCNWB30WNI -k+kAoMEUNA+gNyzPfdhki31QBO5kjPGY -=QDtc +iF4EAREIAAYFAk7tANwACgkQfx9sOO7MmlxF4AD+N/KTdrYQJBLLc0BkoTKBI66T +yMpG+u3YG5pQwW/IWjwA/02q1sdlpLjntKML/emgzfPeDY0G0NzJqcz/RN9L4KMD +=gXux -----END PGP SIGNATURE----- diff --git a/media-libs/jasper/files/CVE-2011-4516+7.patch b/media-libs/jasper/files/CVE-2011-4516+7.patch new file mode 100644 index 000000000000..1f1c7bb35f63 --- /dev/null +++ b/media-libs/jasper/files/CVE-2011-4516+7.patch @@ -0,0 +1,24 @@ +diff -up jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409 jasper-1.900.1/src/libjasper/jpc/jpc_cs.c +--- jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409 2011-10-25 17:25:39.000000000 +0200 ++++ jasper-1.900.1/src/libjasper/jpc/jpc_cs.c 2011-10-25 17:29:14.379371908 +0200 +@@ -744,6 +744,10 @@ static int jpc_cox_getcompparms(jpc_ms_t + return -1; + } + compparms->numrlvls = compparms->numdlvls + 1; ++ if (compparms->numrlvls > JPC_MAXRLVLS) { ++ jpc_cox_destroycompparms(compparms); ++ return -1; ++ } + if (prtflag) { + for (i = 0; i < compparms->numrlvls; ++i) { + if (jpc_getuint8(in, &tmp)) { +@@ -1331,7 +1335,7 @@ static int jpc_crg_getparms(jpc_ms_t *ms + jpc_crgcomp_t *comp; + uint_fast16_t compno; + crg->numcomps = cstate->numcomps; +- if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(uint_fast16_t)))) { ++ if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(jpc_crgcomp_t)))) { + return -1; + } + for (compno = 0, comp = crg->comps; compno < cstate->numcomps; + diff --git a/media-libs/jasper/jasper-1.900.1-r4.ebuild b/media-libs/jasper/jasper-1.900.1-r4.ebuild new file mode 100644 index 000000000000..f5792a4cfc7e --- /dev/null +++ b/media-libs/jasper/jasper-1.900.1-r4.ebuild @@ -0,0 +1,42 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/jasper-1.900.1-r4.ebuild,v 1.1 2011/12/17 20:51:25 phosphan Exp $ + +EAPI=3 + +inherit libtool eutils + +DESCRIPTION="software-based implementation of the codec specified in the JPEG-2000 Part-1 standard" +HOMEPAGE="http://www.ece.uvic.ca/~mdadams/jasper/" +SRC_URI="http://www.ece.uvic.ca/~mdadams/jasper/software/jasper-${PV}.zip + mirror://gentoo/${P}-fixes-20081208.patch.bz2" + +LICENSE="JasPer2.0" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x64-solaris ~x86-solaris" +IUSE="jpeg opengl static-libs" + +RDEPEND="jpeg? ( virtual/jpeg ) + opengl? ( virtual/opengl media-libs/freeglut )" +DEPEND="${RDEPEND} + app-arch/unzip" + +src_prepare() { + epatch "${WORKDIR}"/${P}-fixes-20081208.patch + epatch "${FILESDIR}"/CVE-2011-4516+7.patch + elibtoolize +} + +src_configure() { + econf \ + $(use_enable jpeg libjpeg) \ + $(use_enable opengl) \ + $(use_enable static-libs static) \ + --enable-shared +} + +src_install() { + emake DESTDIR="${D}" install || die + dodoc NEWS README doc/* + find "${ED}" -name '*.la' -delete +}