security fix for fvwm-menu-directory, patch from the debian project.

(Portage version: 2.1.1-r1)

4 files changed, 195 insertions, 1 deletions

diff --git a/x11-wm/fvwm/ChangeLog b/x11-wm/fvwm/ChangeLog
index 5db17b688fa0..93e98170c144 100644
--- a/x11-wm/fvwm/ChangeLog
+++ b/x11-wm/fvwm/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for x11-wm/fvwm
 # Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/x11-wm/fvwm/ChangeLog,v 1.124 2006/11/05 03:39:40 ranger Exp $
+# $Header: /var/cvsroot/gentoo-x86/x11-wm/fvwm/ChangeLog,v 1.125 2006/11/13 22:12:39 taviso Exp $
+
+*fvwm-2.5.18-r1 (13 Nov 2006)
+
+  13 Nov 2006; Tavis Ormandy <taviso@gentoo.org>
+  +files/fvwm-menu-directory-security.diff, +fvwm-2.5.18-r1.ebuild:
+  add security patch to fvwm-menu-directory from debian
+  http://article.gmane.org/gmane.comp.window-managers.fvwm.devel/2419
 
   05 Nov 2006; Brent Baude <ranger@gentoo.org> fvwm-2.5.18.ebuild:
   marking fvwm-2.5.18 ppc64 stable for bug 152758
diff --git a/x11-wm/fvwm/files/digest-fvwm-2.5.18-r1 b/x11-wm/fvwm/files/digest-fvwm-2.5.18-r1
new file mode 100644
index 000000000000..6ebdba7bf2ce
--- /dev/null
+++ b/x11-wm/fvwm/files/digest-fvwm-2.5.18-r1
@@ -0,0 +1,6 @@
+MD5 140c3b506c7afb69a3e6ac0b2b56e75b fvwm-2.5.18-translucent-menus.diff.gz 82595
+RMD160 175e2dc93ca4e265a5022655deeede32dd653b38 fvwm-2.5.18-translucent-menus.diff.gz 82595
+SHA256 ffdaf69a93f626a709541e15ecbbb8842c306543beebd4adc909a6edbda42516 fvwm-2.5.18-translucent-menus.diff.gz 82595
+MD5 d90612ab2bd3a86b2bd23325aa87d3d4 fvwm-2.5.18.tar.bz2 2034340
+RMD160 68bd7a5d3e1c5fb3776de0fbda75414d9e7ad54b fvwm-2.5.18.tar.bz2 2034340
+SHA256 8489b32ad488d91898d9be0ff4ec4697590feee66f10de88301511efc617e9c5 fvwm-2.5.18.tar.bz2 2034340
diff --git a/x11-wm/fvwm/files/fvwm-menu-directory-security.diff b/x11-wm/fvwm/files/fvwm-menu-directory-security.diff
new file mode 100644
index 000000000000..440431415369
--- /dev/null
+++ b/x11-wm/fvwm/files/fvwm-menu-directory-security.diff
@@ -0,0 +1,11 @@
+--- fvwm-2.5.18.orig/bin/fvwm-menu-directory.in
++++ fvwm-2.5.18/bin/fvwm-menu-directory.in
+@@ -279,7 +279,7 @@
+        my $itemStr = $dir && $itemF_eval? &evalItem($_name, $dir): $_name;
+        $itemStr = escapeItemName($itemStr);
+        my $act = !$dir || $checkSubdirs && !-x $dir? "Nop": !$reuse?
+-               qq(Popup ") . escapeFvwmName($dir) . qq("$submenuPos):
++               qq(Popup ") . escapeFileName($dir) . qq("$submenuPos):
+                qq(PipeRead 'echo ") . escapeFileName($dir) . qq(" >$dirFile; )
+                . qq(echo Menu ") . escapeFvwmName($name) . qq(" WarpTitle');
+        return qq(+ "$iconDStr$itemStr" $act\n);
diff --git a/x11-wm/fvwm/fvwm-2.5.18-r1.ebuild b/x11-wm/fvwm/fvwm-2.5.18-r1.ebuild
new file mode 100644
index 000000000000..311ad40c75b6
--- /dev/null
+++ b/x11-wm/fvwm/fvwm-2.5.18-r1.ebuild
@@ -0,0 +1,170 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/x11-wm/fvwm/fvwm-2.5.18-r1.ebuild,v 1.1 2006/11/13 22:12:39 taviso Exp $
+
+inherit eutils flag-o-matic
+
+DESCRIPTION="An extremely powerful ICCCM-compliant multiple virtual desktop window manager"
+HOMEPAGE="http://www.fvwm.org/"
+SRC_URI="ftp://ftp.fvwm.org/pub/fvwm/version-2/${P}.tar.bz2 mirror://gentoo/fvwm-2.5.18-translucent-menus.diff.gz"
+
+LICENSE="GPL-2 FVWM"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="bidi debug gtk imlib nls perl png readline rplay stroke tk truetype xinerama"
+
+RDEPEND="readline? ( sys-libs/readline sys-libs/ncurses )
+		gtk? ( =x11-libs/gtk+-1.2*
+				imlib? ( media-libs/gdk-pixbuf
+						media-libs/imlib ) )
+		rplay? ( media-sound/rplay )
+		bidi? ( dev-libs/fribidi )
+		png? ( media-libs/libpng )
+		stroke? ( dev-libs/libstroke )
+		perl? ( tk? ( dev-lang/tk
+						dev-perl/perl-tk
+						>=dev-perl/X11-Protocol-0.56 ) )
+		truetype? ( virtual/xft media-libs/fontconfig )
+		dev-lang/perl
+		sys-libs/zlib
+		sys-apps/debianutils
+		|| ( (
+			x11-libs/libXpm
+			x11-libs/libXft
+			xinerama? ( x11-libs/libXinerama ) )
+		virtual/x11 )"
+# XXX:	gtk2 perl bindings require dev-perl/gtk2-perl, worth a dependency?
+# XXX:	gtk perl bindings require dev-perl/gtk-perl, worth a dependency?
+# XXX:	netpbm is used by FvwmScript-ScreenDump, worth a dependency?
+DEPEND="${RDEPEND}
+		dev-util/pkgconfig
+		!x11-wm/metisse
+		|| ( (
+			x11-libs/libXrandr
+			x11-proto/xextproto
+			x11-proto/xproto
+			xinerama? ( x11-proto/xineramaproto ) )
+		virtual/x11 )"
+
+src_unpack() {
+	unpack ${A}; export EPATCH_OPTS="-F3 -l"
+
+	# this patch enables fast translucent menus in fvwm. this is a
+	# minor tweak of a patch posted to fvwm-user mailing list by Olivier
+	# Chapuis in <20030827135125.GA6370@snoopy.folie>.
+	cd ${S}; epatch ${WORKDIR}/fvwm-2.5.18-translucent-menus.diff
+
+	# fixing #51287, the fvwm-menu-xlock script is not compatible
+	# with the xlockmore implementation in portage.
+	cd ${S}; epatch ${FILESDIR}/fvwm-menu-xlock-xlockmore-compat.diff
+
+	# fix security issue in fvwm-menu-directory when parsing directories
+	# with newlines.
+	cd ${S}; epatch ${FILESDIR}/fvwm-menu-directory-security.diff
+}
+
+src_compile() {
+	local myconf="--libexecdir=/usr/lib --with-imagepath=/usr/include/X11/bitmaps:/usr/include/X11/pixmaps:/usr/share/icons/fvwm --enable-package-subdirs"
+
+	# use readline in FvwmConsole.
+	if use readline; then
+		myconf="${myconf} --without-termcap-library"
+	fi
+
+	# FvwmGtk can be built as a gnome application, or a Gtk+ application.
+	if ! use gtk; then
+		myconf="${myconf} --disable-gtk --without-gnome"
+	else
+		if ! use imlib; then
+			einfo "ATTN: You can safely ignore any imlib related configure errors."
+			myconf="${myconf} --with-imlib-prefix=${T}"
+		fi
+		myconf="${myconf} --without-gnome"
+	fi
+
+	# set the local maintainer for fvwm-bug.
+	export FVWM_BUGADDR="taviso@gentoo.org"
+
+	# reccommended by upstream
+	append-flags -fno-strict-aliasing
+
+	econf ${myconf} `use_enable truetype xft` \
+					`use_with stroke stroke-library` \
+					`use_enable nls` \
+					`use_enable nls iconv` \
+					`use_enable png png-library` \
+					`use_enable bidi` \
+					`use_enable xinerama` \
+					`use_enable debug debug-msgs` \
+					`use_enable debug command-log` \
+					`use_enable perl perllib` \
+					`use_with readline readline-library` \
+					`use_with rplay rplay-library` || die
+	emake || die
+}
+
+src_install() {
+	make DESTDIR=${D} install || die
+
+	if use perl; then
+
+		local toolkits="gtk tcltk"
+
+		if ! use tk; then
+			# Remove the Tk bindings (requires perl-tk)
+			rm -f ${D}/usr/share/fvwm/perllib/FVWM/Module/Tk.pm
+			toolkits=${toolkits/tcltk/}
+		fi
+		if ! use gtk; then
+			# Remove gtk bindings (requires gtk-perl/gtk2-perl)
+			rm -f ${D}/usr/share/fvwm/perllib/FVWM/Module/Gtk.pm \
+				${D}/usr/share/fvwm/perllib/FVWM/Module/Gtk2.pm
+			toolkits=${toolkits/gtk/}
+		fi
+		toolkits=${toolkits// /}
+		if ! test "${toolkits}"; then
+			# No perl toolkit bindings wanted, remove the unneeded files
+			# and empty directories.
+			rm -f ${D}/usr/share/fvwm/perllib/FVWM/Module/Toolkit.pm
+			find ${D}/usr/share/fvwm/perllib -depth -type d -exec rmdir {} \; 2>/dev/null
+		fi
+	else
+		# Remove useless script if perllib isnt required.
+		rm -rf ${D}/usr/bin/fvwm-perllib ${D}/usr/share/man/man1/fvwm-perllib.1
+	fi
+
+	# neat utility for testing fvwm behaviour on applications setting various
+	# hints, creates a simple black window with configurable hints set.
+	if use debug; then
+		dobin ${S}/tests/hints/hints_test
+		newdoc ${S}/tests/hints/README README.hints
+	fi
+
+	# fvwm-convert-2.6 is just a stub, contains no code - remove it for now.
+	# fvwm-convert-2.2 has a man page, but the script is no longer distributed.
+	rm -f ${D}/usr/bin/fvwm-convert-2.6 ${D}/usr/share/man/man1/fvwm-convert-2.6.1
+	rm -f ${D}/usr/share/man/man1/fvwm-convert-2.2.1
+
+	# ive included `exec` to save a few bytes of memory.
+	echo "#!/bin/bash" > fvwm2
+	echo "exec /usr/bin/fvwm2" >> fvwm2
+
+	exeinto /etc/X11/Sessions
+	doexe fvwm2
+
+	dodoc AUTHORS ChangeLog COPYING README NEWS docs/ANNOUNCE docs/BUGS \
+	docs/COMMANDS docs/DEVELOPERS docs/FAQ docs/error_codes docs/TODO \
+	docs/fvwm.lsm
+
+	dodoc ${FILESDIR}/README.transluceny
+
+	# fix a couple of symlinks.
+	prepallman
+}
+
+pkg_postinst() {
+	einfo
+	einfo "For information about the changes in this release, please"
+	einfo "refer to the NEWS file."
+	einfo
+}