security bump; Bug #75801

10 files changed, 361 insertions, 9 deletions

diff --git a/app-text/tetex/ChangeLog b/app-text/tetex/ChangeLog
index 3479e0ab4f0c..5434f7c3eeb4 100644
--- a/app-text/tetex/ChangeLog
+++ b/app-text/tetex/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for app-text/tetex
 # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.73 2005/01/01 16:37:56 eradicator Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.74 2005/01/19 15:01:12 matsuu Exp $
+
+*tetex-2.0.2-r5 (19 Jan 2005)
+
+  19 Jan 2005; MATSUU Takuto <matsuu@gentoo.org> +files/xdvizilla.patch,
+  +files/xpdf-3.00pl2-CAN-2004-1125.patch,
+  +files/xpdf-3.00pl3-CAN-2005-0064.patch,
+  +files/xpdf-CESA-2004-007-xpdf2-newer.diff, +files/xpdf-goo-sizet.patch,
+  +files/xpdf2-underflow.patch, +tetex-2.0.2-r5.ebuild:
+  security bump; bug #75801
 
 *tetex-2.99.5.20041207 (09 Dec 2004)
 
diff --git a/app-text/tetex/Manifest b/app-text/tetex/Manifest
index 7d098008ea80..ba5167be3f66 100644
--- a/app-text/tetex/Manifest
+++ b/app-text/tetex/Manifest
@@ -1,15 +1,23 @@
-MD5 807ff8ba7ead7d6744f811669f44f510 ChangeLog 13416
-MD5 c472f5fd1646eb8bca71d8df5cb2bdcc metadata.xml 164
 MD5 8f27cd5e7c06b0c37851607799f69316 tetex-1.0.7-r13.ebuild 4770
-MD5 e06e0127f32f1abdde72e80677dbd768 tetex-2.0.2-r3.ebuild 493
+MD5 26bdf61f9b96f64c28f9751ee3a0fc2e tetex-2.99.3.20041109-r1.ebuild 2038
+MD5 89e552eacef76c2025425a8664a83cef tetex-2.0.2-r5.ebuild 1171
 MD5 4ff0a2af91a5f4706ceda6a40f831a4c tetex-2.99.5.20041207.ebuild 2035
 MD5 18a2c88ee01a228f443743b3cbf2a234 tetex-2.0.2-r4.ebuild 611
-MD5 26bdf61f9b96f64c28f9751ee3a0fc2e tetex-2.99.3.20041109-r1.ebuild 2038
-MD5 9179c455d1a594b0b06b670e0b051374 files/digest-tetex-1.0.7-r13 343
+MD5 368dd91b5e3106929e7792a294d3c250 ChangeLog 13762
+MD5 c472f5fd1646eb8bca71d8df5cb2bdcc metadata.xml 164
+MD5 e06e0127f32f1abdde72e80677dbd768 tetex-2.0.2-r3.ebuild 493
 MD5 ed2101fe2206c296c09f0d2b67759841 files/digest-tetex-2.0.2-r3 282
-MD5 41f87c91f8bb6ceeae3c1fb7ca0dce1c files/tetex-texdoctk-gentoo.patch 509
-MD5 960fde783aaac8048090bad11254da92 files/digest-tetex-2.99.5.20041207 248
-MD5 9955467b6e148544069fbbd4ad2e620f files/digest-tetex-2.99.3.20041109-r1 248
 MD5 ed2101fe2206c296c09f0d2b67759841 files/digest-tetex-2.0.2-r4 282
+MD5 ed2101fe2206c296c09f0d2b67759841 files/digest-tetex-2.0.2-r5 282
+MD5 9955467b6e148544069fbbd4ad2e620f files/digest-tetex-2.99.3.20041109-r1 248
+MD5 960fde783aaac8048090bad11254da92 files/digest-tetex-2.99.5.20041207 248
+MD5 77107ec8ba31c93b0e1bc35a9e4c9c4b files/xdvizilla.patch 912
+MD5 41f87c91f8bb6ceeae3c1fb7ca0dce1c files/tetex-texdoctk-gentoo.patch 509
+MD5 362296e34a1a04a6e5e2a7d9e97547c6 files/xpdf2-underflow.patch 2363
 MD5 1c3401dbbc9d478e94c98e44b9b68e38 files/tetex-no-readlink-manpage.diff 542
+MD5 9179c455d1a594b0b06b670e0b051374 files/digest-tetex-1.0.7-r13 343
+MD5 5d40ba9d885af84bcc917ad17e2bf8e0 files/xpdf-3.00pl2-CAN-2004-1125.patch 1136
+MD5 c32a612ce419b9930ff273cf382558bf files/xpdf-3.00pl3-CAN-2005-0064.patch 346
+MD5 2fce5bedd61300fad1566a41f991a782 files/xpdf-goo-sizet.patch 1424
 MD5 6f48f0b987b7ea33b02aea8ba198eeed files/iso-8859-7.def 4419
+MD5 87d20c86d1451638e4b7adc2f7ac8067 files/xpdf-CESA-2004-007-xpdf2-newer.diff 2718
diff --git a/app-text/tetex/files/digest-tetex-2.0.2-r5 b/app-text/tetex/files/digest-tetex-2.0.2-r5
new file mode 100644
index 000000000000..e7e17c3b6698
--- /dev/null
+++ b/app-text/tetex/files/digest-tetex-2.0.2-r5
@@ -0,0 +1,4 @@
+MD5 a16f6bba227d55e79aeee46fbbd82d28 tetex-src-2.0.2.tar.gz 11745933
+MD5 d3bdb96f9077e43b2115d3cc471743b3 tetex-texmf-2.0.2.tar.gz 52424280
+MD5 40d4b2c5582eccbee4b6ec692c3cc253 tetex-texmfsrc-2.0.2.tar.gz 22909537
+MD5 0a0ba30552331663f496d41b8ca2a299 tetex-2.0.2-gentoo.tar.gz 1704
diff --git a/app-text/tetex/files/xdvizilla.patch b/app-text/tetex/files/xdvizilla.patch
new file mode 100644
index 000000000000..bc925280a198
--- /dev/null
+++ b/app-text/tetex/files/xdvizilla.patch
@@ -0,0 +1,30 @@
+--- tetex-bin-2.0.2/texk/xdvik/xdvizilla	2002-10-12 15:28:50.000000000 +0200
++++ tetex-bin-2.0.2.new/texk/xdvik/xdvizilla	2004-12-23 12:58:35.010332504 +0100
+@@ -33,7 +33,7 @@
+ case "$FILETYPE" in
+ 
+   *"gzip compressed data"*)
+-    FILE=/tmp/xdvizilla$$
++    FILE=`mktemp -t xdvizilla.XXXXXX` || exit 1
+     gunzip -c "$1" > $FILE
+     [ -n "$NO_RM" ] || rm -f -- "$1"
+     NO_RM=
+@@ -41,7 +41,7 @@
+     ;;
+ 
+   *"compressed data"* | *"compress'd data"*)
+-    FILE=/tmp/xdvizilla$$
++    FILE=`mktemp -t xdvizilla.XXXXXX` || exit 1
+     uncompress -c "$1" > $FILE
+     [ -n "$NO_RM" ] || rm -f -- "$1"
+     NO_RM=
+@@ -60,8 +60,7 @@
+ case "$FILETYPE" in
+ 
+   *" tar archive")
+-    TARDIR=/tmp/xdvitar$$
+-    mkdir $TARDIR
++    TARDIR=`mktemp -t -d xdvitar.XXXXXX` || exit 1
+     cat "$FILE" | (cd $TARDIR; tar xf -)
+     DVINAME=`tar tf "$FILE" | grep '\.dvi$' | head -1`
+     [ -n "$NO_RM" ] || rm -f -- "$FILE"
diff --git a/app-text/tetex/files/xpdf-3.00pl2-CAN-2004-1125.patch b/app-text/tetex/files/xpdf-3.00pl2-CAN-2004-1125.patch
new file mode 100644
index 000000000000..119de236d50b
--- /dev/null
+++ b/app-text/tetex/files/xpdf-3.00pl2-CAN-2004-1125.patch
@@ -0,0 +1,37 @@
+*** Gfx.cc.orig	Sun Dec 12 16:04:43 2004
+--- Gfx.cc	Sun Dec 12 16:05:16 2004
+***************
+*** 2654,2660 ****
+      haveMask = gFalse;
+      dict->lookup("Mask", &maskObj);
+      if (maskObj.isArray()) {
+!       for (i = 0; i < maskObj.arrayGetLength(); ++i) {
+  	maskObj.arrayGet(i, &obj1);
+  	maskColors[i] = obj1.getInt();
+  	obj1.free();
+--- 2654,2662 ----
+      haveMask = gFalse;
+      dict->lookup("Mask", &maskObj);
+      if (maskObj.isArray()) {
+!       for (i = 0;
+! 	   i < maskObj.arrayGetLength() && i < 2*gfxColorMaxComps;
+! 	   ++i) {
+  	maskObj.arrayGet(i, &obj1);
+  	maskColors[i] = obj1.getInt();
+  	obj1.free();
+*** GfxState.cc.orig	Sun Dec 12 16:04:48 2004
+--- GfxState.cc	Sun Dec 12 16:06:38 2004
+***************
+*** 708,713 ****
+--- 708,718 ----
+    }
+    nCompsA = obj2.getInt();
+    obj2.free();
++   if (nCompsA > gfxColorMaxComps) {
++     error(-1, "ICCBased color space with too many (%d > %d) components",
++ 	  nCompsA, gfxColorMaxComps);
++     nCompsA = gfxColorMaxComps;
++   }
+    if (dict->lookup("Alternate", &obj2)->isNull() ||
+        !(altA = GfxColorSpace::parse(&obj2))) {
+      switch (nCompsA) {
diff --git a/app-text/tetex/files/xpdf-3.00pl3-CAN-2005-0064.patch b/app-text/tetex/files/xpdf-3.00pl3-CAN-2005-0064.patch
new file mode 100644
index 000000000000..d7d2294c8527
--- /dev/null
+++ b/app-text/tetex/files/xpdf-3.00pl3-CAN-2005-0064.patch
@@ -0,0 +1,14 @@
+*** XRef.cc.orig	Wed Jan 12 17:10:53 2005
+--- XRef.cc	Wed Jan 12 17:11:22 2005
+***************
+*** 793,798 ****
+--- 793,801 ----
+  	} else {
+  	  keyLength = 5;
+  	}
++ 	if (keyLength > 16) {
++ 	  keyLength = 16;
++ 	}
+  	permFlags = permissions.getInt();
+  	if (encVersion >= 1 && encVersion <= 2 &&
+  	    encRevision >= 2 && encRevision <= 3) {
diff --git a/app-text/tetex/files/xpdf-CESA-2004-007-xpdf2-newer.diff b/app-text/tetex/files/xpdf-CESA-2004-007-xpdf2-newer.diff
new file mode 100644
index 000000000000..55a24458c9a4
--- /dev/null
+++ b/app-text/tetex/files/xpdf-CESA-2004-007-xpdf2-newer.diff
@@ -0,0 +1,78 @@
+--- XRef.cc.orig	2004-09-17 23:54:38.000000000 -0700
++++ XRef.cc	2004-09-25 17:59:36.000000000 -0700
+@@ -76,6 +76,12 @@
+ 
+   // trailer is ok - read the xref table
+   } else {
++    if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++      error(-1, "Invalid 'size' inside xref table.");
++      ok = gFalse;
++      errCode = errDamaged;
++      return;
++    }
+     entries = (XRefEntry *)gmalloc(size * sizeof(XRefEntry));
+     for (i = 0; i < size; ++i) {
+       entries[i].offset = 0xffffffff;
+@@ -267,6 +273,10 @@
+     // table size
+     if (first + n > size) {
+       newSize = size + 256;
++      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++        error(-1, "Invalid 'newSize'");
++        goto err2;
++      }
+       entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
+       for (i = size; i < newSize; ++i) {
+ 	entries[i].offset = 0xffffffff;
+@@ -410,6 +420,10 @@
+ 	    if (!strncmp(p, "obj", 3)) {
+ 	      if (num >= size) {
+ 		newSize = (num + 1 + 255) & ~255;
++	        if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++	          error(-1, "Invalid 'obj' parameters.");
++	          return gFalse;
++	        }
+ 		entries = (XRefEntry *)
+ 		            grealloc(entries, newSize * sizeof(XRefEntry));
+ 		for (i = size; i < newSize; ++i) {
+@@ -431,6 +445,11 @@
+     } else if (!strncmp(p, "endstream", 9)) {
+       if (streamEndsLen == streamEndsSize) {
+ 	streamEndsSize += 64;
++        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
++          error(-1, "Invalid 'endstream' parameter.");
++          return gFalse;
++        }
++
+ 	streamEnds = (Guint *)grealloc(streamEnds,
+ 				       streamEndsSize * sizeof(int));
+       }
+--- Catalog.cc.orig	2004-10-18 16:26:39.388666476 +0200
++++ Catalog.cc	2004-10-18 16:27:28.004749073 +0200
+@@ -62,6 +62,12 @@
+   }
+   pagesSize = numPages0 = obj.getInt();
+   obj.free();
++  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++    error(-1, "Invalid 'pagesSize'");
++    ok = gFalse;
++    return;
++  }
+   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   for (i = 0; i < pagesSize; ++i) {
+@@ -186,6 +192,11 @@
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
++        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++            pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++          error(-1, "Invalid 'pagesSize' parameter.");
++          goto err3;
++        }
+ 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ 	for (j = pagesSize - 32; j < pagesSize; ++j) {
+
+
diff --git a/app-text/tetex/files/xpdf-goo-sizet.patch b/app-text/tetex/files/xpdf-goo-sizet.patch
new file mode 100644
index 000000000000..5d90c5120bd4
--- /dev/null
+++ b/app-text/tetex/files/xpdf-goo-sizet.patch
@@ -0,0 +1,57 @@
+diff -ru xpdf-2.02pl1/goo/gmem.c xpdf-2.02pl1/goo/gmem.c
+--- xpdf-2.02pl1/goo/gmem.c	2003-06-16 22:01:26.000000000 +0200
++++ xpdf-2.02pl1/goo/gmem.c	2004-10-29 15:13:34.866919791 +0200
+@@ -53,9 +53,9 @@
+ 
+ #endif /* DEBUG_MEM */
+ 
+-void *gmalloc(int size) {
++void *gmalloc(size_t size) {
+ #ifdef DEBUG_MEM
+-  int size1;
++  size_t size1;
+   char *mem;
+   GMemHdr *hdr;
+   void *data;
+@@ -94,11 +94,11 @@
+ #endif
+ }
+ 
+-void *grealloc(void *p, int size) {
++void *grealloc(void *p, size_t size) {
+ #ifdef DEBUG_MEM
+   GMemHdr *hdr;
+   void *q;
+-  int oldSize;
++  size_t oldSize;
+ 
+   if (size == 0) {
+     if (p)
+@@ -137,7 +137,7 @@
+ 
+ void gfree(void *p) {
+ #ifdef DEBUG_MEM
+-  int size;
++  size_t size;
+   GMemHdr *hdr;
+   GMemHdr *prevHdr, *q;
+   int lst;
+diff -ru xpdf-2.02pl1/goo/gmem.h xpdf-2.02pl1/goo/gmem.h
+--- xpdf-2.02pl1/goo/gmem.h	2003-06-16 22:01:26.000000000 +0200
++++ xpdf-2.02pl1/goo/gmem.h	2004-10-29 15:13:50.864027201 +0200
+@@ -19,13 +19,13 @@
+  * Same as malloc, but prints error message and exits if malloc()
+  * returns NULL.
+  */
+-extern void *gmalloc(int size);
++extern void *gmalloc(size_t size);
+ 
+ /*
+  * Same as realloc, but prints error message and exits if realloc()
+  * returns NULL.  If <p> is NULL, calls malloc instead of realloc().
+  */
+-extern void *grealloc(void *p, int size);
++extern void *grealloc(void *p, size_t size);
+ 
+ /*
+  * Same as free, but checks for and ignores NULL pointers.
diff --git a/app-text/tetex/files/xpdf2-underflow.patch b/app-text/tetex/files/xpdf2-underflow.patch
new file mode 100644
index 000000000000..9371be84352e
--- /dev/null
+++ b/app-text/tetex/files/xpdf2-underflow.patch
@@ -0,0 +1,81 @@
+diff -ru xpdf-2.02pl1/xpdf/XRef.cc xpdf-2.02pl1/xpdf/XRef.cc
+--- xpdf-2.02pl1/xpdf/XRef.cc	2004-10-29 15:16:45.790089001 +0200
++++ xpdf-2.02pl1/xpdf/XRef.cc	2004-10-29 15:11:54.132168025 +0200
+@@ -66,6 +66,8 @@
+   start = str->getStart();
+   pos = readTrailer();
+ 
++  entries = NULL;
++
+   // if there was a problem with the trailer,
+   // try to reconstruct the xref table
+   if (pos == 0) {
+@@ -76,7 +78,7 @@
+ 
+   // trailer is ok - read the xref table
+   } else {
+-    if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++    if ((size < 0) || (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size)) {
+       error(-1, "Invalid 'size' inside xref table.");
+       ok = gFalse;
+       errCode = errDamaged;
+@@ -181,7 +183,7 @@
+     n = atoi(p);
+     while ('0' <= *p && *p <= '9') ++p;
+     while (isspace(*p)) ++p;
+-    if (p == buf)
++    if ((p == buf) || (n < 0)) /* must make progress */
+       return 0;
+     pos1 += (p - buf) + n * 20;
+   }
+@@ -255,6 +257,10 @@
+     }
+     s[i] = '\0';
+     first = atoi(s);
++    if (first < 0) {
++        error(-1, "Invalid 'first'");
++        goto err2;
++    }
+     while ((c = str->lookChar()) != EOF && isspace(c)) {
+       str->getChar();
+     }
+@@ -266,6 +272,10 @@
+     }
+     s[i] = '\0';
+     n = atoi(s);
++    if (n<=0) {
++        error(-1, "Invalid 'n'");
++        goto err2;
++    }
+     while ((c = str->lookChar()) != EOF && isspace(c)) {
+       str->getChar();
+     }
+@@ -273,7 +283,7 @@
+     // table size
+     if (first + n > size) {
+       newSize = size + 256;
+-      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++      if ((newSize < 0) || (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize)) {
+         error(-1, "Invalid 'newSize'");
+         goto err2;
+       }
+@@ -406,6 +416,10 @@
+     // look for object
+     } else if (isdigit(*p)) {
+       num = atoi(p);
++      if (num < 0) {
++	error(-1, "Invalid 'num' parameters.");
++	return gFalse;
++      }
+       do {
+ 	++p;
+       } while (*p && isdigit(*p));
+@@ -425,7 +439,7 @@
+ 	    if (!strncmp(p, "obj", 3)) {
+ 	      if (num >= size) {
+ 		newSize = (num + 1 + 255) & ~255;
+-	        if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++	        if ((newSize < 0) || (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize)) {
+ 	          error(-1, "Invalid 'obj' parameters.");
+ 	          return gFalse;
+ 	        }
diff --git a/app-text/tetex/tetex-2.0.2-r5.ebuild b/app-text/tetex/tetex-2.0.2-r5.ebuild
new file mode 100644
index 000000000000..4cc1ef636d88
--- /dev/null
+++ b/app-text/tetex/tetex-2.0.2-r5.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/tetex-2.0.2-r5.ebuild,v 1.1 2005/01/19 15:01:12 matsuu Exp $
+
+inherit tetex eutils flag-o-matic
+
+DESCRIPTION="a complete TeX distribution"
+HOMEPAGE="http://tug.org/teTeX/"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~ppc-macos ~s390 ~sparc ~x86"
+IUSE=""
+
+src_unpack() {
+	tetex_src_unpack
+
+	# bug 75801
+	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-CESA-2004-007-xpdf2-newer.diff
+	EPATCH_OPTS="-d ${S}/libs/xpdf -p1" epatch ${FILESDIR}/xpdf-goo-sizet.patch
+	EPATCH_OPTS="-d ${S}/libs/xpdf -p1" epatch ${FILESDIR}/xpdf2-underflow.patch
+	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl2-CAN-2004-1125.patch
+	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl3-CAN-2005-0064.patch
+	EPATCH_OPTS="-d ${S} -p1" epatch ${FILESDIR}/xdvizilla.patch
+}
+
+src_compile() {
+	use amd64 && replace-flags "-O3" "-O2"
+	tetex_src_compile
+}
+
+src_install() {
+	insinto /usr/share/texmf/tex/latex/greek
+	doins ${FILESDIR}/iso-8859-7.def
+	tetex_src_install
+}