Security fix from bug #115775 (xpdf buffer overflow).

Package-Manager: portage-2.1_pre3-r1

7 files changed, 268 insertions, 49 deletions

diff --git a/app-text/tetex/ChangeLog b/app-text/tetex/ChangeLog
index f1551d4a6ccf..57cc7fde98ff 100644
--- a/app-text/tetex/ChangeLog
+++ b/app-text/tetex/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-text/tetex
 # Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.99 2006/01/22 16:35:23 nattfodd Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.100 2006/01/23 22:08:23 nattfodd Exp $
+
+*tetex-2.0.2-r8 (23 Jan 2006)
+
+  23 Jan 2006; Alexandre Buisse <nattfodd@gentoo.org>
+  +files/xpdf-2.02pl1-CAN-2005-3191-3.patch, -tetex-2.0.2-r6.ebuild,
+  -tetex-2.0.2-r7.ebuild, +tetex-2.0.2-r8.ebuild:
+  Added security fixes from bug #115775 (xpdf buffer overflow)
 
 *tetex-3.0_p1-r1 (22 Jan 2006)
 
diff --git a/app-text/tetex/Manifest b/app-text/tetex/Manifest
index 41ab737e4dd1..03d9c3da0f88 100644
--- a/app-text/tetex/Manifest
+++ b/app-text/tetex/Manifest
@@ -1,8 +1,7 @@
-MD5 d14030405a61a00589c718c3ac93c497 ChangeLog 18234
+MD5 16517cf559f50d42378eb2e1924aa6cc ChangeLog 18503
 MD5 9179c455d1a594b0b06b670e0b051374 files/digest-tetex-1.0.7-r13 343
 MD5 d9e3971f8b0ed3b93c4c8db657fc3629 files/digest-tetex-2.0.2-r5 282
-MD5 d9e3971f8b0ed3b93c4c8db657fc3629 files/digest-tetex-2.0.2-r6 282
-MD5 d9e3971f8b0ed3b93c4c8db657fc3629 files/digest-tetex-2.0.2-r7 282
+MD5 d9e3971f8b0ed3b93c4c8db657fc3629 files/digest-tetex-2.0.2-r8 282
 MD5 7184c72f1e38b2f0ddb843687cf80832 files/digest-tetex-3.0-r3 202
 MD5 7184c72f1e38b2f0ddb843687cf80832 files/digest-tetex-3.0-r4 202
 MD5 ca5c96c960d2e8845588f273359e3dc9 files/digest-tetex-3.0_p1 207
@@ -19,6 +18,7 @@ MD5 e70ba402012ed53ab6c0f0d5df28f3df files/tetex-3.0_p1-xpdf-vulnerabilities.pat
 MD5 1c3401dbbc9d478e94c98e44b9b68e38 files/tetex-no-readlink-manpage.diff 542
 MD5 41f87c91f8bb6ceeae3c1fb7ca0dce1c files/tetex-texdoctk-gentoo.patch 509
 MD5 77107ec8ba31c93b0e1bc35a9e4c9c4b files/xdvizilla.patch 912
+MD5 34a6a462f630bab703319681b675a92d files/xpdf-2.02pl1-CAN-2005-3191-3.patch 7060
 MD5 5d40ba9d885af84bcc917ad17e2bf8e0 files/xpdf-3.00pl2-CAN-2004-1125.patch 1136
 MD5 c32a612ce419b9930ff273cf382558bf files/xpdf-3.00pl3-CAN-2005-0064.patch 346
 MD5 87d20c86d1451638e4b7adc2f7ac8067 files/xpdf-CESA-2004-007-xpdf2-newer.diff 2718
@@ -27,8 +27,7 @@ MD5 362296e34a1a04a6e5e2a7d9e97547c6 files/xpdf2-underflow.patch 2363
 MD5 c472f5fd1646eb8bca71d8df5cb2bdcc metadata.xml 164
 MD5 8f27cd5e7c06b0c37851607799f69316 tetex-1.0.7-r13.ebuild 4770
 MD5 ac832dc2976c466da737908fafa9a30b tetex-2.0.2-r5.ebuild 1272
-MD5 6e15190448b2788a3fd3f57afdcd2120 tetex-2.0.2-r6.ebuild 1282
-MD5 2d83c92048930d3bf7a72999100f1a21 tetex-2.0.2-r7.ebuild 1378
+MD5 a538d40de2a99131727aab6418c403f7 tetex-2.0.2-r8.ebuild 1488
 MD5 6d84991ef4fd00210a9eb68fdb393bd8 tetex-3.0-r3.ebuild 1272
 MD5 1fe71bbc946829906e955a0380bbbcef tetex-3.0-r4.ebuild 1345
 MD5 5a2a4686b5586b98469959979d34ca76 tetex-3.0_p1-r1.ebuild 1886
diff --git a/app-text/tetex/files/digest-tetex-2.0.2-r7 b/app-text/tetex/files/digest-tetex-2.0.2-r7
deleted file mode 100644
index fcad70744266..000000000000
--- a/app-text/tetex/files/digest-tetex-2.0.2-r7
+++ /dev/null
@@ -1,4 +0,0 @@
-MD5 0a0ba30552331663f496d41b8ca2a299 tetex-2.0.2-gentoo.tar.gz 1704
-MD5 a16f6bba227d55e79aeee46fbbd82d28 tetex-src-2.0.2.tar.gz 11745933
-MD5 d3bdb96f9077e43b2115d3cc471743b3 tetex-texmf-2.0.2.tar.gz 52424280
-MD5 40d4b2c5582eccbee4b6ec692c3cc253 tetex-texmfsrc-2.0.2.tar.gz 22909537
diff --git a/app-text/tetex/files/digest-tetex-2.0.2-r6 b/app-text/tetex/files/digest-tetex-2.0.2-r8
index fcad70744266..fcad70744266 100644
--- a/app-text/tetex/files/digest-tetex-2.0.2-r6
+++ b/app-text/tetex/files/digest-tetex-2.0.2-r8
diff --git a/app-text/tetex/files/xpdf-2.02pl1-CAN-2005-3191-3.patch b/app-text/tetex/files/xpdf-2.02pl1-CAN-2005-3191-3.patch
new file mode 100644
index 000000000000..6e2531318df7
--- /dev/null
+++ b/app-text/tetex/files/xpdf-2.02pl1-CAN-2005-3191-3.patch
@@ -0,0 +1,252 @@
+Index: xpdf-2.02pl1/xpdf/Stream.h
+===================================================================
+--- xpdf-2.02pl1.orig/xpdf/Stream.h
++++ xpdf-2.02pl1/xpdf/Stream.h
+@@ -225,6 +225,8 @@ public:
+ 
+   ~StreamPredictor();
+ 
++  GBool isOk() { return ok; }
++
+   int lookChar();
+   int getChar();
+ 
+@@ -242,6 +244,7 @@ private:
+   int rowBytes;			// bytes per line
+   Guchar *predLine;		// line buffer
+   int predIdx;			// current index in predLine
++  GBool ok;
+ };
+ 
+ //------------------------------------------------------------------------
+Index: xpdf-2.02pl1/xpdf/Stream.cc
+===================================================================
+--- xpdf-2.02pl1.orig/xpdf/Stream.cc
++++ xpdf-2.02pl1/xpdf/Stream.cc
+@@ -15,6 +15,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stddef.h>
++#include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
+ #endif
+@@ -409,13 +410,28 @@ StreamPredictor::StreamPredictor(Stream 
+   width = widthA;
+   nComps = nCompsA;
+   nBits = nBitsA;
++  predLine = NULL;
++  ok = gFalse;
+ 
++  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
++      nComps >= INT_MAX/nBits ||
++      width >= INT_MAX/nComps/nBits) {
++    return;
++  }
+   nVals = width * nComps;
++  if (nVals * nBits + 7 <= 0) {
++    return;
++  }
+   pixBytes = (nComps * nBits + 7) >> 3;
+   rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
++  if (rowBytes < 0) {
++    return;
++  }
+   predLine = (Guchar *)gmalloc(rowBytes);
+   memset(predLine, 0, rowBytes);
+   predIdx = rowBytes;
++
++  ok = gTrue;
+ }
+ 
+ StreamPredictor::~StreamPredictor() {
+@@ -981,6 +997,10 @@ LZWStream::LZWStream(Stream *strA, int p
+     FilterStream(strA) {
+   if (predictor != 1) {
+     pred = new StreamPredictor(this, predictor, columns, colors, bits);
++    if (!pred->isOk()) {
++      delete pred;
++      pred = NULL;
++    }
+   } else {
+     pred = NULL;
+   }
+@@ -1226,6 +1246,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++    error(-1, "invalid number of columns");
++    exit(1);
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2864,6 +2888,11 @@ GBool DCTStream::readBaselineSOF() {
+   height = read16();
+   width = read16();
+   numComps = str->getChar();
++  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   if (prec != 8) {
+     error(getPos(), "Bad DCT precision %d", prec);
+     return gFalse;
+@@ -2890,6 +2919,11 @@ GBool DCTStream::readProgressiveSOF() {
+   height = read16();
+   width = read16();
+   numComps = str->getChar();
++  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   if (prec != 8) {
+     error(getPos(), "Bad DCT precision %d", prec);
+     return gFalse;
+@@ -2912,6 +2946,10 @@ GBool DCTStream::readScanInfo() {
+ 
+   length = read16() - 2;
+   scanInfo.numComps = str->getChar();
++  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   --length;
+   if (length != 2 * scanInfo.numComps + 3) {
+     error(getPos(), "Bad DCT scan info block");
+@@ -2979,12 +3017,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3072,9 +3110,11 @@ int DCTStream::readMarker() {
+   do {
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c != 0xff);
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c == 0xff);
+   } while (c == 0x00);
+   return c;
+@@ -3182,6 +3222,10 @@ FlateStream::FlateStream(Stream *strA, i
+     FilterStream(strA) {
+   if (predictor != 1) {
+     pred = new StreamPredictor(this, predictor, columns, colors, bits);
++    if (!pred->isOk()) {
++      delete pred;
++      pred = NULL;
++    }
+   } else {
+     pred = NULL;
+   }
+Index: xpdf-2.02pl1/xpdf/JBIG2Stream.cc
+===================================================================
+--- xpdf-2.02pl1.orig/xpdf/JBIG2Stream.cc
++++ xpdf-2.02pl1/xpdf/JBIG2Stream.cc
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -1001,7 +1002,16 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
+-  data = (Guchar *)gmalloc(h * line);
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)gmalloc(h * line + 1);
++  data[h * line] = 0;
+ }
+ 
+ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, JBIG2Bitmap *bitmap):
+@@ -1010,8 +1020,17 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
+-  data = (Guchar *)gmalloc(h * line);
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)gmalloc(h * line + 1);
+   memcpy(data, bitmap->data, h * line);
++  data[h * line] = 0;
+ }
+ 
+ JBIG2Bitmap::~JBIG2Bitmap() {
+@@ -1036,10 +1055,14 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= (INT_MAX - 1)/ line) {
++    error(-1, "invalid width/height");
++    gfree(data);
++    data = NULL;
+     return;
+   }
+-  data = (Guchar *)grealloc(data, newH * line);
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)grealloc(data, newH * line + 1);
+   if (pixel) {
+     memset(data + h * line, 0xff, (newH - h) * line);
+   } else {
+@@ -2576,6 +2599,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -3205,6 +3237,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++    error(-1, "invalid width/height");
++    return NULL;
++  }
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
+# vim: syntax=diff
diff --git a/app-text/tetex/tetex-2.0.2-r6.ebuild b/app-text/tetex/tetex-2.0.2-r6.ebuild
deleted file mode 100644
index 8bede0d0bfbd..000000000000
--- a/app-text/tetex/tetex-2.0.2-r6.ebuild
+++ /dev/null
@@ -1,38 +0,0 @@
-# Copyright 1999-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/tetex-2.0.2-r6.ebuild,v 1.4 2006/01/21 11:47:36 nattfodd Exp $
-
-inherit tetex-2 flag-o-matic
-
-DESCRIPTION="a complete TeX distribution"
-HOMEPAGE="http://tug.org/teTeX/"
-
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~ppc-macos ~s390 ~sh ~sparc ~x86"
-IUSE=""
-
-src_unpack() {
-	tetex-2_src_unpack
-
-	# bug 75801
-	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-CESA-2004-007-xpdf2-newer.diff
-	EPATCH_OPTS="-d ${S}/libs/xpdf -p1" epatch ${FILESDIR}/xpdf-goo-sizet.patch
-	EPATCH_OPTS="-d ${S}/libs/xpdf -p1" epatch ${FILESDIR}/xpdf2-underflow.patch
-	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl2-CAN-2004-1125.patch
-	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl3-CAN-2005-0064.patch
-	EPATCH_OPTS="-d ${S} -p1" epatch ${FILESDIR}/xdvizilla.patch
-
-	# bug 118264
-	EPATCH_OPTS="-d ${WORKDIR} -p0" epatch ${FILESDIR}/${P}-dvi-draw-conflicting-types.patch
-
-}
-
-src_compile() {
-	use amd64 && replace-flags "-O3" "-O2"
-	tetex_src_compile
-}
-
-src_install() {
-	insinto /usr/share/texmf/tex/latex/greek
-	doins ${FILESDIR}/iso-8859-7.def
-	tetex-2_src_install
-}
diff --git a/app-text/tetex/tetex-2.0.2-r7.ebuild b/app-text/tetex/tetex-2.0.2-r8.ebuild
index d395600611b4..4553e3df0038 100644
--- a/app-text/tetex/tetex-2.0.2-r7.ebuild
+++ b/app-text/tetex/tetex-2.0.2-r8.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2006 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/tetex-2.0.2-r7.ebuild,v 1.2 2006/01/21 11:47:36 nattfodd Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/tetex-2.0.2-r8.ebuild,v 1.1 2006/01/23 22:08:23 nattfodd Exp $
 
 inherit tetex-2 flag-o-matic
 
@@ -20,6 +20,9 @@ src_unpack() {
 	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl2-CAN-2004-1125.patch
 	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p0" epatch ${FILESDIR}/xpdf-3.00pl3-CAN-2005-0064.patch
 
+	#bug 115775
+	EPATCH_OPTS="-d ${S}/libs/xpdf/xpdf -p2" epatch ${FILESDIR}/xpdf-2.02pl1-CAN-2005-3191-3.patch
+
 	EPATCH_OPTS="-d ${S} -p1" epatch ${FILESDIR}/xdvizilla.patch
 
 	# bug 85404