fix CVE-2013-4276 wrt bug #479874

Package-Manager: portage-2.2.8-r2/cvs/Linux x86_64
Manifest-Sign-Key: 0xBD3A97A3

4 files changed, 204 insertions, 16 deletions

diff --git a/media-libs/lcms/ChangeLog b/media-libs/lcms/ChangeLog
index c4594b6d93fd..410224e9c639 100644
--- a/media-libs/lcms/ChangeLog
+++ b/media-libs/lcms/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-libs/lcms
 # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/lcms/ChangeLog,v 1.178 2014/07/04 19:39:06 ago Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/lcms/ChangeLog,v 1.179 2014/10/23 19:30:38 tamiko Exp $
+
+*lcms-1.19-r3 (23 Oct 2014)
+
+  23 Oct 2014; Matthias Maier <tamiko@gentoo.org>
+  +files/lcms-1.19-cve-2013-4276.patch, +lcms-1.19-r3.ebuild:
+  fix CVE-2013-4276 wrt bug #479874
 
   04 Jul 2014; Agostino Sarubbo <ago@gentoo.org> lcms-1.19-r1.ebuild:
   Stable for ppc, wrt bug #504214
diff --git a/media-libs/lcms/Manifest b/media-libs/lcms/Manifest
index 1cd7fc8d566e..46a99dba8a37 100644
--- a/media-libs/lcms/Manifest
+++ b/media-libs/lcms/Manifest
@@ -1,6 +1,7 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX lcms-1.19-cve-2013-4276.patch 2113 SHA256 fb1cae9ada801f9f0ec3d3107a0e462f1c9b38c590b5ac9c7206635925b1d3d1 SHA512 785eff7bf8f8d2bf085877d7d61e111e0b149f5982958e12c77e2f1134d0239b8f280289fb65004cce3d82e1a6e80047bea9c28a471aac58e3b7a8ec1aa62085 WHIRLPOOL 36ce2616f82e3f05336ea3284a01b813e03cce262dc6fda226fdcbfcae47eee52a26330e2b22c1ef81a10d9cb8b08d1ef9818133e3690a689afd781e6fa2a7ed
 AUX lcms-1.19-disable_static_modules.patch 578 SHA256 bd56a283da65a7ab262d35c890a99e8b103a3a73e50b997e404c3c0ac3ae467e SHA512 fba391dd6d69122217cdcde985d2154dfc2fd9b9aed5a50a013248e024ee54fe07a98acf917fd0e889578616512a2bdf155f0cbe782795e406d96a90b10bbb33 WHIRLPOOL d40c77d18ab5249252e4cadd5b6e2e40c1e43c0f761758908f2afa06d29dce41d56de52d33fe043d7441180c40ca572571fb7c27b87c43406991e5f1e25ff22c
 AUX lcms-1.19-fix-python3.2.patch 1098 SHA256 aee8200bdb7106b5aaa0df92590de5c857319373e95c7617fb7541717ce3219a SHA512 6b8bda2f792ca5afe65e62c618613583763904f7a6994c6f60d38285b4b823ebf92fd449afedb2b57d61ddf7edc82f277dbe4bb7b8dc8e751ccbe1d0970c8277 WHIRLPOOL 842dcb6bd64505bc0f05ebf8a621514a643ae8bdd8ead4d4fa5e827e0dbc4f7b39a65863cbfb0d4bfe047f06da1b00ef7837b107de574b3b5e8f6150983e0c3f
 AUX lcms-1.19-fix-swig-destructor.patch 345 SHA256 ac8ade0b3e45fd934b88925256fe6e729bb4b6b38f3ad896dfef3dc11e8b52a7 SHA512 00d1b2dd2ed32d4848c726e6616a4cb9caccc9ad410c796d400bd8566938854100c0c94e8db6446ab00a3dfef610406b6eca1f7a288a37b7249f3f98e9653a91 WHIRLPOOL 4247ffa55abdec48e98926ee174101bf440d00e81cf7c3fe2940693de04697d692b2538ca5b5d3917a5f1ea8ba72f2d964bcc7b7b49bc484bd18e6e260332484
@@ -12,28 +13,29 @@ DIST lcms2-2.5.tar.gz 7000396 SHA256 6727772b44470a2111dba53b9ce4c952b87e7d1b72a
 DIST lcms2-2.6.tar.gz 4583389 SHA256 5172528839647c54c3da211837225e221be93e4733f5b5e9f57668f7107e14b1 SHA512 af2dd8829a5d8b280688bc247812829c885368951d385a23a1596cf8d0a7aed627c8faa35740073efc51a86ef5c900fc9bdb9dcdfad885fb8b1eae16953f9041 WHIRLPOOL 4fe1be53c48b0928bd474e05613c443eea49570a074d22b71863c485408523116927655b57d86bcb02aca85d9e06c0e26d9ee46bc7c4d746e91e951212de9e59
 EBUILD lcms-1.19-r1.ebuild 2605 SHA256 6197c779c7d3c7432704141fe1912ed1ba0b43c872c74c72eb580df60fe1d854 SHA512 a8a0903702baf0d1292167bed619eae38cfffd4dbf472a1483ae893f237000eb5a306b54be3a61755232fa855ed65b5cf73914804ad8e5c20db9a61d08499b8e WHIRLPOOL cdf0ec7f197e1c579af286a412f737fe401c401be6e04abf7acab8f786fd43aaef7f50dc030197888a68a800af6aef320c00f06fcef7d98f856b39cb70618d28
 EBUILD lcms-1.19-r2.ebuild 2945 SHA256 c3014b847f8c24e6ba6efa190fce9a85213fc4780348fac0e3c4f29096358a82 SHA512 f116f1e5954e8d5a175fbe61cbadd3532c9ae97d14824acf3e1aae8be91aa8309ceaa43892ad07469d8953d3f6ba3b4cda8af890c54d2ceab7486c06b1410e72 WHIRLPOOL fcd1208562c1f28c22edc1aaa74632d4de81734e8bf56111fda8c516967bbbad0edd6ce90682694bb312ae87f3fa0b9a1e46275fecd33fb1012915132953ee6b
+EBUILD lcms-1.19-r3.ebuild 2982 SHA256 c42a93b56c1dcd9a2b23c81530195534f330b407c00fb6a15ea946616d8e8ed6 SHA512 fbbea6c17356f969cbdf6b5d91a6cc3083ece4c898af0d6b700437f07809eb7c312b45093f0f5938d102423636160e342662568ef634f79f863f4d8549ae1d6b WHIRLPOOL 55079eadd5438e1cd3f603837586e90e03f61ed0d4cac6018b52918bc1a65835e855832449798e29c342f5c7c91ce075fd9c91391e04b7b10aee78e354a6ff72
 EBUILD lcms-1.19.ebuild 2710 SHA256 0e21a730735f70db5d58b7eb16f453bc50f5953c5cbc2eb86eb73eb8d528f479 SHA512 1ef0381d435d04e93fc330eb892f743c48a986f368914a6c452c0575417f1119344e65f906d84f565ecfe8ac9d0283fae2e9bccc6d5f2545a51cd8138846562f WHIRLPOOL 8fcbc34c9e4814b0720cf487442b3ee32632900c8b8f4024f40d87f65b9d38ac4e9c515e1ba82446166899cb106d0c0b6bf64e9d974e5614f65757c0ee0642e2
 EBUILD lcms-2.3.ebuild 1199 SHA256 2a48cdc394f86efd05a30227deef20095077dd719266834d93c91df867a926ed SHA512 bfecb719eeb71da7c0ffd65d69064e73a174de4c58160f852be59f720957b42c86d9e85c8f4000d945314b61a5240828af1628f394f0cffae26d1aa25e581ac6 WHIRLPOOL 8de76ba66d15ea0f9d3509a17a72ebd817c04db87893449a12ac20fb3987d16609f5eed626f45a276d062afa80ef2a41a5507e80cf165e163deed1e3f2c9811a
 EBUILD lcms-2.4.ebuild 1223 SHA256 9913a16c3eb028e2b7801e91ceeac15d6097c1b9a772396a7f57144655473aca SHA512 4f4c781f0133bb8b7299e8840709ef955a228c0c5d6ab1d4faf043da910c8be80c6f43e77ce79b79819ca062e8f0df4e2963f14e6d1428230eb76e1b64edf6f2 WHIRLPOOL c30e5ae288833732fa8284d72da967eb6d448ff3d2a1554556b122ca262c7fdc422a1542c25628afd3c56dba7c3e51c824bb442b5139e6f61a4bfb5de88d5557
 EBUILD lcms-2.5-r1.ebuild 1383 SHA256 bebae0d4da68a9f2ed9cb5ad6bd465a418da24061be1f0bf9b28305150d06270 SHA512 a959c3feb304c53e73740d73db05d95d53792fa9e6fab2490639f89afd6abd9380c2c4114c920c8b31afb3439cc019174d398de843adf57fcd3057dc4343412d WHIRLPOOL b7d6565f4ae0c97fa4356575f41969206399c23903fcfec7a1fa900e92e8f7639c61815dac5e90bcf5f88ac39789e4b998bf45ba0ffe50118b5e1f70feb0f0b1
 EBUILD lcms-2.5.ebuild 1140 SHA256 84d16fbd4e4d820e01350167face78804aab8c8fb32ce2e178d2f4b0c2eefc48 SHA512 00b536ca98f6f2c0a91360b79ff97b310744fc396e798feed98e68361e1e9d8675c23a959d721047af16bc3c63c2aedfd8367954027946cacf355124a244f984 WHIRLPOOL 2f1a9af5ec48cbe4f25c3e678ad5e07813a838b9bb87d8ffa8ab03e38e52376fa59dd9efbc2fe53033dff9ed03ec8da7d50e95f8d4eac67c2259684e7956cab1
 EBUILD lcms-2.6.ebuild 1412 SHA256 855ea682afa9569531f2579aae3359bf6d30578d7e8a5caeebf27fc6556b3d73 SHA512 aa6f23dfc5cdb1ef742151f2eb5bf02e531b150bea86cc46abe7dc95ab546c7aa2a30aeae06625853bdbfa351d4ce3c38d120d1ead48b9b2a2e7d8919e3a9405 WHIRLPOOL d42dfa700752b758503a72243469414a78dc2b2e4b7c93a46374feb85f07df6c57121c305c1be18829c915aeea380e5176fb4547325dfd2e3467fd2d122167ea
-MISC ChangeLog 22184 SHA256 dd8ee3a7664322f2e5ef804d482131c1da5be672acbe88cd670527176d4b758f SHA512 c63727af19da5e2c88a4c3daec46ff483bb172e011f53e10daf96037e9e87f29b827830c9ca1a180c868dffe3acf5feb1db5a42447c7a8c95899cc768fc92cbc WHIRLPOOL 5f7e80f01053b114cd50c8d2c23ad9d3248e4c7336f6ed0c37f18189ab52a01ef60fd48e8a84cc5ae41491fcd80a73dd5b7ed9b1ba6a2063fb335a8afc730754
+MISC ChangeLog 22365 SHA256 6bc78f0a2c2b0b13d353b752b5ec5c70567f40d5d6c40ab7b5c4ca58353e5ac5 SHA512 2bd2c91c0141473371105e49a0f62f287b4da82a1814ddfd291baec8368d1a7c50cf0fd7f82d1ecd82fad99aed94206341753ac2950f0c4078d8366d751eb338 WHIRLPOOL f492d2a9d3a7009bd1b7c106085bccb7ed577fa407c35a24bd6ef858a8efb32655b08945d5cf642405fceb2360879e2ca5357381c36b67e54c3de0409d41c929
 MISC metadata.xml 161 SHA256 7c85e6739a71f5bb23e8de36c88677d772946e61f7285892f7554e37bd2bca76 SHA512 3b5d653ba492267297653f61d148b859d366b53d9c29670f175c84622f6ad64141e93e30db08e24f87a75e6fcf1ab187cc8783b72aa2ee1709cf1ef6c7c75e22 WHIRLPOOL 2516e48e62e1604c152e32a6336881cb02f3599c23856a220019bc807611880480bfe4af7a60a2bb45efbb93faf89141ccfd9fde69044677604bf976dfb65988
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.22 (GNU/Linux)
+Version: GnuPG v2.0
 
-iQIcBAEBCAAGBQJTtwLcAAoJELp701BxlEWfNNIQAIo3tSEFEWU6k9l50D34ZuNo
-oa19zvd5LxUk/gTa+veTmi1DIKnfulYBNhlkpQrvYI9JZ1XxvGZzqYdp3Mu7pbfh
-p7cHjJpOa7rs1a6Dg1mjGGmKyk7Ur3/lSrj3aGO/NOll7nXEMOsw9Om6GnGc5VYl
-tyC4+doEPHaam9243yePEz9IrXkMLUkRVBxhvG2Vru44N+k/UkebdYW2JgoGz3rE
-T1JcuIMJzC/FuE1iCMCDazGtxQ9TlOpvbn7G/39Gs3k5+XFl88xE0dfrFoDSZ/2N
-clvUGcWTVYdT+sPj+ZTT0d/GhEVg3gTtY5ty+WR8H9HQNdUu5R4a4oR7qeolffiB
-vu82yWJ+KDWqWuOt27lhrNB5/tokgT3e25VuHIzQH6jiSVs57ETRnKmy2DFr6wN9
-VNqKq1YtNdpiBDKVOcqRBxzw4Yuun1QpOOyf67BhXUDqVVVCwwRBFo1vBCxmUhi5
-+zYpd3T4CEZfQbhob/v0nTZf5+DHGD3mYtrh9aH05QHTer6LWmByzd7D6Tr+FFVt
-7kzf/v35LE/yskm1F9Ttd8SiGrXKKSAsqDK//HV2ZSvHzJDbcu04luEZxHnM9U1+
-FE+BlN/ZDajDXZQ8nzZuof9G2Dm4dBBPImkc2z4E9DLk5yPkAIlZgT0heotQT8D1
-ZNfQ2wbvS4BIda0lLq9Z
-=WFir
+iQIcBAEBCAAGBQJUSVdWAAoJELhOzYlK7nn/tBgQAKyrqKAtUTxZxGVfjQJFHSZP
+b6ceWfruBZwlwD99C8GXphET07yu2NHr+e1PVr2M7wmXZHL7g8WPXJXPkPbGXPix
+EDgaTdTWveoM8ms1p2lySRpd4S/aCliUvhRDp2ZnJ1FHjYkQG+8zsiDhIkDzq0IU
+ZCy++lRvyd41WigDfjAv9NXllIeZg9/14UaQ8sKYyNAZRaKtlqW2oggzwlB3q4oP
+47khmYkShwFxn8Fo1x7+cA2uglCftT4M1RQOR//2KKT4pDMFoOvv4mMe8HnLJXBY
+xPPyIEQA6uVDva2LmgkiiOL69vmJk1jyKUtsT3GXGzy710Z9OnNKrTiwQK0p6vka
+SuAYGZCfcVm/MTf9t0GegFUACxFYbiaPQTXF613x76StxutEWu1TCXE46+B/mw+0
+xoNBYHODoYZcJzP7WT0vjxBAkL9sBGHc/TrhXhGQxx2ZND4IrrxCllQYh1lAKm5O
+b6FyHtxOi4AROYrY2UCdPTzmNa2i2gwYuH3n0p6A0ws1EPUGO5LF86gzZfnJytGz
+bpupFYn8YbbnuLjonynMsK3ti8ocyNddh4xhxR1h+t2J/Tx0f41tU/VOE/n7NJPx
+wYUOssDRSAMYpVhuOvkjhIFO1ARaKt2J02tgaC1HGTBoMbnZbRJuGQu20vh3oL1i
+n8ZKYBjfmQC8xQGSZTD7
+=2YF0
 -----END PGP SIGNATURE-----
diff --git a/media-libs/lcms/files/lcms-1.19-cve-2013-4276.patch b/media-libs/lcms/files/lcms-1.19-cve-2013-4276.patch
new file mode 100644
index 000000000000..87c96605d6b0
--- /dev/null
+++ b/media-libs/lcms/files/lcms-1.19-cve-2013-4276.patch
@@ -0,0 +1,69 @@
+patch taken from:
+  https://bugzilla.redhat.com/show_bug.cgi?id=991757
+
+patch checked against:
+  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718682#10
+  https://build.opensuse.org/package/view_file/openSUSE:Evergreen:11.2:Test/lcms/CVE-2013-4276.patch
+
+diff -ur lcms-1.19.dfsg/samples/icctrans.c lcms-1.19.dfsg-patched/samples/icctrans.c
+--- lcms-1.19.dfsg/samples/icctrans.c	2009-10-30 15:57:45.000000000 +0000
++++ lcms-1.19.dfsg-patched/samples/icctrans.c	2013-08-06 11:53:14.385266647 +0100
+@@ -86,6 +86,8 @@
+ static LPcmsNAMEDCOLORLIST InputColorant = NULL;
+ static LPcmsNAMEDCOLORLIST OutputColorant = NULL;
+ 
++unsigned int Buffer_size = 4096;
++
+ 
+ // isatty replacement
+ 
+@@ -500,7 +502,7 @@
+ 
+     Prefix[0] = 0;
+     if (!lTerse)
+-        sprintf(Prefix, "%s=", C);
++        snprintf(Prefix, 20, "%s=", C);
+ 
+     if (InHexa)
+     {
+@@ -648,7 +650,9 @@
+ static
+ void GetLine(char* Buffer)
+ {    
+-    scanf("%s", Buffer);
++    char User_buffer[Buffer_size];
++    fgets(User_buffer, (Buffer_size - 1), stdin);
++    sscanf(User_buffer,"%s", Buffer);
+     
+     if (toupper(Buffer[0]) == 'Q') { // Quit?
+ 
+@@ -668,7 +672,7 @@
+ static
+ double GetAnswer(const char* Prompt, double Range)
+ {
+-    char Buffer[4096];
++    char Buffer[Buffer_size];
+     double val = 0.0;
+ 	       
+     if (Range == 0.0) {              // Range 0 means double value
+@@ -738,7 +742,7 @@
+ static
+ WORD GetIndex(void)
+ {
+-    char Buffer[4096], Name[40], Prefix[40], Suffix[40];
++    char Buffer[Buffer_size], Name[40], Prefix[40], Suffix[40];
+     int index, max;
+ 
+     max = cmsNamedColorCount(hTrans)-1;
+diff -ur lcms-1.19.dfsg/tifficc/tiffdiff.c lcms-1.19.dfsg-patched/tifficc/tiffdiff.c
+--- lcms-1.19.dfsg/tifficc/tiffdiff.c	2009-10-30 15:57:46.000000000 +0000
++++ lcms-1.19.dfsg-patched/tifficc/tiffdiff.c	2013-08-06 11:49:06.698951157 +0100
+@@ -633,7 +633,7 @@
+     cmsIT8SetSheetType(hIT8, "TIFFDIFF");
+     
+    
+-    sprintf(Buffer, "Differences between %s and %s", TiffName1, TiffName2);
++    snprintf(Buffer, 256, "Differences between %s and %s", TiffName1, TiffName2);
+   
+     cmsIT8SetComment(hIT8, Buffer);
+ 
diff --git a/media-libs/lcms/lcms-1.19-r3.ebuild b/media-libs/lcms/lcms-1.19-r3.ebuild
new file mode 100644
index 000000000000..48cf6e8cf939
--- /dev/null
+++ b/media-libs/lcms/lcms-1.19-r3.ebuild
@@ -0,0 +1,111 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/lcms/lcms-1.19-r3.ebuild,v 1.1 2014/10/23 19:30:38 tamiko Exp $
+
+EAPI="5"
+
+PYTHON_COMPAT=( python{2_6,2_7,3_2,3_3,3_4} )
+
+# autoreconf needs to update python macros for py3 support.
+AUTOTOOLS_AUTORECONF=1
+
+inherit autotools-multilib python-r1
+
+DESCRIPTION="A lightweight, speed optimized color management engine"
+HOMEPAGE="http://www.littlecms.com/"
+SRC_URI="http://www.littlecms.com/${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x86-freebsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="jpeg python static-libs tiff zlib"
+
+RDEPEND="
+	tiff? ( >=media-libs/tiff-4.0.3-r6:0[${MULTILIB_USEDEP}] )
+	jpeg? ( >=virtual/jpeg-0-r2:0[${MULTILIB_USEDEP}] )
+	zlib? ( >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+	abi_x86_32? (
+		!<=app-emulation/emul-linux-x86-baselibs-20140508-r11
+		!app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+	)
+"
+DEPEND="${RDEPEND}
+	python? ( >=dev-lang/swig-1.3.31 )
+"
+
+PATCHES=(
+	"${FILESDIR}/${P}-disable_static_modules.patch"
+	"${FILESDIR}/${P}-implicit.patch"
+	"${FILESDIR}/${P}-fix-swig-destructor.patch"
+	"${FILESDIR}/${P}-fix-python3.2.patch"
+	"${FILESDIR}/${P}-cve-2013-4276.patch"
+)
+
+src_prepare() {
+	# Breaks out-of-source build, only corresponding .in file is needed
+	rm include/icc34.h || die 'rm failed'
+
+	autotools-utils_src_prepare
+
+	# run swig to regenerate lcms_wrap.cxx and lcms.py (bug #148728)
+	if use python; then
+		cd python || die
+		bash swig_lcms || die
+	fi
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(use_enable static-libs static)
+		$(use_with jpeg)
+		$(use_with tiff)
+		$(use_with zlib)
+	)
+	autotools-utils_src_configure --without-python
+
+	if multilib_is_native_abi && use python; then
+		python_parallel_foreach_impl \
+			autotools-utils_src_configure --with-python
+	fi
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python; then
+		# Note: it intentionally passes evaluated 'parent' dir.
+		python_parallel_foreach_impl \
+			autotools-utils_src_compile -C python \
+			top_builddir="${BUILD_DIR}"
+	fi
+}
+
+multilib_src_test() {
+	cp "${S}"/testbed/*icm testbed/ || die
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${ED}" BINDIR="${ED}"/usr/bin install
+
+	if multilib_is_native_abi && use python; then
+		# Note: it intentionally passes evaluated 'parent' dir.
+		python_foreach_impl \
+			autotools-utils_src_install -C python \
+			top_builddir="${BUILD_DIR}"
+
+		python_parallel_foreach_impl python_optimize
+	fi
+
+	insinto /usr/share/lcms/profiles
+	doins "${S}"/testbed/*.icm
+}
+
+multilib_src_install_all() {
+	DOCS=( AUTHORS README.1ST INSTALL NEWS doc/{LCMSAPI,TUTORIAL}.TXT )
+
+	einstalldocs
+	prune_libtool_files --modules
+}