From b67d2844ae6ce5b2407866d3eef4e272c5947de1 Mon Sep 17 00:00:00 2001 From: rhatto Date: Tue, 13 Jan 2009 14:34:52 +0000 Subject: jhead: adding patch to fix GLSA 200901-02 git-svn-id: svn+slack://slack.fluxo.info/var/svn/mkbuilds@359 18ef50b8-d735-4ccd-97c1-689132df3dd9 --- media/gfx/jhead/Manifest | 5 +- media/gfx/jhead/jhead-2.84.diff | 122 +++++++++++ media/gfx/jhead/jhead.mkbuild | 2 +- net/www/mozplugger/Manifest | 4 +- net/www/mozplugger/mozplugger.mkbuild | 4 +- net/www/mozplugger/mozpluggerrc | 396 ---------------------------------- 6 files changed, 130 insertions(+), 403 deletions(-) create mode 100644 media/gfx/jhead/jhead-2.84.diff delete mode 100644 net/www/mozplugger/mozpluggerrc diff --git a/media/gfx/jhead/Manifest b/media/gfx/jhead/Manifest index a002276..eef1fd4 100644 --- a/media/gfx/jhead/Manifest +++ b/media/gfx/jhead/Manifest @@ -1,3 +1,4 @@ DIST jhead-2.84.tar.gz 64159 MD5 3e009f8e8a6a077d4a966d14b8797038 SHA1 63251c63a7d88e4f7b00f287ebc7b1095c2422f6 SHA256 c4811e7672703e09831bc931eac129a003a5949c43298ad8c6bba10e04797294 SHA512 11110fcc32a1463dda55bf4efa6f24122660312352e7cff3c78613cdd0f9d1651eee4dd06ea9569f79a9eb9a023a76bc7387ab80e0ec20546e50f4e63667b728 RMD160 018b75450d7a1e1c2018fd05b2c3c25f70cd8669 -MKBUILD jhead.mkbuild 2850 MD5 ec35eddec7605c6364eed96b1eba7ed9 SHA1 9f6bf28489b8aa101d58d513cfd0404ef2f3140d SHA256 70615d0bdbbee15f35808e0fccd4bc2f01a4f8e644ab8b015aa4012e7452190c SHA512 9d2f90f9bbabe3986dbc2f4d4e46f164c7a21ed2fb1da8adb4c773db71b4a1581864fe0cfb41a7ca44ac068719fa201b57feedab9a688db83d60e69fbdb4c8a6 RMD160 28116d69d734da5973b38c6d53d6a53801088d1b -SLACKBUILD jhead.SlackBuild 6322 MD5 ee0e06362f301c5dafdfe4aff779b684 SHA1 fa8430525ab4f1feef7f7333c609e5d287702b65 SHA256 254d674c994ac9b72ececad63a7b2a955533ed359f332797db89a588ddbbceb8 SHA512 44fbdab621e65c7569be0e3a8134c845acf46e09c00af9ce09f0dec7fe9216343f699b1266526a939e0ed1c5832687830add211c788064a87f9f3346ca18c619 RMD160 ccd8463f0360af1f878e916fdf4dce847aec4666 +MKBUILD jhead.mkbuild 2850 MD5 330ae5992ddf62ce30c2dd525e550365 RMD160 ad3a9d82b58398aa133ab35a4bb5a981ad892d35 SHA1 d24735fc18f8660f541ee5538fa25e76a2b303cf SHA256 1018a09afbf5f132eb9a787e3346d0a2e5d2eb7e219cef451dc063f80d8357be SHA512 a572e2636035e8d4eff15fdc38439f00aa15c6b5d22749716728cc69885b2b2eee43bbb88fae39f30c15825dfb2aff18ecb7c128243f05ffcf2164d451dc26ff +PATCH jhead-2.84.diff 4346 MD5 4d59c419285eb61c6d399c99c9d56bad RMD160 3312ba98eb1743d059cc96ced9ef58df8ecbfe38 SHA1 bf70d638464cf8df84c715e0933f708cc066b804 SHA256 dd7a611a9ac66687d7386e880d8319b9cc4a7175e3f5fec961b596ffc137d458 SHA512 6465eed64f02581926bc87d132cd5eedeebfc043add6f8f25b18c2d954d8c6a34f541fbea246f121f0be84a5d0217f00a7ff015c15fffa9bbff914e74ad232cd +SLACKBUILD jhead.SlackBuild 7302 MD5 5fdaab5eca79a52cf9c9fbd2abc1bd9e RMD160 5a965b5e8ce77cee97c8da91b48e819c156b43ef SHA1 245838a86dce04f003c1192f22148942a7aeb7aa SHA256 3497f4174a90eab11a06937c25f40f281269c6d7d6d6eae60c11a94f8857418c SHA512 70d868b2aa29e20778d2789e15821475671777f0ec0397034a7e481e8ea5727b31887df6ea0115ff8008b42c32c19b4dabe4318cd8a9ede19f0358a22c9e5610 diff --git a/media/gfx/jhead/jhead-2.84.diff b/media/gfx/jhead/jhead-2.84.diff new file mode 100644 index 0000000..4ed8ff5 --- /dev/null +++ b/media/gfx/jhead/jhead-2.84.diff @@ -0,0 +1,122 @@ +this patch fixes gentoo bug #243238 (CVE-2008-{4640,4641}) + +diff -ru jhead-2.84.orig/jhead.c jhead-2.84/jhead.c +--- jhead-2.84.orig/jhead.c 2008-10-04 18:10:35.000000000 +0200 ++++ jhead-2.84/jhead.c 2008-11-28 18:51:52.000000000 +0100 +@@ -295,44 +295,88 @@ + + + //-------------------------------------------------------------------------- ++// Escape an argument such that it is interpreted literally by the shell ++// (returns the number of written characters) ++//-------------------------------------------------------------------------- ++static int shellescape(char* to, const char* from) ++{ ++ int i, j; ++ i = j = 0; ++ ++ // Enclosing characters in double quotes preserves the literal value of ++ // all characters within the quotes, with the exception of $, `, and \. ++ to[j++] = '"'; ++ while(from[i]) ++ { ++#ifdef _WIN32 ++ // Under WIN32, there isn't really anything dangerous you can do with ++ // escape characters, plus windows users aren't as sercurity paranoid. ++ // Hence, no need to do fancy escaping. ++ to[j++] = from[i++]; ++#else ++ switch(from[i]) { ++ case '"': ++ case '$': ++ case '`': ++ case '\\': ++ to[j++] = '\\'; ++ default: ++ to[j++] = from[i++]; ++ } ++#endif ++ if (j >= PATH_MAX) ErrFatal("max path exceeded"); ++ } ++ to[j++] = '"'; ++ return j; ++} ++ ++ ++//-------------------------------------------------------------------------- + // Apply the specified command to the JPEG file. + //-------------------------------------------------------------------------- + static void DoCommand(const char * FileName, int ShowIt) + { + int a,e; +- char ExecString[PATH_MAX*2]; +- char TempName[PATH_MAX+1]; ++ char ExecString[PATH_MAX*3]; ++ char TempName[PATH_MAX+10]; + int TempUsed = FALSE; + + e = 0; + +- // Make a temporary file in the destination directory by changing last char. +- strcpy(TempName, FileName); +- a = strlen(TempName)-1; +- TempName[a] = (char)(TempName[a] == 't' ? 'z' : 't'); ++ // Generate an unused temporary file name in the destination directory ++ // (a is the number of characters to copy from FileName) ++ a = strlen(FileName)-1; ++ while(a > 0 && FileName[a-1] != '/') a--; ++ memcpy(TempName, FileName, a); ++ strcpy(TempName+a, "XXXXXX"); ++ mkstemp(TempName); ++ if(!TempName[0]) { ++ ErrFatal("Cannot find available temporary file name"); ++ } ++ ++ + + // Build the exec string. &i and &o in the exec string get replaced by input and output files. + for (a=0;;a++){ + if (ApplyCommand[a] == '&'){ + if (ApplyCommand[a+1] == 'i'){ + // Input file. +- e += sprintf(ExecString+e, "\"%s\"",FileName); ++ e += shellescape(ExecString+e, FileName); + a += 1; + continue; + } + if (ApplyCommand[a+1] == 'o'){ + // Needs an output file distinct from the input file. +- e += sprintf(ExecString+e, "\"%s\"",TempName); ++ e += shellescape(ExecString+e, TempName); + a += 1; + TempUsed = TRUE; +- unlink(TempName);// Remove any pre-existing temp file + continue; + } + } + ExecString[e++] = ApplyCommand[a]; + if (ApplyCommand[a] == 0) break; + } +- ++ShowIt = 1; + if (ShowIt) printf("Cmd:%s\n",ExecString); + + errno = 0; +@@ -638,7 +682,7 @@ + ErrFatal("Orientation screwup"); + } + +- sprintf(RotateCommand, "jpegtran -%s -outfile &o &i", Argument); ++ sprintf(RotateCommand, "jpegtran -trim -%s -outfile &o &i", Argument); + ApplyCommand = RotateCommand; + DoCommand(FileName, FALSE); + ApplyCommand = NULL; +@@ -657,7 +701,7 @@ + strcpy(ThumbTempName_out, FileName); + strcat(ThumbTempName_out, ".tho"); + SaveThumbnail(ThumbTempName_in); +- sprintf(RotateCommand,"jpegtran -%s -outfile \"%s\" \"%s\"", ++ sprintf(RotateCommand,"jpegtran -trim -%s -outfile \"%s\" \"%s\"", + Argument, ThumbTempName_out, ThumbTempName_in); + + if (system(RotateCommand) == 0){ diff --git a/media/gfx/jhead/jhead.mkbuild b/media/gfx/jhead/jhead.mkbuild index 153ab57..d8cf43b 100644 --- a/media/gfx/jhead/jhead.mkbuild +++ b/media/gfx/jhead/jhead.mkbuild @@ -64,7 +64,7 @@ off: md5sum_download_and_check_1 off: gpg_signature_check on: manifest_check on: untar_source -off: patch_source + on: patch_source off: configure on: make_package on: install_package diff --git a/net/www/mozplugger/Manifest b/net/www/mozplugger/Manifest index b306dcc..1c60b7c 100644 --- a/net/www/mozplugger/Manifest +++ b/net/www/mozplugger/Manifest @@ -1,5 +1,5 @@ DIST mozplugger-1.12.0.tar.gz 95073 MD5 6d4dd7b1c577f625c9d664532389d6db RMD160 87c82713de2dd9b139ea0b49f856b6797c913fb8 SHA1 5107338378795c147e79c04eead8f9fa7f6ebd28 SHA256 1312aad8078dcda7f8ec8e9d756786034420406bf1658066d60392bdaa7befee SHA512 54b3308b806ae11e0021549bb8873d7f57efc9979858f3e746368a19c9d553dc9b8bcd92c7c60f57c3897d06abcb7afce4173218a0e57982814c370941c929ee MISC mozpluggerrc 13726 MD5 e1537238645697581fd7654cfa7c8fa4 RMD160 e53c56bdb110a2c29f09608f0436ba855d5e95f0 SHA1 e808d691ea7729321cdccff2e5b6f58a324229d3 SHA256 c222dd52ce470a9effdc79c490a2fd17e3cefe0c83b70ec78a8b7719fafb10fb SHA512 37b17db22a76dfa85521867b1cd049ff472caf4767754bc433eb9a4e932b522721e072760f7e026915945f4195d241fe4956a6e810982542a553ed87e683a601 MISC mozpluggerrc.new 13726 MD5 e1537238645697581fd7654cfa7c8fa4 RMD160 e53c56bdb110a2c29f09608f0436ba855d5e95f0 SHA1 e808d691ea7729321cdccff2e5b6f58a324229d3 SHA256 c222dd52ce470a9effdc79c490a2fd17e3cefe0c83b70ec78a8b7719fafb10fb SHA512 37b17db22a76dfa85521867b1cd049ff472caf4767754bc433eb9a4e932b522721e072760f7e026915945f4195d241fe4956a6e810982542a553ed87e683a601 -MKBUILD mozplugger.mkbuild 3381 MD5 3cd301a9235d518348fae7ec4f04f11b RMD160 51b1046be42127c09f62c8a8bbad74f5ea0a597e SHA1 8dbe765c4634104d0d602fa9902ec5b1e931da21 SHA256 f670466afdc5ff72e820c9d07b37c9950a35977d42ca3fa99e4a0aaf4c762dc5 SHA512 c8aec846ad5a0c2c14ba59ce714dc887fca6ba51bb15b96848fc3bd4f3fb3b9d98ab3f374271d0cd7361e18f4541abef26730743f47c5bc32a565529c8dfb5bc -SLACKBUILD mozplugger.SlackBuild 7985 MD5 6b28f3d50a01f11556ba01984973d69a RMD160 dc8df30974278d7ebaa3a17695161baa76a0f6b0 SHA1 4e28938aaa2acd22e97721850b49cf1c9b03f291 SHA256 e92b92f2a23efba84c0346191e59c286ae835dad75baab5312651f7309198057 SHA512 79cccd2cfe6bbd32cf224ba6aaf9002bb1a92138cf95f4a388dc06502b5ee976c62fe8d8838812c67f1fdfd19f0cfb73b3c8c1bb55eba13c587348e10aef6df7 +MKBUILD mozplugger.mkbuild 3385 MD5 bc8b4018723ef349fb1b28a1d632e9ed RMD160 7fdfcf2581c03550b662cd5c21a79af2ac979545 SHA1 e987919ff80ea467f6a804fdeb46ba1628ca4f55 SHA256 6536032cdbdb8aadb60558ae842dc4132825d73f0857c4c0344baba9c7759478 SHA512 be8d521b88e608ba46a334bfc3f488c9c036cd2d24540804d00b5ac782ef2b2074575584dc22aa1e8c512f3154983844e2a6cbd56834b3b2f6aedd728343efc6 +SLACKBUILD mozplugger.SlackBuild 7670 MD5 da79191cfda9b5105b8988b8b58ca3ad RMD160 f533e221ab511fd842ecd372fb534608bdb5375a SHA1 7298ec4ea4975437576802dbe0cc8ec2d7e763ac SHA256 fc21065da60064feff38b860b9bbf82fb18d131d36f9e54a609a5c512c7af704 SHA512 17249643fddaab7d6f197f223e342b37db16d30b6badb16b44f1bbb6bab7343ace2edca72a3bf30258bebdee7bb3956dc6ab5704a03950df380763a85b8aae20 diff --git a/net/www/mozplugger/mozplugger.mkbuild b/net/www/mozplugger/mozplugger.mkbuild index 2474ce2..d2abe4b 100644 --- a/net/www/mozplugger/mozplugger.mkbuild +++ b/net/www/mozplugger/mozplugger.mkbuild @@ -47,7 +47,7 @@ [[SLACKBUILD PATH]]="net/www/mozplugger" # Config files -[[CONFIG FILES]]="mozpluggerrc" +[[CONFIG FILES]]="etc/mozpluggerrc" [[REST OF DOINST.SH]]="config etc/mozpluggerrc.new" #--------------------- @@ -82,7 +82,7 @@ off: configure off: compress_manpages off: compress_info_files off: copy_init_scripts - on: copy_config_files +off: copy_config_files on: install_documentation on: slackdesc on: move_config_files diff --git a/net/www/mozplugger/mozpluggerrc b/net/www/mozplugger/mozpluggerrc deleted file mode 100644 index 152e675..0000000 --- a/net/www/mozplugger/mozpluggerrc +++ /dev/null @@ -1,396 +0,0 @@ -# Configure file for MozPlugger 1.10 -# Version: July 15, 2008 -# -# Commands which are not installed on your system will not be used. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA. - - -################### -### m4 macros ### -################### - -changequote([,]) - -### Helpers - -### MPlayer - -define(MP_CMD,[mplayer -really-quiet -nojoystick -nofs -zoom -vo xv,x11 -ao esd,alsa,oss,arts,null -osdlevel 0 $1 &1 | grep vorbis]),[],[ - define(MP_NO_VORBIS) -],[ - define(MP_VORBIS) -]) - -### Totem - -define(TM_CMD,[totem $1 /dev/audio - -audio/wav:wav:Microsoft wave file -audio/x-wav:wav:Microsoft wave file -audio/x-pn-wav:wav:Microsoft wave file -audio/x-pn-windows-acm:wav:Microsoft wave file - controls: play "$file" - controls: wavplay -q "$file" - controls noisy: bplay "$file" - controls: splay "$file" - nokill noisy : xmms -e -p "$file" - repeat noisy swallow(alsaplayer): alsaplayer -q "$file" - -audio/x-pn-realaudio-plugin:rpm:RealPlayer Plugin Metafile -audio/x-pn-realaudio:ra,rm,ram:Realaudio-plugin resource locator -audio/x-realaudio:ra,rm,ram:RealAudio file -application/vnd.rn-realmedia:rm:RealMedia file -application/smil:smi:RealPlayer -audio/vnd.rn-realaudio:ra,ram:RealAudio file -audio/vnd.rn-realvideo:rv:RealVideo file - nokill stream: hxplay "$file" - nokill stream: realplay "$file" - -audio/x-ms-wax:wax:Windows Media Audio - MP_AUDIO_STREAM(-playlist-playlist)) - TM_AUDIO_STREAM() - -audio/x-ms-wma:wma:Windows Media Audio - MP_AUDIO_STREAM() - TM_AUDIO_STREAM() - -####################### -### Documents ### -####################### - -image/sun-raster:rs:SUN raster image -image/x-sun-raster:rs:SUN raster image -image/x-rgb:rgb:RGB Image -image/x-portable-pixmap:ppm:PPM Image -image/x-portable-graymap:pgm:PGM Image -image/x-portable-bitmap:pbm:PBM Image -image/x-portable-anymap:pnm:PBM Image -image/tiff:tiff,tif:TIFF image -image/x-tiff:tiff,tif:TIFF image - exits: display -window $window -backdrop "$file" - repeat noisy swallow(gqview) fill: gqview -t "$file" - swallow(:) maxaspect: xv -ima -igeom +9000+9000 -geometry +9000+9000 "$file" - repeat swallow(display): display "$file" - repeat swallow(Sdtimage) fill: sdtimage "$file" - swallow(*qiv:) fill maxaspect: qiv -n "$file" - -image/x-xcf:xcf:Gimp Image -image/xcf:xcf:Gimp Image -application/x-gimp:xcf:Gimp Image -application/gimp:xcf:Gimp Image - exits: display -window $window -backdrop "$file" - repeat swallow(display) fill: display "$file" - -application/photoshop:psd:PhotoShop Image -application/x-photoshop:psd:PhotoShop Image - exits: display -window $window -backdrop "$file" - repeat swallow(display) fill: display "$file" - -application/pdf:pdf:PDF file -application/x-pdf:pdf:PDF file -text/pdf:pdf:PDF file -text/x-pdf:pdf:PDF file - ACROREAD() - repeat noisy swallow(evince) fill: evince "$file" - repeat noisy swallow(kpdf) fill: kpdf "$file" - repeat noisy swallow(Xpdf) fill: xpdf -g +9000+9000 "$file" - repeat noisy swallow(okular) fill: okular "$file" - GV() - -application/x-dvi:dvi:DVI file - repeat swallow(kdvi) fill: kdvi "$file" - repeat swallow(xdvi) fill: xdvi -safer -hush -geometry +9000+9000 "$file" - -application/x-postscript:ps:PostScript file -application/postscript:ps:PostScript file - GV() - repeat noisy swallow(evince) fill: evince "$file" - -application/x-rtf:rtf:Rich Text Format -application/rtf:rtf:Rich Text Format -text/rtf:rtf:Rich Text Format - OO() - repeat noisy swallow(AbiWord) fill: abiword --nosplash --geometry +9000+9000 "$file" - repeat noisy swallow(kword): kword "$file" - repeat noisy swallow(Ted) fill: Ted "$file" - -application/x-msword:doc,dot:Microsoft Word Document -application/msword:doc,dot:Microsoft Word Document - OO() - repeat noisy swallow(kword): kword "$file" - repeat noisy swallow(AbiWord) fill: abiword --nosplash --geometry +9000+9000 "$file" - -application/vnd.ms-excel:xls,xlb:Microsoft Excel Document - OO() - repeat swallow(Gnumeric) fill: gnumeric "$file" - -# OpenOffice MimeTypes (http://framework.openoffice.org/documentation/mimetypes/mimetypes.html) -application/vnd.sun.xml.writer:sxw:OpenOffice Writer 6.0 documents -application/so7_vnd.sun.xml.writer:sxw:OpenOffice Writer 7.0 documents -application/vnd.sun.xml.writer.template:stw:OpenOffice Writer 6.0 templates -application/vnd.sun.xml.writer.global:sxg:OpenOffice Writer 6.0 global documents -application/vnd.stardivision.writer:sdw:StarWriter 5.x documents -application/vnd.stardivision.writer-global:sgl:StarWriter 5.x global documents -application/x-starwriter:sdw:StarWriter 4.x documents - OO() - -application/vnd.sun.xml.calc:sxc:OpenOffice Calc 6.0 spreadsheets -application/so7_vnd.sun.xml.calc:sxc:OpenOffice Calc 7.0 spreadsheets -application/vnd.sun.xml.calc.template:stc:OpenOffice Calc 6.0 templates -application/vnd.stardivision.calc:sdc:StarCalc 5.x spreadsheets -application/x-starcalc:sdc:StarCalc 4.x spreadsheets -application/vnd.lotus-1-2-3: 123, wk1: Lotus 1-2-3 Document - OO() - -application/vnd.sun.xml.draw:sxd:OpenOffice Draw 6.0 documents -application/so7_vnd.sun.xml.draw:sxc:StarOffice Draw 7.0 documents -application/vnd.sun.xml.draw.template:std:OpenOffice Draw 6.0 templates -application/vnd.stardivision.draw:sda:StarDraw 5.x documents -application/x-stardraw:sda:StarDraw 4.x documents - OO() - -application/vnd.sun.xml.impress:sxi:OpenOffice Impress 6.0 presentations -application/so7_vnd.sun.xml.impress:sxi:StarOffice 7.0 Impress presentations -application/vnd.sun.xml.impress.template:sti:OpenOffice Impress 6.0 templates -application/vnd.stardivision.impress:sdd:StarImpress 5.x presentations -application/vnd.stardivision.impress-packed:sdp:StarImpress Packed 5.x files -application/x-starimpress:sdd:StarImpress 4.x presentations -application/vnd.ms-powerpoint:ppt:PowerPoint Slideshow -application/mspowerpoint:ppt,ppz,pps,pot:PowerPoint Slideshow - OO() - -application/vnd.sun.xml.math:sxm:OpenOffice Math 6.0 documents -application/so7_vnd.sun.xml.math:sxm:StarOffice 7.0 Math documents -application/vnd.stardivision.math:smf:StarMath 5.x documents -application/x-starmath:smf:StarMath 4.x documents - OO() - -application/vnd.oasis.opendocument.text:odt,ODT:OASIS OpenDocument Text - OO() - -application/vnd.oasis.opendocument.spreadsheet:ods,ODS:OASIS OpenDocument SpreadSheet - OO() - -application/vnd.oasis.opendocument.presentation:odp,ODP:OASIS OpenDocument Presentation - OO() - -chemical/x-pdb:pdb: Protein Data Bank file -model/x-pdb:pdb: Protein Data Bank file - swallow(rasmol) fill: rasmol "$file" - swallow(molecule) fill: /usr/X11R6/lib/xscreensaver/molecule -delay 20000 -geometry +9000+9000 -no-spin -molecule "$file" - -mozplugger/xterm:xterm: xterm - stream swallow(xterm) fill: xterm -title xterm $VAR_arg -- cgit v1.2.3