Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879.

(Portage version: 2.1.10.39/cvs/Linux i686)

3 files changed, 73 insertions, 1 deletions

diff --git a/media-libs/jasper/ChangeLog b/media-libs/jasper/ChangeLog
index 0c85ead0dade..67da394efd20 100644
--- a/media-libs/jasper/ChangeLog
+++ b/media-libs/jasper/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-libs/jasper
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.59 2011/04/04 19:11:12 scarabeus Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/ChangeLog,v 1.60 2011/12/17 20:51:25 phosphan Exp $
+
+*jasper-1.900.1-r4 (17 Dec 2011)
+
+  17 Dec 2011; Patrick Kursawe <phosphan@gentoo.org> +jasper-1.900.1-r4.ebuild,
+  +files/CVE-2011-4516+7.patch:
+  Security fixes from Fedora, CVE-2011-4516 CVE-2011-4517, see bug #394879.
 
   04 Apr 2011; Tomáš Chvátal <scarabeus@gentoo.org>
   jasper-1.900.1-r3.ebuild:
diff --git a/media-libs/jasper/files/CVE-2011-4516+7.patch b/media-libs/jasper/files/CVE-2011-4516+7.patch
new file mode 100644
index 000000000000..1f1c7bb35f63
--- /dev/null
+++ b/media-libs/jasper/files/CVE-2011-4516+7.patch
@@ -0,0 +1,24 @@
+diff -up jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409 jasper-1.900.1/src/libjasper/jpc/jpc_cs.c
+--- jasper-1.900.1/src/libjasper/jpc/jpc_cs.c.CERT-VU-887409	2011-10-25 17:25:39.000000000 +0200
++++ jasper-1.900.1/src/libjasper/jpc/jpc_cs.c	2011-10-25 17:29:14.379371908 +0200
+@@ -744,6 +744,10 @@ static int jpc_cox_getcompparms(jpc_ms_t
+ 		return -1;
+ 	}
+ 	compparms->numrlvls = compparms->numdlvls + 1;
++	if (compparms->numrlvls > JPC_MAXRLVLS) {
++		jpc_cox_destroycompparms(compparms);
++		return -1;
++	}
+ 	if (prtflag) {
+ 		for (i = 0; i < compparms->numrlvls; ++i) {
+ 			if (jpc_getuint8(in, &tmp)) {
+@@ -1331,7 +1335,7 @@ static int jpc_crg_getparms(jpc_ms_t *ms
+ 	jpc_crgcomp_t *comp;
+ 	uint_fast16_t compno;
+ 	crg->numcomps = cstate->numcomps;
+-	if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(uint_fast16_t)))) {
++	if (!(crg->comps = jas_alloc2(cstate->numcomps, sizeof(jpc_crgcomp_t)))) {
+ 		return -1;
+ 	}
+ 	for (compno = 0, comp = crg->comps; compno < cstate->numcomps;
+
diff --git a/media-libs/jasper/jasper-1.900.1-r4.ebuild b/media-libs/jasper/jasper-1.900.1-r4.ebuild
new file mode 100644
index 000000000000..f5792a4cfc7e
--- /dev/null
+++ b/media-libs/jasper/jasper-1.900.1-r4.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/jasper/jasper-1.900.1-r4.ebuild,v 1.1 2011/12/17 20:51:25 phosphan Exp $
+
+EAPI=3
+
+inherit libtool eutils
+
+DESCRIPTION="software-based implementation of the codec specified in the JPEG-2000 Part-1 standard"
+HOMEPAGE="http://www.ece.uvic.ca/~mdadams/jasper/"
+SRC_URI="http://www.ece.uvic.ca/~mdadams/jasper/software/jasper-${PV}.zip
+	mirror://gentoo/${P}-fixes-20081208.patch.bz2"
+
+LICENSE="JasPer2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x64-solaris ~x86-solaris"
+IUSE="jpeg opengl static-libs"
+
+RDEPEND="jpeg? ( virtual/jpeg )
+	opengl? ( virtual/opengl media-libs/freeglut )"
+DEPEND="${RDEPEND}
+	app-arch/unzip"
+
+src_prepare() {
+	epatch "${WORKDIR}"/${P}-fixes-20081208.patch
+	epatch "${FILESDIR}"/CVE-2011-4516+7.patch
+	elibtoolize
+}
+
+src_configure() {
+	econf \
+		$(use_enable jpeg libjpeg) \
+		$(use_enable opengl) \
+		$(use_enable static-libs static) \
+		--enable-shared
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die
+	dodoc NEWS README doc/*
+	find "${ED}" -name '*.la' -delete
+}