Added patch for insecure tempfile handling (CVE-2008-4983) (see bug #245922).

(Portage version: 2.2_rc13/cvs/Linux 2.6.27-SENTINEL-2 i686)

4 files changed, 144 insertions, 142 deletions

diff --git a/sci-mathematics/scilab/ChangeLog b/sci-mathematics/scilab/ChangeLog
index 5257f5a399c1..2b1023a46619 100644
--- a/sci-mathematics/scilab/ChangeLog
+++ b/sci-mathematics/scilab/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for sci-mathematics/scilab
 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sci-mathematics/scilab/ChangeLog,v 1.43 2008/02/08 23:59:46 markusle Exp $
+# $Header: /var/cvsroot/gentoo-x86/sci-mathematics/scilab/ChangeLog,v 1.44 2008/11/07 15:17:39 markusle Exp $
+
+*scilab-4.1.2-r1 (07 Nov 2008)
+
+  07 Nov 2008; Markus Dittrich <markusle@gentoo.org>
+  +files/scilab-4.1.2-tmp-fix.patch, -scilab-4.1.1.ebuild,
+  -scilab-4.1.2.ebuild, +scilab-4.1.2-r1.ebuild:
+  Added patch for insecure tempfile handling (CVE-2008-4983) (see bug
+  #245922).
 
   08 Feb 2008; Markus Dittrich <markusle@gentoo.org>
   +files/scilab-4.1.2-java-config.patch, scilab-4.1.2.ebuild:
diff --git a/sci-mathematics/scilab/files/scilab-4.1.2-tmp-fix.patch b/sci-mathematics/scilab/files/scilab-4.1.2-tmp-fix.patch
new file mode 100644
index 000000000000..f945fe12994c
--- /dev/null
+++ b/sci-mathematics/scilab/files/scilab-4.1.2-tmp-fix.patch
@@ -0,0 +1,133 @@
+diff -Naur scilab-4.1.2/bin/scilink scilab-4.1.2.new/bin/scilink
+--- scilab-4.1.2/bin/scilink	2001-04-26 03:43:33.000000000 -0400
++++ scilab-4.1.2.new/bin/scilink	2008-11-07 08:57:27.000000000 -0500
+@@ -15,30 +15,31 @@
+ shift
+ LOCALPOS=`pwd`
+ cd $SCI
+-make show | grep -v make > /tmp/SciLink$$1
+-sed -e "s+routines/default+\$SD+g"  -e "s+libs+\$SL+g" -e "s+./pvm3+\$SPVM+g" /tmp/SciLink$$1 > /tmp/SciLink$$2
++TMPWRKDIR=`mktemp -d sci.XXXXXXXXXX`
++make show | grep -v make > $TMPWRKDIR/SciLink$$1
++sed -e "s+routines/default+\$SD+g"  -e "s+libs+\$SL+g" -e "s+./pvm3+\$SPVM+g" $TMPWRKDIR/SciLink$$1 > $TMPWRKDIR/SciLink$$2
+ for i in $*
+ do
+   x=`basename $i`
+-  sed "s+\$SD/$x++g" /tmp/SciLink$$2 > /tmp/SciLink$$3
+-  rm -f /tmp/SciLink$$2
+-  mv /tmp/SciLink$$3 /tmp/SciLink$$2
++  sed "s+\$SD/$x++g" $TMPWRKDIR/SciLink$$2 > $TMPWRKDIR/SciLink$$3
++  rm -f $TMPWRKDIR/SciLink$$2
++  mv $TMPWRKDIR/SciLink$$3 $TMPWRKDIR/SciLink$$2
+ done
+-echo "#!/bin/sh" > /tmp/SciLink$$3
+-echo  SCI=$SCI >>  /tmp/SciLink$$3
+-echo "SD=\$SCI/routines/default" >>  /tmp/SciLink$$3
+-echo "SPVM=\$SCI/pvm3" >>  /tmp/SciLink$$3
+-echo "SL=\$SCI/libs" >>  /tmp/SciLink$$3
+-echo "LOCAL=\"$*\"" >>  /tmp/SciLink$$3
+-sed -e "s+\$SL+ \$LOCAL \$SL+" -e "s+show+scilex+g" /tmp/SciLink$$2 >> /tmp/SciLink$$3
++echo "#!/bin/sh" > $TMPWRKDIR/SciLink$$3
++echo  SCI=$SCI >>  $TMPWRKDIR/SciLink$$3
++echo "SD=\$SCI/routines/default" >>  $TMPWRKDIR/SciLink$$3
++echo "SPVM=\$SCI/pvm3" >>  $TMPWRKDIR/SciLink$$3
++echo "SL=\$SCI/libs" >>  $TMPWRKDIR/SciLink$$3
++echo "LOCAL=\"$*\"" >>  $TMPWRKDIR/SciLink$$3
++sed -e "s+\$SL+ \$LOCAL \$SL+" -e "s+show+scilex+g" $TMPWRKDIR/SciLink$$2 >> $TMPWRKDIR/SciLink$$3
+ cd $LOCALPOS
+-mv /tmp/SciLink$$3 Script
++mv $TMPWRKDIR/SciLink$$3 Script
+ chmod +x Script 
+ echo "Linking a new Scilab with " $*
+ ./Script 
+ echo "I've created : scilex and scilab which uses that scilex"
+ sed -e "s+\$SCI/bin/scilex+`pwd`/scilex+g" $SCI/bin/scilab > scilab 
+ chmod +x scilab 
+-#rm -f /tmp/SciLink*
++#rm -f $TMPWRKDIR/SciLink*
+ 
+ 
+diff -Naur scilab-4.1.2/util/scidem scilab-4.1.2.new/util/scidem
+--- scilab-4.1.2/util/scidem	2002-09-02 07:14:52.000000000 -0400
++++ scilab-4.1.2.new/util/scidem	2008-11-07 08:57:27.000000000 -0500
+@@ -6,33 +6,34 @@
+ echo ------------------- File $2--------------------
+ SCI1=$1
+ if [ -f $3  ]; then rm $3;fi;
+-trap "rm -f /tmp/$2.$$ /tmp/$2.$$.res /tmp/$2.$$.err /tmp/$2.$$.diff\
++TMPWRKDIR=`mktemp -d sci.XXXXXXXXXX`
++trap "rm -f $TMPWRKDIR/$2.$$ $TMPWRKDIR/$2.$$.res $TMPWRKDIR/$2.$$.err $TMPWRKDIR/$2.$$.diff\
+         ;exit 1"  1 2 13 15
+ echo "clear;lines(0);deff('[]=bugmes()','write(%io(2),''error on test'')');\
+-        diary('$3');driver('Pos');" >> /tmp/$2.$$ ;
++        diary('$3');driver('Pos');" >> $TMPWRKDIR/$2.$$ ;
+ sed     -e "s/pause,end/bugmes();quit;end/" \
+         -e "s/halt()//" \
+-        $2 >> /tmp/$2.$$ ;
+-echo "diary(0);xend();exit;" >> /tmp/$2.$$ ;
+-($SCI1/bin/scilab -nwni < /tmp/$2.$$ > /tmp/$2.$$.res ) 2> /tmp/$2.$$.err ;
++        $2 >> $TMPWRKDIR/$2.$$ ;
++echo "diary(0);xend();exit;" >> $TMPWRKDIR/$2.$$ ;
++($SCI1/bin/scilab -nwni < $TMPWRKDIR/$2.$$ > $TMPWRKDIR/$2.$$.res ) 2> $TMPWRKDIR/$2.$$.err ;
+ sed -e "s/ \./0\./g" -e "s/E+/D+/g" -e "s/E-/D-/g" -e "s/-\./-0\./g" -e "s/^-->//g" -e "s/^-1->//g" $3 > $3.n
+ grep -v "xinit(" $3.n | grep -v "diary(" | grep -v "exec("  > $3
+ rm -f $3.n
+-if ( grep " error" /tmp/$2.$$.res >  /dev/null ) ; then 
++if ( grep " error" $TMPWRKDIR/$2.$$.res >  /dev/null ) ; then 
+         if [ $# != 4 ]; then 
+                 echo "Test failed ERROR DETECTED  while executing $2" ;
+-        else if (grep "$4" /tmp/$2.$$.res >  /dev/null ) ; 
++        else if (grep "$4" $TMPWRKDIR/$2.$$.res >  /dev/null ) ; 
+              then  echo Test skipped ;
+              else echo "Test failed ERROR DETECTED  while executing $2" ;
+              fi;
+         fi;
+ else if [ -f $3.ref ];then 
+-        if ( diff -w $3 $3.ref > /tmp/$2.$$.diff ) ;
++        if ( diff -w $3 $3.ref > $TMPWRKDIR/$2.$$.diff ) ;
+         then  echo Test passed ;
+         else  echo Test Failed SEE : diff -w  $3 $3.ref ;
+         fi;
+       fi;
+ fi;
+ echo ---------------------------------------------------------- 
+-#rm -f /tmp/$2.$$ /tmp/$2.$$.res /tmp/$2.$$.err /tmp/$2.$$.diff
++#rm -f $TMPWRKDIR/$2.$$ $TMPWRKDIR/$2.$$.res $TMPWRKDIR/$2.$$.err $TMPWRKDIR/$2.$$.diff
+ exit 0
+diff -Naur scilab-4.1.2/util/scidoc scilab-4.1.2.new/util/scidoc
+--- scilab-4.1.2/util/scidoc	2006-01-04 09:40:34.000000000 -0500
++++ scilab-4.1.2.new/util/scidoc	2008-11-07 08:57:27.000000000 -0500
+@@ -7,24 +7,26 @@
+ SCI=$1
+ export SCI
+ if [ -f $3  ]; then rm $3;fi;
+-trap "rm -f /tmp/$2.$$ /tmp/$2.$$.res /tmp/$2.$$.err /tmp/$2.$$.diff\
++TMPWRKDIR=`mktemp -d sci.XXXXXXXXXX`
++trap "rm -f $TMPWRKDIR/$2.$$ $TMPWRKDIR/$2.$$.res $TMPWRKDIR/$2.$$.err $TMPWRKDIR/$2.$$.diff\
+ 	;exit 1"  1 2 13 15
+ echo "clear;lines(0);deff('[]=bugmes()','write(%io(2),''error on test'')');\
+-	diary('$3');driver('Pos');" >> /tmp/$2.$$ ;
++	diary('$3');driver('Pos');" >> $TMPWRKDIR/$2.$$ ;
+ sed     -e "s/pause,end/bugmes();quit;end/" \
+ 	-e "s/halt()//" \
+-        $2 >> /tmp/$2.$$ ;
+-echo "diary(0);xend();quit;quit;quit;quit;quit;quit;" >> /tmp/$2.$$ ;
+-($SCI/bin/scilex -nw < /tmp/$2.$$ > /tmp/$2.$$.res ) 2> /tmp/$2.$$.err ;
++        $2 >> $TMPWRKDIR/$2.$$ ;
++echo "diary(0);xend();quit;quit;quit;quit;quit;quit;" >> $TMPWRKDIR/$2.$$ ;
++($SCI/bin/scilex -nw < $TMPWRKDIR/$2.$$ > $TMPWRKDIR/$2.$$.res ) 2> $TMPWRKDIR/$2.$$.err ;
+ sed -e "s/ \.[0-9]/0&/g" -e "s/0 \./0./g" -e "s/E+/D+/g" -e "s/E-/D-/g" -e "s/-\./-0\./g" $3 > $3.n
+ grep -v "xinit(" $3.n | grep -v "diary(" | grep -v "exec("  > $3
+ rm -f $3.n
+-if ( grep error /tmp/$2.$$.res >  /dev/null ) ; then 
++if ( grep error $TMPWRKDIR/$2.$$.res >  /dev/null ) ; then 
+ 	if [ $# != 4 ]; then 
+ 		echo "ERROR DETECTED  while executing $2" ;
+ 	fi;
+ fi;
+ echo ---------------------------------------------------------- 
+-rm -f /tmp/$2.$$ /tmp/$2.$$.res /tmp/$2.$$.err /tmp/$2.$$.diff
++rm -f $TMPWRKDIR/$2.$$ $TMPWRKDIR/$2.$$.res $TMPWRKDIR/$2.$$.err $TMPWRKDIR/$2.$$.diff 
++rmdir $TMPWRKDIR
+ exit 0
+ 
diff --git a/sci-mathematics/scilab/scilab-4.1.1.ebuild b/sci-mathematics/scilab/scilab-4.1.1.ebuild
deleted file mode 100644
index 6a0b58cd54f6..000000000000
--- a/sci-mathematics/scilab/scilab-4.1.1.ebuild
+++ /dev/null
@@ -1,140 +0,0 @@
-# Copyright 1999-2008 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sci-mathematics/scilab/scilab-4.1.1.ebuild,v 1.6 2008/01/09 03:04:10 markusle Exp $
-
-inherit eutils fortran toolchain-funcs multilib autotools java-pkg-opt-2
-
-DESCRIPTION="Scientific software package for numerical computations (Matlab lookalike)"
-LICENSE="scilab"
-SRC_URI="http://www.scilab.org/download/${PV}/${P}-src.tar.gz"
-HOMEPAGE="http://www.scilab.org/"
-
-SLOT="0"
-IUSE="ocaml gtk Xaw3d java"
-KEYWORDS="~amd64 ~ppc ~x86"
-
-RDEPEND="virtual/blas
-	virtual/lapack
-	virtual/cblas
-	sys-libs/ncurses
-	gtk? (
-		media-libs/jpeg
-		media-libs/libpng
-		sys-libs/zlib
-		>=x11-libs/gtk+-2
-		x11-libs/vte
-		=gnome-extra/gtkhtml-2*
-	)
-	>=dev-lang/tk-8.4
-	>=dev-lang/tcl-8.4
-	Xaw3d? ( x11-libs/Xaw3d )
-	ocaml? ( dev-lang/ocaml )
-	java? ( >=virtual/jdk-1.4 )"
-
-DEPEND="${RDEPEND}
-	app-text/sablotron"
-
-pkg_setup() {
-	java-pkg-opt-2_pkg_setup
-	need_fortran gfortran g77
-}
-
-src_unpack() {
-	unpack ${A}
-	cd "${S}"
-
-	epatch "${FILESDIR}"/${PN}-4.0-makefile.patch
-	epatch "${FILESDIR}"/${PN}-4.1-java-pic.patch
-	epatch "${FILESDIR}"/${PN}-4.1-header-fix.patch
-	epatch "${FILESDIR}"/${PN}-4.1-examples.patch
-
-	sed -e '/^ATLAS_LAPACKBLAS\>/s,=.*,= $(ATLASDIR)/liblapack.so $(ATLASDIR)/libblas.so $(ATLASDIR)/libcblas.so,' \
-		-e 's,$(SCIDIR)/libs/lapack.a,,' \
-		-i Makefile.OBJ.in || die "Failed to fix Makefile.OBJ.in"
-
-	sed -e "s:\$(PREFIX):\${D}\$(PREFIX):g" \
-		-e "s:\$(PREFIX)/lib:\$(PREFIX)/$(get_libdir):g" \
-		-i Makefile.in || die "Failed to fix Makefile.in"
-
-	sed -e "s:@CC_OPTIONS@:${CFLAGS}:" \
-		-e "s:@FC_OPTIONS@:${FFLAGS}:" \
-		-e "s:@LD_LDFLAGS@:${LDFLAGS} -lpthread:" \
-		-i Makefile.incl.in || die "Failed to fix Makefile.incl.in"
-
-	# fix bad C practices by failure of scilab build system to
-	# include proper headers
-	sed -e "s:-DNOTMPNAM:-DNOTMPNAM -DSYSVSTR -DHASSTDLIB:" \
-		-i pvm3/conf/LINUX.def -i pvm3/conf/LINUX64.def || \
-		die "Failed to fix pvm3 conf scripts."
-
-	# fix examples
-	local MAKE_TO_FIX="callsci inter* link* m* interface-multi-so/lib interface-general/lib"
-	cd examples/
-	for name in ${MAKE_TO_FIX}; do
-		sed -e "s:gentoo-scidir:/usr/$(get_libdir)/${P}:" \
-			-i ${name}/Makefile || die "Failed to fix examples"
-	done
-}
-
-src_compile() {
-	local myopts
-	myopts="${myopts} --with-atlas-library=/usr/$(get_libdir)"
-
-	# the tk interface is the default
-	myopts="${myopts} --with-tk"
-
-	if [[ ${FORTRANC} == gfortran ]]; then
-		myopts="${myopts} --with-gfortran"
-	fi
-
-	econf $(use_with Xaw3d xaw3d) \
-		$(use_with gtk gtk2 ) \
-		$(use_with ocaml) \
-		$(use_with java ) \
-		${myopts} || die "econf failed"
-	env HOME="${S}" emake -j1 all || die "emake failed"
-}
-
-src_install() {
-	DESTDIR="${D}" make install || die "installation failed"
-
-	# some postinstall fixes
-	echo "SCIDIR=/usr/$(get_libdir)/${P}" > \
-		"${D}/usr/$(get_libdir)/${P}/Path.incl"
-
-	# install docs
-	dodoc ACKNOWLEDGEMENTS CHANGES README_Unix RELEASE_NOTES \
-		Readme_Visual.txt || die "failed to install docs"
-
-	# install examples
-	insinto /usr/share/${PN}/
-	doins -r examples/ || die "failed to install examples"
-
-	insinto /usr/$(get_libdir)/${P}
-	doins Makefile.incl || die "failed to install Makefile.incl"
-
-	# The compile and install process causes the work folder
-	# to be registered as the runtime folder in many files.
-	# This is corrected here.
-	BAD_REF="${WORKDIR}/${P}"
-	FIXED_REF="/usr/$(get_libdir)/${P}"
-	local BIN_TO_FIX="Blpr BEpsf Blatexpr2 Blatexprs Blatexpr scilab"
-	for i in ${BIN_TO_FIX}; do
-		sed -e "s%${BAD_REF}%${FIXED_REF}%" -i \
-		"${D}"/usr/$(get_libdir)/${P}/bin/${i} || \
-		die "Failed to fix wrapper scripts"
-	done
-	local MISC_TO_FIX="util/Blatdoc util/Blatdocs"
-	for i in ${MISC_TO_FIX}; do
-		sed -e "s%${BAD_REF}%${FIXED_REF}%" -i \
-		"${D}"/usr/$(get_libdir)/${P}/${i} || \
-		die "Failed to fix Blatdocs"
-	done
-}
-
-pkg_postinst() {
-	einfo "To tell Scilab about your printers, set the environment"
-	einfo "variable PRINTERS in the form:"
-	einfo
-	einfo "PRINTERS=\"firstPrinter:secondPrinter:anotherPrinter\""
-}
diff --git a/sci-mathematics/scilab/scilab-4.1.2.ebuild b/sci-mathematics/scilab/scilab-4.1.2-r1.ebuild
index a0830cea3b83..07502a9dd590 100644
--- a/sci-mathematics/scilab/scilab-4.1.2.ebuild
+++ b/sci-mathematics/scilab/scilab-4.1.2-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sci-mathematics/scilab/scilab-4.1.2.ebuild,v 1.3 2008/02/08 23:59:46 markusle Exp $
+# $Header: /var/cvsroot/gentoo-x86/sci-mathematics/scilab/scilab-4.1.2-r1.ebuild,v 1.1 2008/11/07 15:17:39 markusle Exp $
 
 inherit eutils fortran toolchain-funcs multilib autotools java-pkg-opt-2
 
@@ -48,6 +48,7 @@ src_unpack() {
 	epatch "${FILESDIR}"/${P}-header-fix.patch
 	epatch "${FILESDIR}"/${PN}-4.1-examples.patch
 	epatch "${FILESDIR}"/${P}-java-config.patch
+	epatch "${FILESDIR}"/${P}-tmp-fix.patch
 	eautoconf
 
 	sed -e '/^ATLAS_LAPACKBLAS\>/s,=.*,= $(ATLASDIR)/liblapack.so $(ATLASDIR)/libblas.so $(ATLASDIR)/libcblas.so,' \