fix for bug #169675

Package-Manager: portage-2.1.2.1

5 files changed, 160 insertions, 5 deletions

diff --git a/app-text/libwpd/ChangeLog b/app-text/libwpd/ChangeLog
index 077c027275fb..73d15feb63e8 100644
--- a/app-text/libwpd/ChangeLog
+++ b/app-text/libwpd/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-text/libwpd
 # Copyright 2000-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/libwpd/ChangeLog,v 1.39 2007/02/21 23:33:16 peper Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/libwpd/ChangeLog,v 1.40 2007/03/07 17:26:44 dang Exp $
+
+*libwpd-0.8.4-r1 (07 Mar 2007)
+
+  07 Mar 2007; Daniel Gryniewicz <dang@gentoo.org>
+  +files/libwpd-0.8.4-heap-overflow.patch, +libwpd-0.8.4-r1.ebuild:
+  fix for bug #169675
 
   21 Feb 2007; Piotr Jaroszyński <peper@gentoo.org> ChangeLog:
   Transition to Manifest2.
diff --git a/app-text/libwpd/Manifest b/app-text/libwpd/Manifest
index d7dccb05dee1..1b6b5139b005 100644
--- a/app-text/libwpd/Manifest
+++ b/app-text/libwpd/Manifest
@@ -1,7 +1,14 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX libwpd-0.8.2-gcc41.patch 3887 RMD160 7024b53c33821caf55fa23310f62b8c1672bde21 SHA1 32a94f79cbd9fa3a4c9cbe59c25592810a839b8d SHA256 176eecf0040b087791b96296c7ef5a4de7ee71d58db860f56aed6bb3aca5a96f
 MD5 eb778c0afcfb084ac7033c4587e3218f files/libwpd-0.8.2-gcc41.patch 3887
 RMD160 7024b53c33821caf55fa23310f62b8c1672bde21 files/libwpd-0.8.2-gcc41.patch 3887
 SHA256 176eecf0040b087791b96296c7ef5a4de7ee71d58db860f56aed6bb3aca5a96f files/libwpd-0.8.2-gcc41.patch 3887
+AUX libwpd-0.8.4-heap-overflow.patch 3494 RMD160 cd7055365e15c80a7f71ebc4b4374605dad7800d SHA1 51ad68ce3aec7f9aebf126a7304273fcbbc6c398 SHA256 a34df34880288e6eda18d87a674bb5de88319ee4345fe58857c05678632d089b
+MD5 29e54fa5fde919b8b3814fd2d53b1355 files/libwpd-0.8.4-heap-overflow.patch 3494
+RMD160 cd7055365e15c80a7f71ebc4b4374605dad7800d files/libwpd-0.8.4-heap-overflow.patch 3494
+SHA256 a34df34880288e6eda18d87a674bb5de88319ee4345fe58857c05678632d089b files/libwpd-0.8.4-heap-overflow.patch 3494
 DIST libwpd-0.7.1.tar.gz 399768 RMD160 b7a869ecc0549855d62717c6df6dead72b58a398 SHA1 ea7178aa26c9934a448c5673651b290cf9cd76b2 SHA256 b09c2f9e11c203201215671a563eef34651ca3d4ab177ea571d39349e76cddb9
 DIST libwpd-0.7.2.tar.gz 311872 RMD160 653eb61f7133a36a51fa7205dee964605ce60cca SHA1 93d046ea7f8fb23730c5f880c1577586b6b0964e SHA256 87b94129f5e03aec82bb74fdf6f41effc370adfc339d407c87ee8f7750c0022e
 DIST libwpd-0.8.2.tar.gz 486490 RMD160 b652d1c79a5436df3154d90221b2544d55381a3a SHA1 8eb400f4e26db6333fb418051ae0cc98fe648797 SHA256 9ca228f9ea98d64cc17d9de4605ce6e26d64087042b6ea78a80fe473e367167e
@@ -18,14 +25,18 @@ EBUILD libwpd-0.8.2.ebuild 830 RMD160 075089de7dc901ffddb799410f93fa8a6532a1d0 S
 MD5 9ee3fc88b98ae463d4c9b3777ec22e66 libwpd-0.8.2.ebuild 830
 RMD160 075089de7dc901ffddb799410f93fa8a6532a1d0 libwpd-0.8.2.ebuild 830
 SHA256 38b9600bf2362458db6a9ccf88a50b12a198d7bec1af36f6ab885dc4e2a546cc libwpd-0.8.2.ebuild 830
+EBUILD libwpd-0.8.4-r1.ebuild 882 RMD160 3e8c30630fee7d62f67cb73fcab554fbb7a7668f SHA1 e3aae1a43404337ed231bbf993df1f0699d5cb85 SHA256 2ac1e7effc8df6c77f15727ce90c698ac91586e0d6a417b6b6549bfd7d888b3b
+MD5 0cfcf886b2816011d8018d1361da3445 libwpd-0.8.4-r1.ebuild 882
+RMD160 3e8c30630fee7d62f67cb73fcab554fbb7a7668f libwpd-0.8.4-r1.ebuild 882
+SHA256 2ac1e7effc8df6c77f15727ce90c698ac91586e0d6a417b6b6549bfd7d888b3b libwpd-0.8.4-r1.ebuild 882
 EBUILD libwpd-0.8.4.ebuild 764 RMD160 947b6021fa60f0db497aa5e6be7fa2874fe189e1 SHA1 9f805613c34656765f63415144454c587698b848 SHA256 951a05fd720d515cc5594db90b3e779b6e74f9d9a4a9dcc44fb48bf895b359f0
 MD5 799b62c768622b5a3f9a3a623eeb36e6 libwpd-0.8.4.ebuild 764
 RMD160 947b6021fa60f0db497aa5e6be7fa2874fe189e1 libwpd-0.8.4.ebuild 764
 SHA256 951a05fd720d515cc5594db90b3e779b6e74f9d9a4a9dcc44fb48bf895b359f0 libwpd-0.8.4.ebuild 764
-MISC ChangeLog 4242 RMD160 2bb39b90b58343b0c8245e9073591d13e8c8ee6c SHA1 3d16a93ff527600477eafe4d59545f0d567c3c3c SHA256 be6c3aaf5dd101afcef01fa967ff9370b1afceb54842a68ecd74ccae179496e3
-MD5 75d3b545b311a8a180d82083a48d1a85 ChangeLog 4242
-RMD160 2bb39b90b58343b0c8245e9073591d13e8c8ee6c ChangeLog 4242
-SHA256 be6c3aaf5dd101afcef01fa967ff9370b1afceb54842a68ecd74ccae179496e3 ChangeLog 4242
+MISC ChangeLog 4415 RMD160 afdca179f06e2643290387e4169c8f25b2940cb3 SHA1 e520b530dc5b041089322f073221e6025cd1e4e7 SHA256 ddbec506ed57ccbe981a1028608cc1698ebac533c546c61efc56fc0a64a135e3
+MD5 768843b46f6db74d3467665ea51fd0d7 ChangeLog 4415
+RMD160 afdca179f06e2643290387e4169c8f25b2940cb3 ChangeLog 4415
+SHA256 ddbec506ed57ccbe981a1028608cc1698ebac533c546c61efc56fc0a64a135e3 ChangeLog 4415
 MISC metadata.xml 158 RMD160 c0e2bae8e91bb6be8922bac5e4f597302e06587e SHA1 38f78e9790bcd4382b4a49aa226aa6dda1d3a3d7 SHA256 3a7dbca0fdc557de69783e0663e2d76ddab129ea8a19b2d0ef6d3e5d1b947ce1
 MD5 03ad2e6c4ab41244af1015a8bbb0b39f metadata.xml 158
 RMD160 c0e2bae8e91bb6be8922bac5e4f597302e06587e metadata.xml 158
@@ -42,3 +53,13 @@ SHA256 2fd543c5797a71ffb70ab38846ca4db9932804eaddb76296c81e6265bfcd4311 files/di
 MD5 8529b5b5d576f70afdb2099ea8b7f65e files/digest-libwpd-0.8.4 238
 RMD160 757f038c0c33b0b2492092f9a7bf50955227d27b files/digest-libwpd-0.8.4 238
 SHA256 cbd1b5edc3203e0623b6601ba013d4504bfaa206a8cc585d2e64bd44c4aeb66a files/digest-libwpd-0.8.4 238
+MD5 8529b5b5d576f70afdb2099ea8b7f65e files/digest-libwpd-0.8.4-r1 238
+RMD160 757f038c0c33b0b2492092f9a7bf50955227d27b files/digest-libwpd-0.8.4-r1 238
+SHA256 cbd1b5edc3203e0623b6601ba013d4504bfaa206a8cc585d2e64bd44c4aeb66a files/digest-libwpd-0.8.4-r1 238
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.2 (GNU/Linux)
+
+iD8DBQFF7vWxomPajV0RnrERAn/YAJ9F21p9b8myGgnuhRIddxS14LTTmgCeKMCw
+05IeKiqUWA10T5betqBhsF8=
+=roLS
+-----END PGP SIGNATURE-----
diff --git a/app-text/libwpd/files/digest-libwpd-0.8.4-r1 b/app-text/libwpd/files/digest-libwpd-0.8.4-r1
new file mode 100644
index 000000000000..990dbdb70111
--- /dev/null
+++ b/app-text/libwpd/files/digest-libwpd-0.8.4-r1
@@ -0,0 +1,3 @@
+MD5 0461d4bf2da534b4bed041b67d7f7064 libwpd-0.8.4.tar.gz 491831
+RMD160 ce5826683e37e1b3f1220f8d5c6c40b48610f054 libwpd-0.8.4.tar.gz 491831
+SHA256 b6393088bf6c49b72a07d2aec7d84d14f6cab0ab00ad177c17157f03095f2096 libwpd-0.8.4.tar.gz 491831
diff --git a/app-text/libwpd/files/libwpd-0.8.4-heap-overflow.patch b/app-text/libwpd/files/libwpd-0.8.4-heap-overflow.patch
new file mode 100644
index 000000000000..4bd689a30c78
--- /dev/null
+++ b/app-text/libwpd/files/libwpd-0.8.4-heap-overflow.patch
@@ -0,0 +1,87 @@
+diff --exclude-from=/home/dang/bin/scripts/diffrc -up -ruN libwpd-0.8.4.orig/src/lib/WP5DefinitionGroup.cpp libwpd-0.8.4/src/lib/WP5DefinitionGroup.cpp
+--- libwpd-0.8.4.orig/src/lib/WP5DefinitionGroup.cpp	2005-12-05 08:51:35.000000000 -0500
++++ libwpd-0.8.4/src/lib/WP5DefinitionGroup.cpp	2007-03-07 11:59:45.000000000 -0500
+@@ -26,7 +26,7 @@
+ #include "WPXListener.h"
+ #include "libwpd_internal.h"
+ 
+-WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input) :
++WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize) :
+ 	WP5VariableLengthGroup_SubGroup(),
+ 	m_position(0),
+ 	m_numColumns(0),
+@@ -34,6 +34,7 @@ WP5DefinitionGroup_DefineTablesSubGroup:
+ 	m_leftGutter(0),
+ 	m_rightGutter(0)
+ {
++	long startPosition = input->tell();
+ 	// Skip useless old values to read the old column number
+ 	input->seek(2, WPX_SEEK_CUR);
+ 	m_numColumns = readU16(input);
+@@ -50,12 +51,26 @@ WP5DefinitionGroup_DefineTablesSubGroup:
+ 	input->seek(10, WPX_SEEK_CUR);
+ 	m_leftOffset = readU16(input);
+ 	int i;
++	if ((m_numColumns > 32) || ((input->tell() - startPosition + m_numColumns*5) > (subGroupSize - 4)))
++		throw FileException();
+ 	for (i=0; i < m_numColumns; i++)
++	{
++		if (input->atEOS())
++			throw FileException();
+ 		m_columnWidth[i] = readU16(input);
++	}
+ 	for (i=0; i < m_numColumns; i++)
++	{
++		if (input->atEOS())
++			throw FileException();
+ 		m_attributeBits[i] = readU16(input);
++	}
+ 	for (i=0; i < m_numColumns; i++)
++	{
++		if (input->atEOS())
++			throw FileException();
+ 		m_columnAlignment[i] = readU8(input);
++	}
+ }
+ 
+ void WP5DefinitionGroup_DefineTablesSubGroup::parse(WP5Listener *listener)
+@@ -86,7 +101,7 @@ void WP5DefinitionGroup::_readContents(W
+ 	switch(getSubGroup())
+ 	{
+ 		case WP5_TOP_DEFINITION_GROUP_DEFINE_TABLES:
+-			m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input);
++			m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input, getSize());
+ 			break;
+ 		default:
+ 			break;
+diff --exclude-from=/home/dang/bin/scripts/diffrc -up -ruN libwpd-0.8.4.orig/src/lib/WP5DefinitionGroup.h libwpd-0.8.4/src/lib/WP5DefinitionGroup.h
+--- libwpd-0.8.4.orig/src/lib/WP5DefinitionGroup.h	2005-12-05 08:51:35.000000000 -0500
++++ libwpd-0.8.4/src/lib/WP5DefinitionGroup.h	2007-03-07 12:02:13.000000000 -0500
+@@ -31,7 +31,7 @@
+ class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup
+ {
+ public:
+-	WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input);
++	WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize);
+ 	virtual void parse(WP5Listener *listener);
+ 
+ private:
+@@ -58,7 +58,6 @@ protected:
+ 
+ private:
+ 	WP5VariableLengthGroup_SubGroup * m_subGroupData;
+-
+ };
+ 
+ #endif /* WP5DEFINITIONGROUP_H */
+diff --exclude-from=/home/dang/bin/scripts/diffrc -up -ruN libwpd-0.8.4.orig/src/lib/WP5VariableLengthGroup.h libwpd-0.8.4/src/lib/WP5VariableLengthGroup.h
+--- libwpd-0.8.4.orig/src/lib/WP5VariableLengthGroup.h	2005-12-05 08:51:37.000000000 -0500
++++ libwpd-0.8.4/src/lib/WP5VariableLengthGroup.h	2007-03-07 12:19:51.000000000 -0500
+@@ -48,6 +48,7 @@ class WP5VariableLengthGroup : public WP
+  	virtual void _readContents(WPXInputStream *input) {} // we don't always need more information than that provided generically
+ 
+ 	const uint8_t getSubGroup() const { return m_subGroup; }
++	const uint16_t getSize() const { return m_size; }
+ 
+  private:
+ 	uint8_t m_subGroup;
diff --git a/app-text/libwpd/libwpd-0.8.4-r1.ebuild b/app-text/libwpd/libwpd-0.8.4-r1.ebuild
new file mode 100644
index 000000000000..dfcb9475ae4b
--- /dev/null
+++ b/app-text/libwpd/libwpd-0.8.4-r1.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/libwpd/libwpd-0.8.4-r1.ebuild,v 1.1 2007/03/07 17:26:44 dang Exp $
+
+inherit eutils
+
+DESCRIPTION="WordPerfect Document import/export library"
+HOMEPAGE="http://libwpd.sf.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc-macos ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="doc"
+
+RDEPEND=">=dev-libs/glib-2
+	>=gnome-extra/libgsf-1.6
+	doc? ( app-doc/doxygen )"
+
+DEPEND="${RDEPEND}
+	dev-util/pkgconfig"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	# Fix for bug #169675
+	epatch "${FILESDIR}"/${P}-heap-overflow.patch
+}
+
+src_compile() {
+	econf $(use_with doc docs) || die
+	emake || die
+}
+
+src_install() {
+	einstall || die
+	dodoc CHANGES COPYING CREDITS INSTALL README TODO
+}