Version bump, also fix CVE-2009-0586 (bug #261594)

Package-Manager: portage-2.1.6.7/cvs/Linux i686

4 files changed, 163 insertions, 3 deletions

diff --git a/media-libs/gst-plugins-base/ChangeLog b/media-libs/gst-plugins-base/ChangeLog
index e6d4d3516e4a..e6c883786438 100644
--- a/media-libs/gst-plugins-base/ChangeLog
+++ b/media-libs/gst-plugins-base/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-libs/gst-plugins-base
-# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/gst-plugins-base/ChangeLog,v 1.90 2008/12/24 16:19:24 ssuominen Exp $
+# Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/gst-plugins-base/ChangeLog,v 1.91 2009/03/30 04:38:14 tester Exp $
+
+*gst-plugins-base-0.10.22 (30 Mar 2009)
+
+  30 Mar 2009; Olivier Crête <tester@gentoo.org>
+  +gst-plugins-base-0.10.22.ebuild:
+  Version bump, also fix CVE-2009-0586 (bug #261594)
 
 *gst-plugins-base-0.10.21-r1 (24 Dec 2008)
 
diff --git a/media-libs/gst-plugins-base/Manifest b/media-libs/gst-plugins-base/Manifest
index 0cb186048231..41dbf7d623c6 100644
--- a/media-libs/gst-plugins-base/Manifest
+++ b/media-libs/gst-plugins-base/Manifest
@@ -1,10 +1,23 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX gst-plugins-base-0.10.21-gtkdoc.patch 616 RMD160 867ec46661f588b15de21816309aa45a5cca1bbb SHA1 6b20eb8e4fca6c7b374b8c856de6576453b54319 SHA256 2498479168c08c064cc294deecd3891c011a2448d7bf264e060302916a466579
+AUX gst-plugins-base-0.10.22-CVE-2009-0586.patch 2813 RMD160 fd1b250c40020077679adade225aeed5cc0eeffa SHA1 82fd6ce0ee1b2f1474739b1d0d520eff05da4677 SHA256 4026cf0a8a0ee2556715345ce1d2b5d7cc001374f2b893d6a3c65b525d10fb0b
 DIST gst-plugins-base-0.10.14.tar.bz2 1625388 RMD160 507666ea6d2a4657d315dfe54c8869ab74a59351 SHA1 54e7b2d482f6eef4dbbe7d4b5f59ada033e447ab SHA256 ffd88d23227f54aae30fdc0ef60ea8eaffe8cc03c069b234ed23c4ea82dcff46
 DIST gst-plugins-base-0.10.20.tar.bz2 1986182 RMD160 2283fa2743a18630c3dab5a77d2b4eae9253eb97 SHA1 e887f071eda3128249657805dc5a42b2ad2d3bef SHA256 aa3d5ce29232ee5b24b6c032194ac1fc757309ea50ac850c0db46e45ab0a78ff
 DIST gst-plugins-base-0.10.21.tar.bz2 1982446 RMD160 4fa9056c8cc5d21db30074596831ffc14f6b671b SHA1 ae83b3306f52aa3affd014dade30c6cd5c2baa66 SHA256 673f4a45a0f3aa99606a58097bde02d09ad51d7b2e702f0d68eeb6db21d47e93
+DIST gst-plugins-base-0.10.22.tar.bz2 2118085 RMD160 013de77422d6e89b64cf55ff7299b0ff1e38ef8a SHA1 8e6a894858f5412234ce1591bbb773102c150cb7 SHA256 184c5aed03ebfe38a276fc03cb7d8685d9a6da5a48bf6a0565c83e11a29cd5f9
 EBUILD gst-plugins-base-0.10.14.ebuild 1418 RMD160 4df90b81a7c0190ec51db75bc922176fc38dafbc SHA1 50ae6d2dab62f553ffc4e9260dd0206c28f3711e SHA256 fa8584d3132d3245185abf98dc641df442b78265555015a1e626050b1ad0f460
 EBUILD gst-plugins-base-0.10.20.ebuild 1189 RMD160 7d7585dd40bb406f3d9e0e63f936fdd8b47ff270 SHA1 95960bc49203748627c37a16cf778b39a021060e SHA256 5ed2304f1dadda1a2c06c46e7fc5c6da2ed6eddd3c48c95150af5156007fa325
 EBUILD gst-plugins-base-0.10.21-r1.ebuild 3048 RMD160 cd4bcc7e173e5b3e1786b5275159e34eca48c38e SHA1 92c01dcea41a20732c16b816eb50a4dc342ab3c4 SHA256 f113ec0f7b5d58896285aa33ead853041112efeda3de50ad1cc53ecb0d1bad95
 EBUILD gst-plugins-base-0.10.21.ebuild 1296 RMD160 50db62d053f33dce2b252d51522be25b82816798 SHA1 a764d79c77a38c98ef665fc44df44d8aeb47bbdf SHA256 8318970b6da5e781047d7ebec56b0ab03fe4cc0117bb71bd4a36da7862031a44
-MISC ChangeLog 12521 RMD160 ce0d114f9189ccca31f70b6e2c9b4b49729498a3 SHA1 512976921d9a4f28aad7aba28490a8f931b0bf70 SHA256 114bfa92f944cc580a571d7fa6d0f04fd833d9bd475e47a808fe1ae521854dd7
+EBUILD gst-plugins-base-0.10.22.ebuild 1216 RMD160 306d0565b210055ab72039ef4f121cae3cef0a15 SHA1 4eb2955d00bbadfbefc175a8f2483bb459dacffd SHA256 0beb56f61c87d1ebe4e5c8696b6ea13845e248e3314649637f231d9cddc08c64
+MISC ChangeLog 12699 RMD160 734278cff07aaad26934f8eda27bef6431b361c1 SHA1 b19a6b47a3111251bb7716d108345a48c600a068 SHA256 b03f1a9790ec4674d6619fbcfdab5896c9e4ebef0199438d3e55392447525b96
 MISC metadata.xml 281 RMD160 07e04e9ed3a829881972155cac9ebb38fdd5d70c SHA1 d5e60b9979d4b2dc4ffd04990a13d4a2fb142a51 SHA256 a66d0d74b7a3b46fb7485773ebc5016917f90e1f046b26def304b18133856b29
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.10 (GNU/Linux)
+
+iEYEARECAAYFAknQTLwACgkQmOfEJZHYOKcz+QCcCxMMbqCd558VrxyhBgEitEXm
+EOoAniM9RGjnIClXlavIZxTR8GtsyT4O
+=5YxX
+-----END PGP SIGNATURE-----
diff --git a/media-libs/gst-plugins-base/files/gst-plugins-base-0.10.22-CVE-2009-0586.patch b/media-libs/gst-plugins-base/files/gst-plugins-base-0.10.22-CVE-2009-0586.patch
new file mode 100644
index 000000000000..abc3438a67eb
--- /dev/null
+++ b/media-libs/gst-plugins-base/files/gst-plugins-base-0.10.22-CVE-2009-0586.patch
@@ -0,0 +1,95 @@
+From 566583e87147f774e7fc4c78b5f7e61d427e40a9 Mon Sep 17 00:00:00 2001
+From: Jan Schmidt <thaytan@noraisin.net>
+Date: Tue, 24 Feb 2009 15:58:42 +0000
+Subject: vorbistag: Protect memory allocation calculation from overflow.
+
+Patch by: Tomas Hoger <thoger@redhat.com> Fixes CVE-2009-0586
+---
+diff --git a/gst-libs/gst/tag/gstvorbistag.c b/gst-libs/gst/tag/gstvorbistag.c
+index 0999368..9401e61 100644
+--- a/gst-libs/gst/tag/gstvorbistag.c
++++ b/gst-libs/gst/tag/gstvorbistag.c
+@@ -305,30 +305,32 @@ gst_vorbis_tag_add (GstTagList * list, const gchar * tag, const gchar * value)
+ }
+ 
+ static void
+-gst_vorbis_tag_add_coverart (GstTagList * tags, const gchar * img_data_base64,
++gst_vorbis_tag_add_coverart (GstTagList * tags, gchar * img_data_base64,
+     gint base64_len)
+ {
+   GstBuffer *img;
+-  guchar *img_data;
+   gsize img_len;
++  guchar *out;
+   guint save = 0;
+   gint state = 0;
+ 
+   if (base64_len < 2)
+     goto not_enough_data;
+ 
+-  img_data = g_try_malloc0 (base64_len * 3 / 4);
+-
+-  if (img_data == NULL)
+-    goto alloc_failed;
+-
+-  img_len = g_base64_decode_step (img_data_base64, base64_len, img_data,
+-      &state, &save);
++  /* img_data_base64 points to a temporary copy of the base64 encoded data, so
++   * it's safe to do inpace decoding here
++   * TODO: glib 2.20 and later provides g_base64_decode_inplace, so change this
++   * to use glib's API instead once it's in wider use:
++   *  http://bugzilla.gnome.org/show_bug.cgi?id=564728
++   *  http://svn.gnome.org/viewvc/glib?view=revision&revision=7807 */
++  out = (guchar *) img_data_base64;
++  img_len = g_base64_decode_step (img_data_base64, base64_len,
++      out, &state, &save);
+ 
+   if (img_len == 0)
+     goto decode_failed;
+ 
+-  img = gst_tag_image_data_to_image_buffer (img_data, img_len,
++  img = gst_tag_image_data_to_image_buffer (out, img_len,
+       GST_TAG_IMAGE_TYPE_NONE);
+ 
+   if (img == NULL)
+@@ -338,7 +340,6 @@ gst_vorbis_tag_add_coverart (GstTagList * tags, const gchar * img_data_base64,
+       GST_TAG_PREVIEW_IMAGE, img, NULL);
+ 
+   gst_buffer_unref (img);
+-  g_free (img_data);
+   return;
+ 
+ /* ERRORS */
+@@ -347,21 +348,14 @@ not_enough_data:
+     GST_WARNING ("COVERART tag with too little base64-encoded data");
+     return;
+   }
+-alloc_failed:
+-  {
+-    GST_WARNING ("Couldn't allocate enough memory to decode COVERART tag");
+-    return;
+-  }
+ decode_failed:
+   {
+-    GST_WARNING ("Couldn't decode bas64 image data from COVERART tag");
+-    g_free (img_data);
++    GST_WARNING ("Couldn't decode base64 image data from COVERART tag");
+     return;
+   }
+ convert_failed:
+   {
+     GST_WARNING ("Couldn't extract image or image type from COVERART tag");
+-    g_free (img_data);
+     return;
+   }
+ }
+@@ -457,6 +451,7 @@ error:
+   return NULL;
+ #undef ADVANCE
+ }
++
+ typedef struct
+ {
+   guint count;
+--
+cgit v0.8.2
diff --git a/media-libs/gst-plugins-base/gst-plugins-base-0.10.22.ebuild b/media-libs/gst-plugins-base/gst-plugins-base-0.10.22.ebuild
new file mode 100644
index 000000000000..57b13262fc8f
--- /dev/null
+++ b/media-libs/gst-plugins-base/gst-plugins-base-0.10.22.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/gst-plugins-base/gst-plugins-base-0.10.22.ebuild,v 1.1 2009/03/30 04:38:14 tester Exp $
+
+# order is important, gnome2 after gst-plugins
+inherit gst-plugins-base gst-plugins10 gnome2 flag-o-matic eutils
+# libtool
+
+DESCRIPTION="Basepack of plugins for gstreamer"
+HOMEPAGE="http://gstreamer.sourceforge.net"
+SRC_URI="http://gstreamer.freedesktop.org/src/${PN}/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="nls"
+
+RDEPEND=">=dev-libs/glib-2.8
+	>=media-libs/gstreamer-0.10.22
+	>=dev-libs/liboil-0.3.14o
+	!<media-libs/gst-plugins-bad-0.10.10"
+DEPEND="${RDEPEND}
+	nls? ( >=sys-devel/gettext-0.11.5 )
+	dev-util/pkgconfig"
+
+DOCS="AUTHORS README RELEASE"
+
+src_unpack() {
+	unpack ${A}
+
+	cd ${S}
+	epatch "${FILESDIR}/gst-plugins-base-0.10.22-CVE-2009-0586.patch"
+}
+
+src_compile() {
+	# gst doesnt handle opts well, last tested with 0.10.15
+	strip-flags
+	replace-flags "-O3" "-O2"
+
+	gst-plugins-base_src_configure \
+		$(use_enable nls)
+	emake || die "emake failed."
+}
+
+src_install() {
+	gnome2_src_install
+}