fix insecure tempfile handling, bug #66357

6 files changed, 278 insertions, 24 deletions

diff --git a/app-text/ghostscript/ChangeLog b/app-text/ghostscript/ChangeLog
index f1d97a576363..2767ed100741 100644
--- a/app-text/ghostscript/ChangeLog
+++ b/app-text/ghostscript/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-text/ghostscript
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/ghostscript/ChangeLog,v 1.74 2004/10/06 22:40:16 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/ghostscript/ChangeLog,v 1.75 2004/10/07 15:14:44 lanius Exp $
+
+*ghostscript-7.07.1-r7 (07 Oct 2004)
+
+  07 Oct 2004; Heinrich Wendel <lanius@gentoo.org>
+  +files/gs7.07.1-tempfile.patch, +ghostscript-7.07.1-r7.ebuild:
+  fix insecure tempfile handling, bug #66357
 
   07 Oct 2004; Luca Barbato <lu_zero@gentoo.org> +files/gs-fix-gc.patch,
   ghostscript-7.07.1-r6.ebuild:
diff --git a/app-text/ghostscript/Manifest b/app-text/ghostscript/Manifest
index ca1db0775009..06e687e449db 100644
--- a/app-text/ghostscript/Manifest
+++ b/app-text/ghostscript/Manifest
@@ -1,30 +1,35 @@
-MD5 0eb21cd33b7646ed6bab341f994c6640 ghostscript-7.05.6-r1.ebuild 2749
-MD5 e5f37353cc211a2f71cc8841bb8cc1ba ghostscript-7.07.1-r1.ebuild 3187
-MD5 8182f0d98162f7b51b03f8017d4035f8 ghostscript-7.07.1-r6.ebuild 3722
-MD5 2db7df35be7d9e0921a6ab5c72c02f67 ghostscript-7.07.1-r2.ebuild 3295
 MD5 6a3949a845d79b6f29d62e2e91f27f94 ghostscript-7.07.1-r5.ebuild 3671
-MD5 5e56a962d78684b6a1d350de6755083a ChangeLog 12367
-MD5 26b4b081d538c195dc39bcb2ec8e6f3a metadata.xml 161
-MD5 0d1e785f83f28fcc649afaee1641be97 ghostscript-7.07.1-r3.ebuild 3443
+MD5 cd8ae5ec23899b7bb11f724bfb1d6211 ghostscript-7.07.1-r7.ebuild 3626
+MD5 2db7df35be7d9e0921a6ab5c72c02f67 ghostscript-7.07.1-r2.ebuild 3295
 MD5 4c43a0cacba1f4a15e9578ed603257fd ghostscript-7.05.6.ebuild 2739
+MD5 f087a4adb47b3991614753019453eaef ghostscript-7.05.6-r2.ebuild 2823
 MD5 d26ced8d0d60522b769bed4ebf49308a ghostscript-7.07.1-r4.ebuild 3644
-MD5 4d11b45e0a5dd9ee77d7757d76814fd9 files/gs7.07.1-cjk.diff.bz2 3264
-MD5 6807c3b6025d5b09e8eb6349769162d1 files/digest-ghostscript-7.05.6-r1 212
-MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r2 291
-MD5 68fa21d11a860c222c8ba89c39ce578e files/gs7.05.6-gdevpx.patch 402
+MD5 8182f0d98162f7b51b03f8017d4035f8 ghostscript-7.07.1-r6.ebuild 3722
+MD5 e5f37353cc211a2f71cc8841bb8cc1ba ghostscript-7.07.1-r1.ebuild 3187
+MD5 5e56a962d78684b6a1d350de6755083a ChangeLog 12367
+MD5 0eb21cd33b7646ed6bab341f994c6640 ghostscript-7.05.6-r1.ebuild 2749
+MD5 0d1e785f83f28fcc649afaee1641be97 ghostscript-7.07.1-r3.ebuild 3443
+MD5 26b4b081d538c195dc39bcb2ec8e6f3a metadata.xml 161
 MD5 8c6a3d7e8897b4297ef853dbd89e408b files/gs-fix-gc.patch 5627
-MD5 b7ca313a24a8adf4c527c0a097354f60 files/digest-ghostscript-7.07.1-r6 212
-MD5 291c8895063b8ecee12b68d45a705ab4 files/gs7.05-gdevhl12.c.bz2 7406
-MD5 acda8ddfde1efeaf451cb28a67dcc773 files/gs7.07.1-krgb.patch.gz 5569
-MD5 3d1cdf07dabc4a05bde9a2dc6f7da2de files/gs7.07.1-fontconfig-rh.patch.bz2 6121
-MD5 7208aacbb4aa234ce1a6126e8f682c06 files/gs7.07.1-ps2epsi.patch 372
+MD5 343b6a60e15e35d0c5f825b4f361fd29 files/gs7.05.6-cjk.diff.bz2 3287
 MD5 5f1b04ca58928a339b749703e067e2ba files/gs7.05.6-kochi-substitute.patch 3774
-MD5 fd34b2b7a029f19eab4ba3f69afe295e files/ghostscript-7.05.6.man.patch 1231
-MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r5 291
-MD5 ac6af6bf67095500ea043aea27062d62 files/gs7.07.1-ijs.patch 401
+MD5 6807c3b6025d5b09e8eb6349769162d1 files/digest-ghostscript-7.05.6-r1 212
+MD5 6807c3b6025d5b09e8eb6349769162d1 files/digest-ghostscript-7.05.6-r2 212
+MD5 acda8ddfde1efeaf451cb28a67dcc773 files/gs7.07.1-krgb.patch.gz 5569
+MD5 291c8895063b8ecee12b68d45a705ab4 files/gs7.05-gdevhl12.c.bz2 7406
 MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r1 291
-MD5 343b6a60e15e35d0c5f825b4f361fd29 files/gs7.05.6-cjk.diff.bz2 3287
-MD5 370d4bcd16d8acd03190ba84e2f61a41 files/gs7.07.1-ijsdestdir.patch 1418
+MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r2 291
 MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r3 291
 MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r4 291
+MD5 71a93bd09748f37be38b726b0530e497 files/digest-ghostscript-7.07.1-r5 291
+MD5 b7ca313a24a8adf4c527c0a097354f60 files/digest-ghostscript-7.07.1-r6 212
+MD5 b7ca313a24a8adf4c527c0a097354f60 files/digest-ghostscript-7.07.1-r7 212
+MD5 370d4bcd16d8acd03190ba84e2f61a41 files/gs7.07.1-ijsdestdir.patch 1418
 MD5 c63f6d71a403dbc72265831386b84eb0 files/digest-ghostscript-7.05.6 359
+MD5 7208aacbb4aa234ce1a6126e8f682c06 files/gs7.07.1-ps2epsi.patch 372
+MD5 3273e412e1d8dd016d124fadef0f348b files/gs7.07.1-tempfile.patch 3107
+MD5 fd34b2b7a029f19eab4ba3f69afe295e files/ghostscript-7.05.6.man.patch 1231
+MD5 3d1cdf07dabc4a05bde9a2dc6f7da2de files/gs7.07.1-fontconfig-rh.patch.bz2 6121
+MD5 68fa21d11a860c222c8ba89c39ce578e files/gs7.05.6-gdevpx.patch 402
+MD5 ac6af6bf67095500ea043aea27062d62 files/gs7.07.1-ijs.patch 401
+MD5 4d11b45e0a5dd9ee77d7757d76814fd9 files/gs7.07.1-cjk.diff.bz2 3264
diff --git a/app-text/ghostscript/files/digest-ghostscript-7.07.1-r7 b/app-text/ghostscript/files/digest-ghostscript-7.07.1-r7
new file mode 100644
index 000000000000..86d2854e2bfc
--- /dev/null
+++ b/app-text/ghostscript/files/digest-ghostscript-7.07.1-r7
@@ -0,0 +1,3 @@
+MD5 d30bf5c09f2c7caa8291f6305cf03044 espgs-7.07.1-source.tar.bz2 5400198
+MD5 a3bf430a7e21cd82401258a2ec3b8afb adobe-cmaps-200204.tar.gz 4360486
+MD5 2fbae60417d42779f6488ab897dcaaf6 acro5-cmaps-2001.tar.gz 631653
diff --git a/app-text/ghostscript/files/gs7.07.1-tempfile.patch b/app-text/ghostscript/files/gs7.07.1-tempfile.patch
new file mode 100644
index 000000000000..2dcca5360f17
--- /dev/null
+++ b/app-text/ghostscript/files/gs7.07.1-tempfile.patch
@@ -0,0 +1,105 @@
+diff -ur espgs-7.07.1.orig/lib/pj-gs.sh espgs-7.07.1/lib/pj-gs.sh
+--- espgs-7.07.1.orig/lib/pj-gs.sh	2002-04-23 13:58:36.000000000 +0200
++++ espgs-7.07.1/lib/pj-gs.sh	2004-09-13 10:04:00.000000000 +0200
+@@ -241,6 +241,7 @@
+ 			then
+ 				/usr/lib/lprcat $Nofilter $Nolabel $file PCL1 $user $dev
+ 			else
++				TEMPFILE=`mktemp -t pjXXXXXX` || exit 1
+ 				type=`file $file | sed 's/^[^:]*..//'`
+ 				case "$type" in
+ 				postscript*)
+@@ -251,22 +252,22 @@
+ #
+ #					gs -q -sDEVICE=paintjet -r180 -sOutputFile=- -dDISKFONTS -dNOPAUSE - < $file 2>/tmp/sh$$
+ 
+-					gs -q -sDEVICE=paintjet -r180 -sOutputFile=/tmp/pj$$ -dDISKFONTS -dNOPAUSE - < $file 1>2
+-					cat /tmp/pj$$
+-					rm /tmp/pj$$
++					gs -q -sDEVICE=paintjet -r180 -sOutputFile=$TEMPFILE -dDISKFONTS -dNOPAUSE - < $file 1>2
++					cat $TEMPFILE
++					rm $TEMPFILE
+ 					needff=
+ 					;;
+-				*)	cat "$file" 2>/tmp/sh$$
++				*)	cat "$file" 2>$TEMPFILE
+ 					needff=1
+ 					;;
+ 				esac
+ 
+-				if [ -s /tmp/sh$$ ]
++				if [ -s $TEMPFILE ]
+ 				then
+ #				    cat /tmp/sh$$	# output any errors
+-				    cat /tmp/sh$$ 1>2	# output any errors
++				    cat $TEMPFILE 1>2	# output any errors
+ 				fi
+-				rm -f /tmp/sh$$
++				rm -f $TEMPFILE
+ 				if [ $needff ]; then echo "\014\r\c"; fi
+ 			fi
+ 
+diff -ur espgs-7.07.1.orig/lib/ps2epsi espgs-7.07.1/lib/ps2epsi
+--- espgs-7.07.1.orig/lib/ps2epsi	2003-09-02 20:01:31.000000000 +0200
++++ espgs-7.07.1/lib/ps2epsi	2004-09-13 10:05:31.000000000 +0200
+@@ -1,12 +1,7 @@
+ #!/bin/sh
+ # $Id: gs7.07.1-tempfile.patch,v 1.1 2004/10/07 15:14:44 lanius Exp $
+ 
+-tmpfile=/tmp/ps2epsi$$
+-rm -f $tmpfile
+-if test -e $tmpfile; then
+-	echo "$0: Our temporary file $tmpfile already exists." 1>&2
+-	exit 1
+-fi
++tmpfile=`mktemp -t ps2epsiXXXXXX` || exit 1
+ trap "rm -rf $tmpfile" 0 1 2 3 7 13 15
+ 
+ export outfile
+diff -ur espgs-7.07.1.orig/lib/pv.sh espgs-7.07.1/lib/pv.sh
+--- espgs-7.07.1.orig/lib/pv.sh	2002-04-23 13:58:36.000000000 +0200
++++ espgs-7.07.1/lib/pv.sh	2004-09-13 10:08:01.000000000 +0200
+@@ -29,9 +29,10 @@
+ PAGE=$1
+ shift
+ FILE=$1
++TEMPFILE=`mktemp -t ${FILE}XXXXXX` || exit 1
+ shift
+-trap "rm -rf $TEMPDIR/$FILE.$$.pv" 0 1 2 15
++trap "rm -rf $TEMPFILE" 0 1 2 15
+ #dvips -D$RESOLUTION -p $PAGE -n 1 $FILE $* -o $FILE.$$.pv
+-dvips -p $PAGE -n 1 $FILE $* -o $FILE.$$.pv
+-gs $FILE.$$.pv
++dvips -p $PAGE -n 1 $FILE $* -o $TEMPFILE
++gs $TEMPFILE
+ exit 0
+diff -ur espgs-7.07.1.orig/lib/sysvlp.sh espgs-7.07.1/lib/sysvlp.sh
+--- espgs-7.07.1.orig/lib/sysvlp.sh	2002-04-23 13:58:37.000000000 +0200
++++ espgs-7.07.1/lib/sysvlp.sh	2004-09-13 10:14:46.000000000 +0200
+@@ -27,20 +27,23 @@
+ # Brother HL-4: switch to HP laserjet II+ emulation
+ # echo "\033\015H\c"
+ 
++TEMPDIR=`mktemp -td sysvlp.XXXXXX` || exit 1
++
+ i=1
+ while [ $i -le $copies ]
+ do
+ 	for file in $files
+ 	do
+ 		$GSHOME/gs \
+-			-sOUTPUTFILE=/tmp/psp$$.%02d \
++			-sOUTPUTFILE=$TEMPDIR/psp$$.%02d \
+ 			-sDEVICE=$DEVICE \
+ 			$EHANDLER $file \
+ 			< /dev/null >> /usr/tmp/ps_log 2>&1
+ 
+-		cat /tmp/psp$$.* 2>> /usr/tmp/ps_log
+-		rm -f /tmp/psp$$.*
++		cat $TEMPDIR/psp$$.* 2>> /usr/tmp/ps_log
++		rm -f $TEMPDIR/psp$$.*
+ 	done
+ 	i=`expr $i + 1`
+ done
++rmdir $TEMPDIR
+ exit 0
diff --git a/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild b/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild
index ab732a91d5c4..819c84ace76a 100644
--- a/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild
+++ b/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild,v 1.4 2004/10/06 22:40:16 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/ghostscript/ghostscript-7.07.1-r6.ebuild,v 1.5 2004/10/07 15:14:44 lanius Exp $
 
 inherit flag-o-matic eutils gcc
 
@@ -63,7 +63,7 @@ src_unpack() {
 	# Makefile.in fixes for DESTDIR support in libijs because
 	# einstall borks on multilib systems -- eradicator
 	epatch ${FILESDIR}/gs${PV}-ijsdestdir.patch
-	
+
 	# Fix the garbage collector on ia64 and ppc
 	epatch ${FILESDIR}/gs-fix-gc.patch
 
diff --git a/app-text/ghostscript/ghostscript-7.07.1-r7.ebuild b/app-text/ghostscript/ghostscript-7.07.1-r7.ebuild
new file mode 100644
index 000000000000..b19b37ba4e4f
--- /dev/null
+++ b/app-text/ghostscript/ghostscript-7.07.1-r7.ebuild
@@ -0,0 +1,135 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/ghostscript/ghostscript-7.07.1-r7.ebuild,v 1.1 2004/10/07 15:14:44 lanius Exp $
+
+inherit flag-o-matic eutils gcc
+
+DESCRIPTION="ESP Ghostscript -- an enhanced version of GNU Ghostscript with better printer support"
+HOMEPAGE="http://www.cups.org/ghostscript.php"
+SRC_URI="mirror://sourceforge/espgs/espgs-${PV}-source.tar.bz2
+	cjk? ( http://www.matsusaka-u.ac.jp/mirror/gs-cjk/adobe-cmaps-200204.tar.gz
+		http://www.matsusaka-u.ac.jp/mirror/gs-cjk/acro5-cmaps-2001.tar.gz)"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+KEYWORDS="~ia64 ~x86 -ppc ~sparc ~alpha ~hppa ~amd64 ~mips ~ppc64"
+IUSE="X cups cjk emacs truetype"
+
+RDEPEND="virtual/libc
+	>=media-libs/jpeg-6b
+	>=media-libs/libpng-1.2.1
+	>=sys-libs/zlib-1.1.4
+	X? ( virtual/x11 )
+	cjk? ( media-fonts/arphicfonts
+		media-fonts/kochi-substitute
+		media-fonts/baekmuk-fonts )
+	cups? ( net-print/cups )
+	!virtual/ghostscript
+	media-libs/fontconfig
+	media-fonts/gnu-gs-fonts-std"
+
+DEPEND="${RDEPEND}
+	truetype? ( dev-util/pkgconfig )"
+
+S=${WORKDIR}/espgs-${PV}
+
+PROVIDE="virtual/ghostscript"
+
+src_unpack() {
+	unpack espgs-${PV}-source.tar.bz2
+
+	cd ${S}
+
+	if use cjk ; then
+		epatch ${FILESDIR}/gs7.05.6-cjk.diff.bz2
+		epatch ${FILESDIR}/gs7.05.6-kochi-substitute.patch
+	fi
+
+	# add fontconfig support
+	epatch ${FILESDIR}/gs7.07.1-fontconfig-rh.patch.bz2
+
+	# man page patch from absinthe@pobox.com (Dylan Carlson) bug #14150
+	epatch ${FILESDIR}/ghostscript-7.05.6.man.patch
+
+	# ijs fPIC patch
+	epatch ${FILESDIR}/gs${PV}-ijs.patch
+
+	# pxl dash patch
+	epatch ${FILESDIR}/gs7.05.6-gdevpx.patch
+
+	# Makefile.in fixes for DESTDIR support in libijs because
+	# einstall borks on multilib systems -- eradicator
+	epatch ${FILESDIR}/gs${PV}-ijsdestdir.patch
+
+	# search path fix
+	sed -i -e "s:\$\(gsdatadir\)/lib:/usr/share/ghostscript/7.07/$(get_libdir):"\
+	Makefile.in || die "sed failed"
+	sed -i -e 's:$(gsdir)/fonts:/usr/share/fonts/default/ghostscript/:' \
+	Makefile.in || die "sed failed"
+
+	# insecure tempfile handling
+	epatch ${FILESDIR}/gs${PV}-tempfile.patch
+
+	# krgb support
+	cd src
+	epatch ${FILESDIR}/gs7.07.1-krgb.patch.gz
+}
+
+src_compile() {
+	local myconf
+	myconf="--with-ijs --with-omni --without-gimp-print"
+
+	use X && myconf="${myconf} --with-x" \
+		|| myconf="${myconf} --without-x"
+
+	use cups && myconf="${myconf} --enable-cups" \
+		|| myconf="${myconf} --disable-cups"
+
+	# -O3 will make ghostscript fail when compiling with gcc 3.4
+	if [ "`gcc-major-version`" -eq "3" ] && [ "`gcc-minor-version`" -eq "4" ]
+	then
+		strip-flags
+		replace-flags -O? -O2
+	fi
+
+	autoconf
+	econf ${myconf} || die "econf failed"
+	make || die "make failed"
+
+	cd ijs
+	econf || die "econf failed"
+	make || die "make failed"
+	cd ..
+}
+
+src_install() {
+	einstall install_prefix=${D}
+
+	rm -fr ${D}/usr/share/ghostscript/7.07/doc || die
+	dodoc doc/README doc/COPYING doc/COPYING.LGPL
+	dohtml doc/*.html doc/*.htm
+
+	if use emacs; then
+		insinto /usr/share/emacs/site-lisp
+		doins doc/gsdoc.el
+	fi
+
+	if use cjk ; then
+		dodir /usr/share/ghostscript/Resource
+		dodir /usr/share/ghostscript/Resource/Font
+		dodir /usr/share/ghostscript/Resource/CIDFont
+		cd ${D}/usr/share/ghostscript/Resource
+		unpack adobe-cmaps-200204.tar.gz
+		unpack acro5-cmaps-2001.tar.gz
+	fi
+
+	# Install ijs
+	cd ${S}/ijs
+	dodir /usr/bin /usr/include /usr/$(get_libdir)
+	# This is broken - there are not even a 'install_prefix'
+	# anywhere in ${S}/ijs ...
+	#einstall install_prefix=${D}
+	#einstall
+	#dosed "s:^prefix=.*:prefix=/usr:" /usr/bin/ijs-config
+	make DESTDIR="${D}" install || die
+}