Added patch from Debian to fix insecure tempfile handling in javareconf (fixes bug #235822). NOTE: R-2.2.1-r1.ebuild is not vulnerable since it does not include the javereconf script. Also removed old ebuilds and removed two tests from the test suite since they fail with portage.

(Portage version: 2.2_rc8/cvs/Linux 2.6.26-SENTINEL-2 i686)

2 files changed, 144 insertions, 0 deletions

diff --git a/dev-lang/R/files/R-2.7.1-test-fix.patch b/dev-lang/R/files/R-2.7.1-test-fix.patch
new file mode 100644
index 000000000000..3be9bc718b77
--- /dev/null
+++ b/dev-lang/R/files/R-2.7.1-test-fix.patch
@@ -0,0 +1,112 @@
+# this patch removed two non-essential tests that fail under portage
+# - test-internet fails due to ACCESS_VIOLATION 
+# - reg-plot-latin1.R fails probably due to locale mismatch
+
+diff -Naur R-2.7.1/tests/Makefile.in R-2.7.1.new/tests/Makefile.in
+--- R-2.7.1/tests/Makefile.in	2008-06-23 05:39:03.000000000 -0400
++++ R-2.7.1.new/tests/Makefile.in	2008-08-27 18:17:33.000000000 -0400
+@@ -40,7 +40,6 @@
+ 
+ test-src-demo = demos.R demos2.R
+ test-src-errmsgs = errormsgs.R
+-test-src-internet = internet.R
+ test-src-isas = isas-tests.R
+ test-src-primitive = primitives.R
+ test-src-random = p-r-random-tests.R
+@@ -51,21 +50,19 @@
+   reg-plot.R reg-S4.R
+ test-src-reg-auto =
+ test-src-reg = $(test-src-reg-1) $(test-src-reg-auto)
+-test-src-reg3 = reg-tests-3.R reg-plot-latin1.R 
++test-src-reg3 = reg-tests-3.R 
+ 
+ DISTFILES = Makefile.in Makefile.win README \
+ 	$(test-src-strict-1) $(test-src-strict-1:.R=.Rout.save) \
+ 	$(test-src-sloppy-1) $(test-src-sloppy-1:.R=.Rout.save) \
+ 	$(test-src-auto:.R=.Rin) isas-tests.Rout.save \
+ 	$(test-src-demo) demos.Rout.save \
+-	$(test-src-internet) internet.Rout.save \
+ 	$(test-src-primitive) \
+ 	$(test-src-random) p-r-random-tests.Rout.save \
+ 	$(test-src-reg) $(test-src-reg3) \
+ 	  reg-S4.Rout.save \
+ 	  reg-IO.Rout.save reg-IO2.Rout.save reg-plot.Rout.save \
+ 	  reg-plot.ps.save reg-tests-2.Rout.save reg-tests-3.Rout.save \
+-	  reg-plot-latin1.ps.save \
+ 	  reg-win.R encodings.R utf8-regex.R \
+ 	  errormsgs.R errormsgs.Rout.save \
+ 	gct-foot.R \
+@@ -89,7 +86,6 @@
+ 
+ test-out-demo = $(test-src-demo:.R=.Rout)
+ test-out-errmsgs = $(test-src-errmsgs:.R=.Rout)
+-test-out-internet = $(test-src-internet:.R=.Rout)
+ test-out-isas = $(test-src-isas:.R=.Rout)
+ test-out-primitive = $(test-src-primitive:.R=.Rout)
+ test-out-random = $(test-src-random:.R=.Rout)
+@@ -100,14 +96,13 @@
+ 
+ ## This macro is used only for dependencies
+ test-out = $(test-src:.R=.Rout) $(test-out-demo) $(test-out-gct) \
+-	$(test-out-internet) \
+ 	$(test-out-random) $(test-out-reg) $(test-out-reg3) \
+ 	$(test-out-segfault) $(test-out-isas)
+ 
+ .SUFFIXES:
+ .SUFFIXES: .R .Rin .Rout .Rout-gct .Rout-valgct
+ 
+-all-basic-tests = Examples Specific Reg Internet
++all-basic-tests = Examples Specific Reg 
+ all-devel-tests = Docs IsAs Random Demo Rd Primitive Regexp Segfault \
+    Standalone Packages
+ 
+@@ -173,24 +168,6 @@
+ 	-@diff reg-plot.ps $(srcdir)/reg-plot.ps.save
+ 	@$(ECHO) "$(ECHO_T) OK"
+ 
+-reg-plot-latin1.Rout: reg-plot-latin1.R
+-	@rm -f $@ $@.fail
+-	@$(ECHO) $(ECHO_N) "running code in '$<' ...$(ECHO_C)"
+-	@$(R2) < $< > $@ 2>&1 || (mv $@ $@.fail && exit 1)
+-	@$(ECHO) "$(ECHO_T) OK"
+-	@if test -f $(srcdir)/$@.save ; then \
+-	  mv $@ $@.fail; \
+-	  $(ECHO) $(ECHO_N) \
+-	    "comparing '$@' to '$(srcdir)/$@.save' ...$(ECHO_C)"; \
+-	  $(RDIFF) $@.fail $(srcdir)/$@.save $(RVAL_IF_DIFF) || exit 1; \
+-	  mv $@.fail $@; \
+-	  $(ECHO) "$(ECHO_T) OK"; \
+-	fi
+-	@$(ECHO) $(ECHO_N) \
+-	  "comparing 'reg-plot-latin1.ps' to '$(srcdir)/reg-plot-latin1.ps.save' ...$(ECHO_C)"
+-	-@diff reg-plot-latin1.ps $(srcdir)/reg-plot-latin1.ps.save
+-	@$(ECHO) "$(ECHO_T) OK"
+-
+ .R.Rout-gct:
+ 	@$(ECHO) "running gctorture() + '$<'"
+ 	@($(ECHO) '.ptime <- proc.time(); gctorture()' ; \
+@@ -265,15 +242,6 @@
+ 	@$(ECHO) "running tests of error messages"
+ 	@$(MAKE) $(test-out-errmsgs) RVAL_IF_DIFF=0
+ 
+-## <NOTE>
+-## These depend on an internet connection, and the sites being up.
+-## So allow this to fail: it may be slow doing so.
+-test-Internet:
+-	@$(ECHO) "running tests of Internet and socket functions"
+-	@$(ECHO) "  expect some differences"
+-	-@$(MAKE) $(test-out-internet) RVAL_IF_DIFF=0
+-## </NOTE>
+-
+ test-IsAs:
+ 	@$(ECHO) "running tests of consistency of as/is.*"
+ 	@$(MAKE) $(test-out-isas) RVAL_IF_DIFF=1
+@@ -434,7 +402,7 @@
+ 	  (cd $${d} && $(MAKE) $@); \
+ 	done
+ 	-@rm -f stamp-R Makedeps Rplot* Rprof.out data dumpdata.R \
+-	  reg-plot-latin1.ps reg-plot.ps reg-tests-?.ps \
++	  reg-plot.ps reg-tests-?.ps \
+ 	  R-exts.* R-intro.R R-intro.Rout \
+ 	  FALSE.R FALSE.tex mirrors.html
+ 	-@rm -f testit.txt testit.html testit.tex testit-Ex.R
diff --git a/dev-lang/R/files/R-javareconf.patch b/dev-lang/R/files/R-javareconf.patch
new file mode 100644
index 000000000000..229dbb293ecb
--- /dev/null
+++ b/dev-lang/R/files/R-javareconf.patch
@@ -0,0 +1,32 @@
+# this patch fixes the insecure tempfile usage reported in bug #235822
+# it was extracted from Debian's r-base_2.7.2-1.diff patch
+
+diff -Naur R-2.7.2/src/scripts/javareconf R-2.7.2.new/src/scripts/javareconf
+--- R-2.7.2/src/scripts/javareconf	2008-03-25 08:26:44.000000000 -0400
++++ R-2.7.2.new/src/scripts/javareconf	2008-08-27 16:49:04.000000000 -0400
+@@ -125,16 +125,19 @@
+ javac_works='not present'
+ if test -n "$JAVAC"; then
+     javac_works='not functional'
+-    rm -rf /tmp/A.java /tmp/A.class
+-    echo "public class A { }" > /tmp/A.java
+-    if test -e /tmp/A.java; then
+-	if "${JAVAC}" /tmp/A.java >/dev/null; then
+-	    if test -e /tmp/A.class; then
++    # edd 25 Aug 2008  use mktemp -t -d
++    #rm -rf /tmp/A.java /tmp/A.class
++    jctmpdir=`mktemp -t -d`
++    echo "public class A { }" > ${jctmpdir}/A.java
++    if test -e ${jctmpdir}/A.java; then
++	if "${JAVAC}" ${jctmpdir}/A.java >/dev/null; then
++	    if test -e ${jctmpdir}/A.class; then
+ 		javac_works=yes
+ 	    fi
+ 	fi
+     fi
+-    rm -rf /tmp/A.java /tmp/A.class
++    # rm -rf /tmp/A.java /tmp/A.class
++    rm -rf ${jctmpdir}
+ fi
+ if test "${javac_works}" = yes; then
+     echo "Java compiler    : ${JAVAC}"