From 3b7532cee15cd48904b1017394f443d561f92a15 Mon Sep 17 00:00:00 2001 From: Kacper Kowalik Date: Fri, 23 Sep 2011 18:25:09 +0000 Subject: Revbump for CVE-2011-3328, till proper apng patch is rolled out Package-Manager: portage-2.2.0_alpha59/cvs/Linux x86_64 --- media-libs/libpng/ChangeLog | 8 +++- media-libs/libpng/Manifest | 15 ++++--- .../libpng/files/libpng-1.5.4-CVE-2011-3328.patch | 23 +++++++++++ media-libs/libpng/libpng-1.5.4-r1.ebuild | 48 ++++++++++++++++++++++ media-libs/libpng/libpng-1.5.4.ebuild | 47 --------------------- 5 files changed, 87 insertions(+), 54 deletions(-) create mode 100644 media-libs/libpng/files/libpng-1.5.4-CVE-2011-3328.patch create mode 100644 media-libs/libpng/libpng-1.5.4-r1.ebuild delete mode 100644 media-libs/libpng/libpng-1.5.4.ebuild (limited to 'media-libs') diff --git a/media-libs/libpng/ChangeLog b/media-libs/libpng/ChangeLog index 33b33303c872..2bb583c4cd79 100644 --- a/media-libs/libpng/ChangeLog +++ b/media-libs/libpng/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for media-libs/libpng # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/media-libs/libpng/ChangeLog,v 1.302 2011/09/20 20:31:14 grobian Exp $ +# $Header: /var/cvsroot/gentoo-x86/media-libs/libpng/ChangeLog,v 1.303 2011/09/23 18:25:09 xarthisius Exp $ + +*libpng-1.5.4-r1 (23 Sep 2011) + + 23 Sep 2011; Kacper Kowalik -libpng-1.5.4.ebuild, + +libpng-1.5.4-r1.ebuild, +files/libpng-1.5.4-CVE-2011-3328.patch: + Revbump for CVE-2011-3328, till proper apng patch is rolled out 20 Sep 2011; Fabian Groffen libpng-1.4.8-r2.ebuild: Fix installation on Darwin diff --git a/media-libs/libpng/Manifest b/media-libs/libpng/Manifest index 7787854dc002..421f42608abf 100644 --- a/media-libs/libpng/Manifest +++ b/media-libs/libpng/Manifest @@ -3,6 +3,7 @@ Hash: SHA1 AUX libpng-1.2.45-build.patch 384 RMD160 a6567731f964f8a78a2c2be44112761417e4799c SHA1 580afbf794330d33298b62fa84a3da1468c05c43 SHA256 980df151b1b785ab24b86b0e512340b7040c7ac02b58cc835170000b90cfdf7c AUX libpng-1.4.8-build.patch 272 RMD160 1f2a9395316c55637ae80207ef589422f2860a6d SHA1 3fb8182441b87f738c019ef2e8d8650042c71d32 SHA256 68342741c0bc08ee30abdbfb808e0c0065851ad5483a3982121ca8be8b7009e6 +AUX libpng-1.5.4-CVE-2011-3328.patch 912 RMD160 1424614deb663702a4018585099006524e947b5d SHA1 40230b3a020bd7c95bf8ae427e280577292d16ba SHA256 90d8ed6891e9c770112eb29b8edc4fddab1dfb880d7de6283156b1b8716bd505 DIST libpng-1.2.45.tar.xz 539972 RMD160 c1294734d1912d84ac8dd2a53095d7345bd6ca99 SHA1 77d744bd5704c0218b8587014d0d205e4fe95cdf SHA256 befc6d2ddebae760f79bf9f88fecce42f88f2fc5962223da7bceb535cf2e5e9b DIST libpng-1.2.46.tar.xz 541808 RMD160 1ae035fb9bd06fa71adf736b1d4b6d152df0a3f6 SHA1 89fbe2bfb031d7c3ec65ee46041fe602c8f79f32 SHA256 f6f3ddc53bcb8cdd224f1d3642150df38aa5e8e9d509b0cedf793638c9269d65 DIST libpng-1.4.7-apng.patch.gz 10437 RMD160 f0e2e8862f057fcc1be7ce26063fc58e58774720 SHA1 8286b869d0adabc77d25ca5fca3d4895b8b9618f SHA256 2e3db25f04cf3bdc193b04e431b8cca31d3d7d3616cee0bd7e58c0a46715e09d @@ -15,13 +16,15 @@ EBUILD libpng-1.2.46.ebuild 995 RMD160 cbc778dc4f81dbfef9cf275e776e01dff731bbd2 EBUILD libpng-1.4.8-r1.ebuild 1426 RMD160 88c5a3c9cd84e43aaad1eb059f15b4774d6deb48 SHA1 9522542c4f4a2e5a4f3cf2142f3729fc439d6e0b SHA256 367a1591ba92868095f461498ab1600ff2b771c0211804906dd5f6fb515490f2 EBUILD libpng-1.4.8-r2.ebuild 1369 RMD160 531f587ba91f30eb15135f613068aed99545600f SHA1 bc4b9405b9d7533dd7ece78f7e39542b61d2d6b0 SHA256 ec52f045d997fc9bfb1fa2fe3686489956395c6f079b9a815e2cec32fbf497d2 EBUILD libpng-1.4.8.ebuild 1467 RMD160 023570d161ac3f93c09893c2292a605ec079418b SHA1 6e2808c79a8c2cebdafa56611c7236d9aa2c195c SHA256 8447d796a9d51d3ed14b91aad3b39d82c4ea1ce0b0d35f8b3fcb6ce2a7abf5c1 -EBUILD libpng-1.5.4.ebuild 1412 RMD160 7edb0df74eedaa4d0778942872a24e9225e51088 SHA1 bb38d4bef6c80939d0907a034ac7b1c8dafa95f4 SHA256 d7e86ac30ec35d34a2e3a0ebe0f7bff6044b31fe949671f49e3ae3be354f958f -MISC ChangeLog 40634 RMD160 7b41385cdbb16a792c82ac1cef76e5fadd1accc3 SHA1 23b4d54bb1f1e8df355fe14b3ef65b4b846d37f6 SHA256 cd2c50a7d61fb7eec657ecb623c3062710dd2f665418ca15ec4d38e11ea9c6ed +EBUILD libpng-1.5.4-r1.ebuild 1463 RMD160 27b6c8dd18f3169fb359c3bec9b433693d67b5de SHA1 faa68726cc46b698db204b4120fe2e0d1ce37af9 SHA256 40a8a4cd20697bcc2fb08fb1248db7515841039d9bfdfd9307fbd34c2cb21be6 +MISC ChangeLog 40880 RMD160 8b32537536e5911d255768ac3bfe00663d674c5c SHA1 fa165d6271ca50f04a1a1e85ca0b674df5cebf42 SHA256 27dffb5dfe02bb45bebea2ff754240a753dc20d8c205b0d77b4b609a6da7553d MISC metadata.xml 247 RMD160 61ce1843d85a1ab05dc7838ac15375b0fb4f35bd SHA1 0a4b634f99126e9ebc485ad949b41df5a11f2fb0 SHA256 6646b71692ca41b7b944a2f6e044942baf8b8258ca073b555160e57b9eb39af8 -----BEGIN PGP SIGNATURE----- -Version: GnuPG v2.0.18 (Darwin) +Version: GnuPG v2.0.18 (GNU/Linux) -iEYEARECAAYFAk54+BgACgkQX3X2B8XHTomCIgCfYKWJumn8DBnY1MQl9AI9nF1T -KQAAnRGgnoNp/fD24Ilvyz6fQPOir0SW -=hUBK +iJwEAQECAAYFAk58zw0ACgkQIiMqcbOVdxR+pQP/ayLU9JrK6hDBzc0aS2AUfwBb +rOUph+Ehcwsj8lXd0zq1+QhnSQZaC/H2AxSM+COM2NSgWnrizXOdI2WS0r5VSeML +RqwFIG+a3sd+tf/HKtQZRc0LhEJ3c4BYfRHDb0fry43dfClq3FFnyo0JuMRxHI7W +qJYKUD9QiDJv8e+/Vl4= +=Z2S2 -----END PGP SIGNATURE----- diff --git a/media-libs/libpng/files/libpng-1.5.4-CVE-2011-3328.patch b/media-libs/libpng/files/libpng-1.5.4-CVE-2011-3328.patch new file mode 100644 index 000000000000..bcfdc119b193 --- /dev/null +++ b/media-libs/libpng/files/libpng-1.5.4-CVE-2011-3328.patch @@ -0,0 +1,23 @@ +--- pngrutil.c.orig 2011-09-23 20:20:43.974170436 +0200 ++++ pngrutil.c 2011-09-23 20:21:41.308119496 +0200 +@@ -1037,12 +1037,14 @@ + */ + png_uint_32 w = y_red + y_green + y_blue; + +- png_ptr->rgb_to_gray_red_coeff = (png_uint_16)(((png_uint_32)y_red * +- 32768)/w); +- png_ptr->rgb_to_gray_green_coeff = (png_uint_16)(((png_uint_32)y_green +- * 32768)/w); +- png_ptr->rgb_to_gray_blue_coeff = (png_uint_16)(((png_uint_32)y_blue * +- 32768)/w); ++ if (w != 0) { ++ png_ptr->rgb_to_gray_red_coeff = (png_uint_16)(((png_uint_32)y_red * ++ 32768)/w); ++ png_ptr->rgb_to_gray_green_coeff = (png_uint_16)(((png_uint_32)y_green ++ * 32768)/w); ++ png_ptr->rgb_to_gray_blue_coeff = (png_uint_16)(((png_uint_32)y_blue * ++ 32768)/w); ++ } + } + } + #endif diff --git a/media-libs/libpng/libpng-1.5.4-r1.ebuild b/media-libs/libpng/libpng-1.5.4-r1.ebuild new file mode 100644 index 000000000000..85c4a0a6c61f --- /dev/null +++ b/media-libs/libpng/libpng-1.5.4-r1.ebuild @@ -0,0 +1,48 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/media-libs/libpng/libpng-1.5.4-r1.ebuild,v 1.1 2011/09/23 18:25:09 xarthisius Exp $ + +EAPI=4 + +inherit eutils libtool multilib + +DESCRIPTION="Portable Network Graphics library" +HOMEPAGE="http://www.libpng.org/" +SRC_URI="mirror://sourceforge/${PN}/${P}.tar.xz + apng? ( mirror://sourceforge/${PN}-apng/${PN}-devel/${PV}/${P}-apng.patch.gz )" + +LICENSE="as-is" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~x86-interix ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt" +IUSE="apng static-libs" + +RDEPEND="sys-libs/zlib" +DEPEND="${RDEPEND} + app-arch/xz-utils" + +DOCS=( ANNOUNCE CHANGES libpng-manual.txt README TODO ) + +src_prepare() { + epatch "${FILESDIR}"/${P}-CVE-2011-3328.patch + use apng && epatch "${WORKDIR}"/${P}-apng.patch + elibtoolize +} + +src_configure() { + econf $(use_enable static-libs static) +} + +src_install() { + default + find "${ED}" -name '*.la' -exec rm -f {} + +} + +pkg_preinst() { + has_version ${CATEGORY}/${PN}:1.4 && return 0 + preserve_old_lib /usr/$(get_libdir)/libpng14$(get_libname 14) +} + +pkg_postinst() { + has_version ${CATEGORY}/${PN}:1.4 && return 0 + preserve_old_lib_notify /usr/$(get_libdir)/libpng14$(get_libname 14) +} diff --git a/media-libs/libpng/libpng-1.5.4.ebuild b/media-libs/libpng/libpng-1.5.4.ebuild deleted file mode 100644 index 8a94c7fd1ba3..000000000000 --- a/media-libs/libpng/libpng-1.5.4.ebuild +++ /dev/null @@ -1,47 +0,0 @@ -# Copyright 1999-2011 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/media-libs/libpng/libpng-1.5.4.ebuild,v 1.2 2011/09/17 17:52:35 ssuominen Exp $ - -EAPI=4 - -inherit eutils libtool multilib - -DESCRIPTION="Portable Network Graphics library" -HOMEPAGE="http://www.libpng.org/" -SRC_URI="mirror://sourceforge/${PN}/${P}.tar.xz - apng? ( mirror://sourceforge/${PN}-apng/${PN}-devel/${PV}/${P}-apng.patch.gz )" - -LICENSE="as-is" -SLOT="0" -KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~x86-interix ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt" -IUSE="apng static-libs" - -RDEPEND="sys-libs/zlib" -DEPEND="${RDEPEND} - app-arch/xz-utils" - -DOCS=( ANNOUNCE CHANGES libpng-manual.txt README TODO ) - -src_prepare() { - use apng && epatch "${WORKDIR}"/${P}-apng.patch - elibtoolize -} - -src_configure() { - econf $(use_enable static-libs static) -} - -src_install() { - default - find "${ED}" -name '*.la' -exec rm -f {} + -} - -pkg_preinst() { - has_version ${CATEGORY}/${PN}:1.4 && return 0 - preserve_old_lib /usr/$(get_libdir)/libpng14$(get_libname 14) -} - -pkg_postinst() { - has_version ${CATEGORY}/${PN}:1.4 && return 0 - preserve_old_lib_notify /usr/$(get_libdir)/libpng14$(get_libname 14) -} -- cgit v1.2.3-65-gdbad