yet another rev bump for security holes... bug #198238 and bug #193437

(Portage version: 2.1.3.19)

4 files changed, 159 insertions, 1 deletions

diff --git a/app-text/tetex/ChangeLog b/app-text/tetex/ChangeLog
index 93c16ecf8920..615b9972efe0 100644
--- a/app-text/tetex/ChangeLog
+++ b/app-text/tetex/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-text/tetex
 # Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.161 2007/11/13 17:25:52 drac Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/ChangeLog,v 1.162 2007/11/15 18:02:20 aballier Exp $
+
+*tetex-3.0_p1-r6 (15 Nov 2007)
+
+  15 Nov 2007; Alexis Ballier <aballier@gentoo.org>
+  +files/tetex-3.0_p1-t1lib-SA26241_buffer_overflow.patch,
+  +tetex-3.0_p1-r6.ebuild:
+  yet another rev bump for security holes... bug #198238 and bug #193437
 
   13 Nov 2007; Samuli Suominen <drac@gentoo.org> tetex-3.0_p1-r5.ebuild:
   amd64 stable wrt security #198238
diff --git a/app-text/tetex/files/digest-tetex-3.0_p1-r6 b/app-text/tetex/files/digest-tetex-3.0_p1-r6
new file mode 100644
index 000000000000..13610b97c3f0
--- /dev/null
+++ b/app-text/tetex/files/digest-tetex-3.0_p1-r6
@@ -0,0 +1,12 @@
+MD5 e7cb60ace25c8c4a964c32895508e3e7 tetex-3.0_p1-dviljk-security-fixes.patch.bz2 8797
+RMD160 ac8499fcc818c4d8fe69b9e2d7fcbe04514d3a04 tetex-3.0_p1-dviljk-security-fixes.patch.bz2 8797
+SHA256 30e14cbed1ac1f2f6b5c5f0066c54394d7f2f215fb96ec3870282947ad33c520 tetex-3.0_p1-dviljk-security-fixes.patch.bz2 8797
+MD5 24568263880f911452936573211fa4e8 tetex-3.0_p1-gentoo.tar.gz 604
+RMD160 5da9d211792ab81d072f0fed65ac737aa3074a6b tetex-3.0_p1-gentoo.tar.gz 604
+SHA256 4e9236349a6d849db06fefcbbf5af7c333199312b461a06840cb8fd2eddd1ac6 tetex-3.0_p1-gentoo.tar.gz 604
+MD5 0f82ade673335256226d0321e6c5e2cf tetex-src-3.0_p1.tar.gz 13357541
+RMD160 24d5029619675ce597782562bc1b87052235d461 tetex-src-3.0_p1.tar.gz 13357541
+SHA256 e67fff941ba95222ac8f0e17395446723fd78045fc2ff548ca40cc72086a4cc1 tetex-src-3.0_p1.tar.gz 13357541
+MD5 ed9d30d9162d16ac8d5065cde6e0f6fa tetex-texmf-3.0.tar.gz 91402377
+RMD160 a1e87733fa3cbef04e39a690ed8549aeaaddb241 tetex-texmf-3.0.tar.gz 91402377
+SHA256 6c3b8fa619749cbb28ca0f8847e56773d13e0bb92f1ea34287420950373640c2 tetex-texmf-3.0.tar.gz 91402377
diff --git a/app-text/tetex/files/tetex-3.0_p1-t1lib-SA26241_buffer_overflow.patch b/app-text/tetex/files/tetex-3.0_p1-t1lib-SA26241_buffer_overflow.patch
new file mode 100644
index 000000000000..fe48e44d5589
--- /dev/null
+++ b/app-text/tetex/files/tetex-3.0_p1-t1lib-SA26241_buffer_overflow.patch
@@ -0,0 +1,17 @@
+Index: tetex-src-3.0/libs/t1lib/t1env.c
+===================================================================
+--- tetex-src-3.0.orig/libs/t1lib/t1env.c
++++ tetex-src-3.0/libs/t1lib/t1env.c
+@@ -568,6 +568,12 @@ char *intT1_Env_GetCompletePath( char *F
+ #endif 
+     strcat( pathbuf, DIRECTORY_SEP);
+     /* And finally the filename: */
++	/* If current pathbuf + StrippedName + 1 byte for NULL is bigger than pathbuf
++	 * let's try next pathbuf */
++	if( strlen(pathbuf) + strlen(StrippedName) + 1 > sizeof(pathbuf) ) {
++		i++;
++		continue;
++	}
+     strcat( pathbuf, StrippedName);
+     
+     /* Check for existence of the path: */
diff --git a/app-text/tetex/tetex-3.0_p1-r6.ebuild b/app-text/tetex/tetex-3.0_p1-r6.ebuild
new file mode 100644
index 000000000000..2ab13cea37c1
--- /dev/null
+++ b/app-text/tetex/tetex-3.0_p1-r6.ebuild
@@ -0,0 +1,122 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/tetex/tetex-3.0_p1-r6.ebuild,v 1.1 2007/11/15 18:02:20 aballier Exp $
+
+inherit tetex-3 flag-o-matic versionator virtualx autotools
+
+SMALL_PV=$(get_version_component_range 1-2 ${PV})
+TETEX_TEXMF_PV=${SMALL_PV}
+S="${WORKDIR}/tetex-src-${SMALL_PV}"
+
+TETEX_SRC="tetex-src-${PV}.tar.gz"
+TETEX_TEXMF="tetex-texmf-${TETEX_TEXMF_PV:-${TETEX_PV}}.tar.gz"
+#TETEX_TEXMF_SRC="tetex-texmfsrc-${TETEX_TEXMF_PV:-${TETEX_PV}}.tar.gz"
+TETEX_TEXMF_SRC=""
+
+DESCRIPTION="a complete TeX distribution"
+HOMEPAGE="http://tug.org/teTeX/"
+
+SRC_PATH_TETEX=ftp://cam.ctan.org/tex-archive/systems/unix/teTeX/current/distrib
+SRC_URI="mirror://gentoo/${TETEX_SRC}
+	${SRC_PATH_TETEX}/${TETEX_TEXMF}
+	mirror://gentoo/${P}-gentoo.tar.gz
+	mirror://gentoo/${P}-dviljk-security-fixes.patch.bz2"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd"
+
+# these are defined in tetex.eclass and tetex-3.eclass
+IUSE=""
+DEPEND="${DEPEND} media-libs/gd"
+RDEPEND="${RDEPEND} media-libs/gd"
+
+src_unpack() {
+	tetex-3_src_unpack
+	cd "${WORKDIR}"
+	unpack ${P}-dviljk-security-fixes.patch.bz2
+	cd "${S}"
+	epatch "${FILESDIR}/${PN}-${SMALL_PV}-kpathsea-pic.patch"
+
+	# bug 85404
+	epatch "${FILESDIR}/${PN}-${SMALL_PV}-epstopdf-wrong-rotation.patch"
+
+	epatch "${FILESDIR}/${P}-amd64-xdvik-wp.patch"
+	epatch "${FILESDIR}/${P}-mptest.patch"
+
+	#bug 98029
+	epatch "${FILESDIR}/${P}-fmtutil-etex.patch"
+
+	#bug 115775
+	epatch "${FILESDIR}/${P}-xpdf-vulnerabilities.patch"
+
+	# bug 94860
+	epatch "${FILESDIR}/${P}-pdftosrc-install.patch"
+
+	# bug 126918
+	epatch "${FILESDIR}/${P}-create-empty-files.patch"
+
+	# bug 94901
+	epatch "${FILESDIR}/${P}-dvipdfm-timezone.patch"
+
+	# security bug #170861
+	epatch "${FILESDIR}/${P}-CVE-2007-0650.patch"
+
+	# security bug #188172
+	epatch "${FILESDIR}/${P}-xpdf-CVE-2007-3387.patch"
+
+	# security bug #198238
+	epatch "${FILESDIR}/${P}-dvips_bufferoverflow.patch"
+
+	# securty bug #196735
+	epatch "${FILESDIR}/xpdf-3.02pl2.patch"
+
+	# Construct a Gentoo site texmf directory
+	# that overlays the upstream supplied
+	epatch "${FILESDIR}/${P}-texmf-site.patch"
+
+	# security bug #198238
+	epatch "${WORKDIR}/${P}-dviljk-security-fixes.patch"
+
+	# security bug #198238 and bug #193437
+	epatch "${FILESDIR}/${P}-t1lib-SA26241_buffer_overflow.patch"
+
+	cd "${S}/texk/dviljk"
+	AT_M4DIR="${S}/texk/m4" eautoreconf
+}
+
+src_compile() {
+	#bug 119856
+	export LC_ALL=C
+
+	# dvipng has its own ebuild (fix for bug #129044).
+	# also, do not build against own lib gd (security #182055)
+	TETEX_ECONF="${TETEX_ECONF} --without-dvipng --with-system-gd"
+
+	tetex-3_src_compile
+}
+
+src_test() {
+	fmtutil --fmtdir "${S}/texk/web2c" --all
+	# The check target tries to access X display, bug #69439.
+	Xmake check || die "Xmake check failed."
+}
+
+src_install() {
+	insinto /usr/share/texmf/dvips/pstricks
+	doins "${FILESDIR}/pst-circ.pro"
+
+	# install pdftosrc man page, bug 94860
+	doman "${S}/texk/web2c/pdftexdir/pdftosrc.1"
+
+	tetex-3_src_install
+
+	# Create Gentoo site texmf directory
+	keepdir /usr/share/texmf-site
+}
+
+pkg_postinst() {
+	tetex-3_pkg_postinst
+
+	elog
+	elog "This release removes dvipng since it is provided in app-text/dvipng"
+	elog
+}