[pkgsrc/pkgsrc-2020Q4]: pkgsrc/graphics/dia Pullup ticket #6404 - requested b...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/e0e89ec40e93
branches:  pkgsrc-2020Q4
changeset: 445405:e0e89ec40e93
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Fri Jan 22 18:11:31 2021 +0000

description:
Pullup ticket #6404 - requested by gutteridge
graphics/dia: security fix

Revisions pulled up:
- graphics/dia/Makefile                                         1.112
- graphics/dia/distinfo                                         1.36
- graphics/dia/patches/patch-app_app__procs.c                   1.1

---
   Module Name:    pkgsrc
   Committed By:   gutteridge
   Date:           Sat Jan 16 00:25:33 UTC 2021

   Modified Files:
           pkgsrc/graphics/dia: Makefile distinfo
   Added Files:
           pkgsrc/graphics/dia/patches: patch-app_app__procs.c

   Log Message:
   dia: apply an upstream security fix

   Fix endless loop on filenames with invalid encoding (CVE-2019-19451).

diffstat:

 graphics/dia/Makefile                       |   4 ++--
 graphics/dia/distinfo                       |   3 ++-
 graphics/dia/patches/patch-app_app__procs.c |  15 +++++++++++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diffs (47 lines):

diff -r e1a9f26bcdd6 -r e0e89ec40e93 graphics/dia/Makefile
--- a/graphics/dia/Makefile     Fri Jan 22 18:11:23 2021 +0000
+++ b/graphics/dia/Makefile     Fri Jan 22 18:11:31 2021 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.111 2020/11/05 09:08:19 ryoon Exp $
+# $NetBSD: Makefile,v 1.111.2.1 2021/01/22 18:11:31 bsiegert Exp $
 
-PKGREVISION=   20
+PKGREVISION=   21
 .include "Makefile.common"
 
 .include "options.mk"
diff -r e1a9f26bcdd6 -r e0e89ec40e93 graphics/dia/distinfo
--- a/graphics/dia/distinfo     Fri Jan 22 18:11:23 2021 +0000
+++ b/graphics/dia/distinfo     Fri Jan 22 18:11:31 2021 +0000
@@ -1,10 +1,11 @@
-$NetBSD: distinfo,v 1.35 2020/05/01 20:19:23 rillig Exp $
+$NetBSD: distinfo,v 1.35.6.1 2021/01/22 18:11:31 bsiegert Exp $
 
 SHA1 (dia-0.97.3.tar.xz) = 316393951daebd186ba387e1cd6e34160a458c39
 RMD160 (dia-0.97.3.tar.xz) = a984efa1663cc154f4394060af37fab146f99175
 SHA512 (dia-0.97.3.tar.xz) = 34298980be930b87cb4a636344e4cb2a7e43eedc00b0969a5e446cee9b74b616fdc8c798efcb9a5832b98741f2e20632a44037b2bcb436f59591d531ef441efa
 Size (dia-0.97.3.tar.xz) = 5548500 bytes
 SHA1 (patch-aa) = bad171ff4f379030f05c613b362e669a53d7f6da
+SHA1 (patch-app_app__procs.c) = 867ec641d96b30123e15af9faca09a9f66a60993
 SHA1 (patch-app_load_save.c) = 2956f9ad67b8270cd84a8421abbb676af29338f2
 SHA1 (patch-be) = fc6ba43fabefca18188ab0541f4be7f19d9726d6
 SHA1 (patch-ca) = 8737f3ff19244e2f87ffb571da21159bc2248648
diff -r e1a9f26bcdd6 -r e0e89ec40e93 graphics/dia/patches/patch-app_app__procs.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/dia/patches/patch-app_app__procs.c       Fri Jan 22 18:11:31 2021 +0000
@@ -0,0 +1,15 @@
+$NetBSD: patch-app_app__procs.c,v 1.1.2.2 2021/01/22 18:11:31 bsiegert Exp $
+
+Fix endless loop on filenames with invalid encoding (CVE-2019-19451)
+https://gitlab.gnome.org/GNOME/dia/issues/428
+
+--- app/app_procs.c.orig       2014-08-24 15:46:01.000000000 +0000
++++ app/app_procs.c
+@@ -801,6 +801,7 @@ app_init (int argc, char **argv)
+ 
+       if (!filename) {
+         g_print (_("Filename conversion failed: %s\n"), filenames[i]);
++        ++i;
+         continue;
+       }
+