[pkgsrc/pkgsrc-2009Q1]: pkgsrc/graphics/lcms Pullup ticket 2737 - requested b...

[spz <spz%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/d4ae052db9b0
branches:  pkgsrc-2009Q1
changeset: 556774:d4ae052db9b0
user:      spz <spz%pkgsrc.org@localhost>
date:      Fri Apr 17 07:50:06 2009 +0000

description:
Pullup ticket 2737 - requested by tron
Security fix

Revisions pulled up:
- pkgsrc/graphics/lcms/Makefile                 1.29
- pkgsrc/graphics/lcms/distinfo                 1.20
- pkgsrc/graphics/lcms/patches/patch-aa         1.10

   Module Name: pkgsrc
   Committed By:        tron
   Date:                Tue Apr 14 18:54:38 UTC 2009

   Modified Files:
        pkgsrc/graphics/lcms: Makefile distinfo
   Added Files:
        pkgsrc/graphics/lcms/patches: patch-aa

   Log Message:
   Add patch for the security vulnerability reported in SA34634/CVE-2009-0793
   taken from Redhat's Bugzilla.


   To generate a diff of this commit:
   cvs rdiff -u -r1.28 -r1.29 pkgsrc/graphics/lcms/Makefile
   cvs rdiff -u -r1.19 -r1.20 pkgsrc/graphics/lcms/distinfo
   cvs rdiff -u -r0 -r1.10 pkgsrc/graphics/lcms/patches/patch-aa

diffstat:

 graphics/lcms/Makefile         |   4 ++--
 graphics/lcms/distinfo         |   3 ++-
 graphics/lcms/patches/patch-aa |  28 ++++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

diffs (56 lines):

diff -r ea9405d7aece -r d4ae052db9b0 graphics/lcms/Makefile
--- a/graphics/lcms/Makefile    Thu Apr 16 21:56:37 2009 +0000
+++ b/graphics/lcms/Makefile    Fri Apr 17 07:50:06 2009 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.28 2009/03/22 18:17:15 gdt Exp $
+# $NetBSD: Makefile,v 1.28.2.1 2009/04/17 07:50:06 spz Exp $
 
 DISTNAME=      lcms-1.18
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    graphics
 MASTER_SITES=  http://www.littlecms.com/
 
diff -r ea9405d7aece -r d4ae052db9b0 graphics/lcms/distinfo
--- a/graphics/lcms/distinfo    Thu Apr 16 21:56:37 2009 +0000
+++ b/graphics/lcms/distinfo    Fri Apr 17 07:50:06 2009 +0000
@@ -1,5 +1,6 @@
-$NetBSD: distinfo,v 1.19 2009/03/22 18:17:15 gdt Exp $
+$NetBSD: distinfo,v 1.19.2.1 2009/04/17 07:50:06 spz Exp $
 
 SHA1 (lcms-1.18.tar.gz) = 7001badb14b2e9cb89e2637bdc56f23ebff2d40e
 RMD160 (lcms-1.18.tar.gz) = 76c37ac029f733bbb9a850234e62bfd2a4a04bf4
 Size (lcms-1.18.tar.gz) = 915536 bytes
+SHA1 (patch-aa) = f28cf7682b8731d8729058a51ad6d5ccc86ba1c6
diff -r ea9405d7aece -r d4ae052db9b0 graphics/lcms/patches/patch-aa
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/lcms/patches/patch-aa    Fri Apr 17 07:50:06 2009 +0000
@@ -0,0 +1,28 @@
+$NetBSD: patch-aa,v 1.11.2.2 2009/04/17 07:50:07 spz Exp $
+
+Patch for SA34634/CVE-2009-0793 taken for Redhat's Bugzilla:
+
+https://bugzilla.redhat.com/attachment.cgi?id=337279
+
+--- src/cmsxform.c.orig        2009-03-21 15:31:52.000000000 +0000
++++ src/cmsxform.c     2009-04-14 19:18:05.000000000 +0100
+@@ -660,6 +660,9 @@
+                 GrayTRC = cmsReadICCGamma(hProfile, icSigGrayTRCTag);
+                 FromLstarToXYZ(GrayTRC, Shapes1);
+ 
++              if (GrayTRC == NULL)
++                      return NULL;
++
+                 // Reversing must be done after curve translation
+ 
+                 Shapes[0] = cmsReverseGamma(Shapes1[0]->nEntries, Shapes1[0]);
+@@ -675,6 +678,9 @@
+ 
+                 GrayTRC = cmsReadICCGammaReversed(hProfile, icSigGrayTRCTag);   // Y
+ 
++              if (GrayTRC == NULL)
++                      return NULL;
++
+                 Shapes[0] = cmsDupGamma(GrayTRC);
+                 Shapes[1] = cmsDupGamma(GrayTRC);
+                 Shapes[2] = cmsDupGamma(GrayTRC);