[pkgsrc/trunk]: pkgsrc Add a patch from PHP's SVN repositry to fix gd library...

[taca <taca%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/7bcd6420caec
branches:  trunk
changeset: 400560:7bcd6420caec
user:      taca <taca%pkgsrc.org@localhost>
date:      Thu Oct 22 14:37:47 2009 +0000

description:
Add a patch from PHP's SVN repositry to fix gd library security problem.

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546

Bump PKGREVISION of php-gd package.
(This fix is for php5 only and I don't know about php4.)

diffstat:

 graphics/php-gd/Makefile   |   4 ++--
 lang/php5/distinfo         |   3 ++-
 lang/php5/patches/patch-ay |  17 +++++++++++++++++
 3 files changed, 21 insertions(+), 3 deletions(-)

diffs (48 lines):

diff -r aec3d5161a1d -r 7bcd6420caec graphics/php-gd/Makefile
--- a/graphics/php-gd/Makefile  Thu Oct 22 13:44:18 2009 +0000
+++ b/graphics/php-gd/Makefile  Thu Oct 22 14:37:47 2009 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.19 2009/08/26 19:57:47 sno Exp $
+# $NetBSD: Makefile,v 1.20 2009/10/22 14:37:47 taca Exp $
 
 MODNAME=               gd
-PKGREVISION=           1
+PKGREVISION=           2
 CATEGORIES+=           graphics
 COMMENT=               PHP extension for GD graphics library
 
diff -r aec3d5161a1d -r 7bcd6420caec lang/php5/distinfo
--- a/lang/php5/distinfo        Thu Oct 22 13:44:18 2009 +0000
+++ b/lang/php5/distinfo        Thu Oct 22 14:37:47 2009 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.67 2009/09/26 07:35:31 taca Exp $
+$NetBSD: distinfo,v 1.68 2009/10/22 14:37:47 taca Exp $
 
 SHA1 (php-5.2.11/php-5.2.11.tar.bz2) = 819c853ce657ef260d4a73b5a21f961115b97eef
 RMD160 (php-5.2.11/php-5.2.11.tar.bz2) = 6aad53dee864ab89f794a9d3c2aa32d435ed5654
@@ -16,3 +16,4 @@
 SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df
 SHA1 (patch-ar) = 2d74ec926cc00bfbb67d16210af78c33ad9ac38d
 SHA1 (patch-as) = f7ce5caffe2acdd1f8e9fc8ae6c7ba1d8c6a25c1
+SHA1 (patch-ay) = c2667dd398c1c58e55f459f2df02613dc028e9cc
diff -r aec3d5161a1d -r 7bcd6420caec lang/php5/patches/patch-ay
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/lang/php5/patches/patch-ay        Thu Oct 22 14:37:47 2009 +0000
@@ -0,0 +1,17 @@
+$NetBSD: patch-ay,v 1.1 2009/10/22 14:37:47 taca Exp $
+
+* Fix for http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546
+  from PHP's SVN repositry r289557.
+
+--- ext/gd/libgd/gd_gd.c.orig  2007-08-09 23:21:38.000000000 +0900
++++ ext/gd/libgd/gd_gd.c
+@@ -39,6 +39,9 @@ int _gdGetColors (gdIOCtx * in, gdImageP
+                       if (!gdGetWord(&im->colorsTotal, in)) {
+                               goto fail1;
+                       }
++                      if (im->colorsTotal > gdMaxColors) {
++                              goto fail1;
++                      }
+               }
+               /* Int to accommodate truecolor single-color transparency */
+               if (!gdGetInt(&im->transparent, in)) {