[pkgsrc/pkgsrc-2017Q1]: pkgsrc/multimedia/vlc Pullup ticket #5467 - requested...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/821b871d11ae
branches:  pkgsrc-2017Q1
changeset: 360408:821b871d11ae
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Mon Jun 05 09:11:04 2017 +0000

description:
Pullup ticket #5467 - requested by sevan
multimedia/vlc: security fix

Revisions pulled up:
- multimedia/vlc/Makefile                                       1.202-1.203
- multimedia/vlc/PLIST                                          1.60
- multimedia/vlc/distinfo                                       1.73-1.74
- multimedia/vlc/patches/patch-compat_Makefile.in               1.3
- multimedia/vlc/patches/patch-configure                        1.8
- multimedia/vlc/patches/patch-include_vlc_atomic.h             1.3
- multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp          deleted

---
   Module Name:    pkgsrc
   Committed By:   jperkin
   Date:           Mon May 15 11:10:00 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: Makefile PLIST

   Log Message:
   Add a cdrom PLIST var and unset it on SunOS as the native cdio interface
   is unsupported.

---
   Module Name:    pkgsrc
   Committed By:   jperkin
   Date:           Mon May 15 11:11:35 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: distinfo
   Added Files:
           pkgsrc/multimedia/vlc/patches: patch-configure

   Log Message:
   Remove bogus exclusion of SunOS MMX/SSE2 support.

---
   Module Name:    pkgsrc
   Committed By:   maya
   Date:           Fri May 26 13:26:37 UTC 2017

   Modified Files:
           pkgsrc/multimedia/vlc: Makefile distinfo
           pkgsrc/multimedia/vlc/patches: patch-compat_Makefile.in
               patch-include_vlc_atomic.h
   Removed Files:
           pkgsrc/multimedia/vlc/patches: patch-modules_gui_qt4_qt4.hpp

   Log Message:
   vlc: update to 2.2.6.

   Includes significant security fixes allowing code execution via
   a crafted subtitles file (fixes CVE-2017-8310, CVE-2017-8311,
   CVE-2017-8312, CVE-2017-8313)

   pkgsrc changes:
   pull in <atomic> in a C++11 case rather than clang case,
   it's a C++11 header. however I couldn't build with -std=c++11 for
   other reasons.

   it builds and runs clang 4.0, but the mkv plugin dies on an
   undefined reference.

   Changes between 2.2.5.1 and 2.2.6:
   ----------------------------------

   Video output:
    * Fix systematic green line on nvidia
    * Fix direct3d SPU texture offsets handling

   Demuxer:
    * Fix heap buffer overflows

   Changes between 2.2.5 and 2.2.5.1:
   ----------------------------------

   Security hardening for DLL hijacking environments

   Translations updates

   Misc:
    * Update for Soundcloud, liveleak and Youtube scripts
    * Fix potential out-of-band dereference in flac decoder
    * Fix potential out-of-band reads in mpeg packetizers
    * Fix infinite loop in subtitles demuxer
    * Fix incorrect memory free in ogg demuxer
    * Fix potential out-of-band reads in subtitle decoders and demuxers
    * Fix green line on Windows with odd sizes

   Changes between 2.2.4 and 2.2.5:
   --------------------------------

   Decoder:
    * Fix mp3 playback quality regression in libmad
    * Fix video scaling in VDPAU
    * Fix playback of palettized codecs
    * Fix ADPCM heap corruption (FG-VD-16-067)
    * Fix AES3 16bps decoding
    * Fix DVD/LPCM heap corruption (FG-VD-16-090)
    * Fix SCTE-27 colors

   Demuxer:
    * Fix possible ASF integer overflow
    * Fix MP4, VOC, XA, SMF divide-by-zero errors
    * Fix MP4 heap buffer overflows
    * Fix Flac metadata integer overflow
    * Fix NSVf and AIFF infinite loops
    * Fix flac null-pointer dereference
    * Fix vorbis and opus comments integer overflows and leaks

   Video output:
    * Fix green line on Windows with AMD drivers
    * Fix screenshots size

   Access:
    * Fix crash in screen recording on Windows
    * Fix FTP scan string injection
    * Fix HTTP size handling

   Mux:
    * Fix mp4 drift

   Lua:
    * Fix vimeo, youtube, dailymotion, cli, appletrailers, http,
      soundcloud scripts

   Audio filter:
    * Fix heap write in stereo_widen audio filter

   Windows:
    * The plugins loading will not load external DLLs by default.
      Plugins will need to LoadLibrary explicitely.
    * Fix uninstaller path handling
    * Fix taskbar buttons behavior

   MacOS:
    * Fix scrolling sensitivity on Sierra
    * Resume points are deleted now if the user clears the list of
      recent items

diffstat:

 multimedia/vlc/Makefile                              |  13 ++++--
 multimedia/vlc/PLIST                                 |   6 +-
 multimedia/vlc/distinfo                              |  16 ++++----
 multimedia/vlc/patches/patch-compat_Makefile.in      |  35 +++++++++----------
 multimedia/vlc/patches/patch-configure               |  24 +++++++++++++
 multimedia/vlc/patches/patch-include_vlc_atomic.h    |   8 ++--
 multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp |  15 --------
 7 files changed, 63 insertions(+), 54 deletions(-)

diffs (283 lines):

diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/Makefile
--- a/multimedia/vlc/Makefile   Mon Jun 05 09:02:20 2017 +0000
+++ b/multimedia/vlc/Makefile   Mon Jun 05 09:11:04 2017 +0000
@@ -1,13 +1,12 @@
-# $NetBSD: Makefile,v 1.201 2017/03/01 09:02:48 wiz Exp $
+# $NetBSD: Makefile,v 1.201.2.1 2017/06/05 09:11:04 bsiegert Exp $
 
 DISTNAME=              vlc-${VLC_VERSION}
-PKGREVISION=           6
 CATEGORIES=            multimedia
 MASTER_SITES=          ${MASTER_SITE_SOURCEFORGE:=vlc/}
 MASTER_SITES+=         http://download.videolan.org/pub/videolan/vlc/${VLC_VERSION}/
 EXTRACT_SUFX=          .tar.xz
 
-VLC_VERSION=           2.2.4
+VLC_VERSION=           2.2.6
 
 MAINTAINER=            pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=              http://www.videolan.org/
@@ -24,7 +23,7 @@
 CONFIGURE_ARGS+=       --with-kde-solid=${PREFIX}/share/kde/apps/solid/actions
 PTHREAD_OPTS+=         require
 USE_LANGUAGES=         c99 c++
-PLIST_VARS+=           x86simd altivec v4l2 oss
+PLIST_VARS+=           altivec cdrom oss v4l2 x86simd
 
 .include "../../mk/bsd.prefs.mk"
 .include "options.mk"
@@ -62,7 +61,6 @@
 CONFIGURE_ARGS+=       --disable-vsxu
 CONFIGURE_ARGS+=       --disable-zvbi
 
-
 CFLAGS+=               -fPIC
 CXXFLAGS+=             -fPIC
 
@@ -85,6 +83,11 @@
 CONFIGURE_ARGS+=       --enable-altivec
 .endif
 
+# SunOS cdio interface is unsupported
+.if ${OPSYS} != "SunOS"
+PLIST.cdrom=           yes
+.endif
+
 # Enable when cleanly builds
 .if exists(/usr/include/linux/videodev2.h) # || exists(/usr/include/sys/videoio.h)
 CONFIGURE_ARGS+=       --enable-v4l2
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/PLIST
--- a/multimedia/vlc/PLIST      Mon Jun 05 09:02:20 2017 +0000
+++ b/multimedia/vlc/PLIST      Mon Jun 05 09:11:04 2017 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.59 2017/03/01 10:42:30 maya Exp $
+@comment $NetBSD: PLIST,v 1.59.2.1 2017/06/05 09:11:04 bsiegert Exp $
 bin/cvlc
 ${PLIST.x11}bin/qvlc
 bin/rvlc
@@ -104,7 +104,7 @@
 ${PLIST.oss}lib/vlc/plugins/access/libaccess_oss_plugin.la
 lib/vlc/plugins/access/libattachment_plugin.la
 lib/vlc/plugins/access/libavio_plugin.la
-lib/vlc/plugins/access/libcdda_plugin.la
+${PLIST.cdrom}lib/vlc/plugins/access/libcdda_plugin.la
 lib/vlc/plugins/access/libdvdnav_plugin.la
 lib/vlc/plugins/access/libdvdread_plugin.la
 lib/vlc/plugins/access/libfilesystem_plugin.la
@@ -122,7 +122,7 @@
 lib/vlc/plugins/access/libtcp_plugin.la
 lib/vlc/plugins/access/libtimecode_plugin.la
 lib/vlc/plugins/access/libudp_plugin.la
-lib/vlc/plugins/access/libvcd_plugin.la
+${PLIST.cdrom}lib/vlc/plugins/access/libvcd_plugin.la
 lib/vlc/plugins/access/libvdr_plugin.la
 ${PLIST.x11}lib/vlc/plugins/access/libxcb_screen_plugin.la
 lib/vlc/plugins/access/libzip_plugin.la
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/distinfo
--- a/multimedia/vlc/distinfo   Mon Jun 05 09:02:20 2017 +0000
+++ b/multimedia/vlc/distinfo   Mon Jun 05 09:11:04 2017 +0000
@@ -1,15 +1,16 @@
-$NetBSD: distinfo,v 1.71.6.1 2017/06/05 09:01:01 bsiegert Exp $
+$NetBSD: distinfo,v 1.71.6.2 2017/06/05 09:11:04 bsiegert Exp $
 
-SHA1 (vlc-2.2.4.tar.xz) = ec171b0ad731d9d114540cd7b7fcb41fc3293696
-RMD160 (vlc-2.2.4.tar.xz) = 2fe178bb9a4b2ad5ca0294d3e52ceb992b22e8ee
-SHA512 (vlc-2.2.4.tar.xz) = 2fc1fe957ba7903f2e0c9640884ed850cb10a60132d80658dee8da0b5abaf4a6ccdf95fa2b8c0a4a827be5e7e40341318bce44662a5248e04442f4779010f85c
-Size (vlc-2.2.4.tar.xz) = 22199316 bytes
+SHA1 (vlc-2.2.6.tar.xz) = d299dce6a5c94af4292657b6cb99c44654024f70
+RMD160 (vlc-2.2.6.tar.xz) = b2727834bcbbf0d274e3a0b4a3317f3b914f9ad4
+SHA512 (vlc-2.2.6.tar.xz) = 9aff5922eb8b3c6a24e6153c367b0170dbc67602ae3e9304f52d2da00c9081d66cc98abd722b7c95b6c7d2e6cc7c86f21f9cba42c7d4bf29ca97d0f2d3553f8d
+Size (vlc-2.2.6.tar.xz) = 22198720 bytes
 SHA1 (patch-bin_override.c) = 0190b65ec29ccdb7ef89d7c6af74a6bfdfc17076
 SHA1 (patch-compat_Makefile.am) = 983e9e29380702326d114274db99af72b5bdb3dd
-SHA1 (patch-compat_Makefile.in) = 640cd0ae1bb653f02b3780ee3617807399b6bb3f
+SHA1 (patch-compat_Makefile.in) = d520534929290864ee30a286633f8ae118106ae1
+SHA1 (patch-configure) = 90cdfc62aa0bbc68ec76758ca0acdcb13dbfe56d
 SHA1 (patch-include_vlc__common.h) = 26ab2c96230e3fbe26dd4bce60db7c5331eb3f6c
 SHA1 (patch-include_vlc__fixups.h) = 1a9f58b70f43fb87381d75d856682e3bcad14f6c
-SHA1 (patch-include_vlc_atomic.h) = 5d6d3cbe75695505588b9dd354672d70d568360a
+SHA1 (patch-include_vlc_atomic.h) = 3f3acc51e2e3645951b8c39c2cf61dab6c7d756d
 SHA1 (patch-modules_access_directory.c) = 95bc95cb7eb0bf44684c04d2cecc2c4e8339f0f7
 SHA1 (patch-modules_access_file.c) = 22eb568aa5a1fea765e65a770432282024baaaf1
 SHA1 (patch-modules_access_rtp_Makefile.am) = cd2c1bcbde8fc04c15f4030ff8708e32b800dd53
@@ -22,7 +23,6 @@
 SHA1 (patch-modules_gui_qt4_input__manager.hpp) = ccc5f5fd53942f168e95d472731ee3f6a4d8ddb0
 SHA1 (patch-modules_gui_qt4_main__interface.cpp) = 11b9600a6e3c11268afc7c38859c5b62a1e8ee0d
 SHA1 (patch-modules_gui_qt4_main__interface.hpp) = 1c3028519662d99c023375c5ee74e9f490c16f3c
-SHA1 (patch-modules_gui_qt4_qt4.hpp) = 7189de990c0eb30850458e156da950eccb0a558f
 SHA1 (patch-modules_gui_qt4_util_input__slider.cpp) = 17aa058d6a7fd5b006b063bdf78cee3302733811
 SHA1 (patch-modules_gui_qt4_util_input__slider.hpp) = 146f2a2e5a9fc70b7aaefefd859a59cb39555e6a
 SHA1 (patch-modules_gui_skins2_src_theme__loader.cpp) = cbf1dfa33aa89bbb9382b789d77f6eea69d85b04
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/patches/patch-compat_Makefile.in
--- a/multimedia/vlc/patches/patch-compat_Makefile.in   Mon Jun 05 09:02:20 2017 +0000
+++ b/multimedia/vlc/patches/patch-compat_Makefile.in   Mon Jun 05 09:11:04 2017 +0000
@@ -1,10 +1,10 @@
-$NetBSD: patch-compat_Makefile.in,v 1.2 2016/08/31 09:23:58 wiz Exp $
+$NetBSD: patch-compat_Makefile.in,v 1.2.6.1 2017/06/05 09:11:04 bsiegert Exp $
 
 See comment on patch_compat_Makefile.am.
 
---- compat/Makefile.in.orig    2016-05-31 16:56:35.000000000 +0000
+--- compat/Makefile.in.orig    2017-05-24 12:55:21.000000000 +0000
 +++ compat/Makefile.in
-@@ -132,7 +132,7 @@ am__uninstall_files_from_dir = { \
+@@ -135,7 +135,7 @@ am__uninstall_files_from_dir = { \
           $(am__cd) "$$dir" && rm -f $$files; }; \
    }
  am__installdirs = "$(DESTDIR)$(pkglibdir)"
@@ -13,7 +13,7 @@
  libcompat_la_DEPENDENCIES = $(LTLIBOBJS)
  am_libcompat_la_OBJECTS = dummy.lo
  libcompat_la_OBJECTS = $(am_libcompat_la_OBJECTS)
-@@ -983,10 +983,10 @@ top_builddir = @top_builddir@
+@@ -995,10 +995,10 @@ top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
  vlcdatadir = @vlcdatadir@
  vlclibdir = @vlclibdir@
@@ -26,7 +26,7 @@
  BUILT_SOURCES = dummy.c
  CLEANFILES = dummy.c
  all: $(BUILT_SOURCES)
-@@ -1025,33 +1025,9 @@ $(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(
+@@ -1036,33 +1036,9 @@ $(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(
        cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
  $(am__aclocal_m4_deps):
  
@@ -63,7 +63,7 @@
        locs=`for p in $$list; do echo $$p; done | \
              sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
              sort -u`; \
-@@ -1061,7 +1037,7 @@ clean-pkglibLTLIBRARIES:
+@@ -1072,7 +1048,7 @@ clean-pkglibLTLIBRARIES:
        }
  
  libcompat.la: $(libcompat_la_OBJECTS) $(libcompat_la_DEPENDENCIES) $(EXTRA_libcompat_la_DEPENDENCIES) 
@@ -72,7 +72,7 @@
  
  mostlyclean-compile:
        -rm -f *.$(OBJEXT)
-@@ -1218,9 +1194,6 @@ check: $(BUILT_SOURCES)
+@@ -1229,9 +1205,6 @@ check: $(BUILT_SOURCES)
        $(MAKE) $(AM_MAKEFLAGS) check-am
  all-am: Makefile $(LTLIBRARIES)
  installdirs:
@@ -82,7 +82,7 @@
  install: $(BUILT_SOURCES)
        $(MAKE) $(AM_MAKEFLAGS) install-am
  install-exec: install-exec-am
-@@ -1256,7 +1229,7 @@ maintainer-clean-generic:
+@@ -1267,7 +1240,7 @@ maintainer-clean-generic:
        -test -z "$(BUILT_SOURCES)" || rm -f $(BUILT_SOURCES)
  clean: clean-am
  
@@ -91,7 +91,7 @@
        mostlyclean-am
  
  distclean: distclean-am
-@@ -1283,7 +1256,7 @@ install-dvi: install-dvi-am
+@@ -1294,7 +1267,7 @@ install-dvi: install-dvi-am
  
  install-dvi-am:
  
@@ -100,7 +100,7 @@
  
  install-html: install-html-am
  
-@@ -1323,24 +1296,23 @@ ps: ps-am
+@@ -1334,24 +1307,23 @@ ps: ps-am
  
  ps-am:
  
@@ -119,16 +119,13 @@
        install-exec-am install-html install-html-am install-info \
        install-info-am install-man install-pdf install-pdf-am \
 -      install-pkglibLTLIBRARIES install-ps install-ps-am \
--      install-strip installcheck installcheck-am installdirs \
--      maintainer-clean maintainer-clean-generic mostlyclean \
--      mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
++      install-ps install-ps-am \
+       install-strip installcheck installcheck-am installdirs \
+       maintainer-clean maintainer-clean-generic mostlyclean \
+       mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
 -      pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \
 -      uninstall-pkglibLTLIBRARIES
-+      install-ps install-ps-am install-strip installcheck \
-+      installcheck-am installdirs maintainer-clean \
-+      maintainer-clean-generic mostlyclean mostlyclean-compile \
-+      mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
-+      tags tags-am uninstall uninstall-am
++      pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am
  
+ .PRECIOUS: Makefile
  
- dummy.c:
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/patches/patch-configure
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/multimedia/vlc/patches/patch-configure    Mon Jun 05 09:11:04 2017 +0000
@@ -0,0 +1,24 @@
+$NetBSD: patch-configure,v 1.8.2.2 2017/06/05 09:11:04 bsiegert Exp $
+
+Remove bogus Solaris exclusion.
+
+--- configure.orig     2016-05-31 16:56:33.000000000 +0000
++++ configure
+@@ -26281,7 +26281,7 @@ fi
+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sse_inline" >&5
+ $as_echo "$ac_cv_sse_inline" >&6; }
+ 
+-  if test "${ac_cv_sse_inline}" != "no" -a "${SYS}" != "solaris"; then :
++  if test "${ac_cv_sse_inline}" != "no"; then :
+ 
+ 
+ $as_echo "#define CAN_COMPILE_SSE 1" >>confdefs.h
+@@ -26324,7 +26324,7 @@ rm -f core conftest.err conftest.$ac_obj
+ fi
+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sse2_inline" >&5
+ $as_echo "$ac_cv_sse2_inline" >&6; }
+-  if test "${ac_cv_sse2_inline}" != "no" -a "${SYS}" != "solaris"; then :
++  if test "${ac_cv_sse2_inline}" != "no"; then :
+ 
+ 
+ $as_echo "#define CAN_COMPILE_SSE2 1" >>confdefs.h
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/patches/patch-include_vlc_atomic.h
--- a/multimedia/vlc/patches/patch-include_vlc_atomic.h Mon Jun 05 09:02:20 2017 +0000
+++ b/multimedia/vlc/patches/patch-include_vlc_atomic.h Mon Jun 05 09:11:04 2017 +0000
@@ -1,7 +1,7 @@
-$NetBSD: patch-include_vlc_atomic.h,v 1.1.12.1 2017/06/05 09:01:01 bsiegert Exp $
+$NetBSD: patch-include_vlc_atomic.h,v 1.1.12.2 2017/06/05 09:11:04 bsiegert Exp $
 
-clang ships everything we need, just use <atomic> instead of the
-vlc_atomic.h #ifdef maze.
+C++11 ships everything we need, just use <atomic> instead
+of the vlc_atomic.h #ifdef maze.
 
 --- include/vlc_atomic.h.orig  2015-02-02 19:42:28.000000000 +0000
 +++ include/vlc_atomic.h
@@ -9,7 +9,7 @@
  /*** Native C11 atomics ***/
  #  include <stdatomic.h>
  
-+#elif defined(__cplusplus) && defined(__clang__)
++#elif defined(__cplusplus) && (__cplusplus >= 201103L)
 +#include <atomic>
 +using std::atomic_uint_least32_t;
 +using std::atomic_uintptr_t;
diff -r 01950238b865 -r 821b871d11ae multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp
--- a/multimedia/vlc/patches/patch-modules_gui_qt4_qt4.hpp      Mon Jun 05 09:02:20 2017 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,15 +0,0 @@
-$NetBSD: patch-modules_gui_qt4_qt4.hpp,v 1.1 2015/11/01 20:15:06 tnn Exp $
-
-We need to include vlc_atomic.h early. Something pulls it in later with
-C linkage and that makes clang sad (#include <atomic> needs C++ linkage).
-
---- modules/gui/qt4/qt4.hpp.orig       2014-11-16 18:57:59.000000000 +0000
-+++ modules/gui/qt4/qt4.hpp
-@@ -29,6 +29,7 @@
- # include "config.h"
- #endif
- 
-+#include <vlc_atomic.h>
- #include <vlc_common.h>    /* VLC_COMMON_MEMBERS for vlc_interface.h */
- #include <vlc_interface.h> /* intf_thread_t */
- #include <vlc_playlist.h>  /* playlist_t */