integer overflow vulnerability fix, #69624

7 files changed, 189 insertions, 13 deletions

diff --git a/app-office/koffice/ChangeLog b/app-office/koffice/ChangeLog
index a7e2e8d5730a..a2afc4c86d03 100644
--- a/app-office/koffice/ChangeLog
+++ b/app-office/koffice/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-office/koffice
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.66 2004/10/27 16:14:05 kugelfang Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.67 2004/10/31 17:02:45 carlo Exp $
+
+*koffice-1.3.3-r2 (31 Oct 2004)
+
+  31 Oct 2004; Carsten Lohrke <carlo@gentoo.org>
+  +files/koffice_1_3_4_xpdf_security_integer_overflow.diff,
+  +koffice-1.3.3-r2.ebuild, +koffice-1.3.4-r1.ebuild:
+  integer overflow vulnerability fix, #69624
 
   27 Oct 2004; Danny van Dyk <kugelfang@gentoo.org> koffice-1.3.3-r1.ebuild:
   Marked stable on amd64.
diff --git a/app-office/koffice/Manifest b/app-office/koffice/Manifest
index eb510bce34dc..c57bafee4344 100644
--- a/app-office/koffice/Manifest
+++ b/app-office/koffice/Manifest
@@ -1,21 +1,26 @@
-MD5 d9f37db32ae55b169d9b81fbf7379606 ChangeLog 9640
 MD5 82d58e79457d600e2e1eb47c83d9fb8d koffice-1.2.1-r1.ebuild 875
+MD5 34f7549e21bc2d8612040c5c04e809a7 koffice-1.3.4.ebuild 889
 MD5 f073cce5ca5665ca1e11d32d285374aa koffice-1.3.ebuild 863
-MD5 3567b0f5f53ad3a98e67fe21ecb23624 metadata.xml 225
-MD5 d93d51a8cdb431412e647dbd9f682a7f koffice-1.3.1-r1.ebuild 957
 MD5 a25f74f8d4bf4f7d759946f34ddf8ddc koffice-1.3.1.ebuild 875
-MD5 dc5570e8c4a82410322a3b38decfabfe koffice-1.3.2.ebuild 886
-MD5 1d63dc21b804a94fdcf3d79d07b74a62 koffice-1.3.3-r1.ebuild 1079
+MD5 d93d51a8cdb431412e647dbd9f682a7f koffice-1.3.1-r1.ebuild 957
+MD5 502b3ec872c89fcffb1a03d3ebb5ffe6 koffice-1.3.3-r2.ebuild 1046
 MD5 44c793c4d545dfc597b841f02f57830c koffice-1.3.3.ebuild 889
-MD5 34f7549e21bc2d8612040c5c04e809a7 koffice-1.3.4.ebuild 889
-MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1 68
-MD5 75c9f696b717a82bf663b4c545be66d2 files/digest-koffice-1.2.1-r1 67
-MD5 65a32b814eb23f48f2392f1ae13ac167 files/digest-koffice-1.3 66
+MD5 d595a809fb14a9858f7368fa799b335a koffice-1.3.4-r1.ebuild 892
+MD5 1d63dc21b804a94fdcf3d79d07b74a62 koffice-1.3.3-r1.ebuild 1079
+MD5 e85ce8dea88947de91d3c7253b8c10ee ChangeLog 9882
+MD5 3567b0f5f53ad3a98e67fe21ecb23624 metadata.xml 225
+MD5 dc5570e8c4a82410322a3b38decfabfe koffice-1.3.2.ebuild 886
+MD5 3b1ec49bae2cb0bcdd35223574324335 files/koffice-1.3.1-gcc34.patch 482
+MD5 20d32402fa6f6883dccb63cf1826a15f files/koffice_1_3_4_xpdf_security_integer_overflow.diff 3393
 MD5 bd89862f0c15396ad54e30a1c9f2f5d9 files/koffice-1.2.1-kword-crashes.diff 3840
-MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1-r1 68
+MD5 65a32b814eb23f48f2392f1ae13ac167 files/digest-koffice-1.3 66
+MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1 68
 MD5 b2943ad7ba97995a7a1932a702250a67 files/digest-koffice-1.3.2 68
-MD5 3b1ec49bae2cb0bcdd35223574324335 files/koffice-1.3.1-gcc34.patch 482
 MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3 68
-MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3-r1 68
 MD5 d261da2eaab2f46cd2f06609e5f41885 files/digest-koffice-1.3.4 68
+MD5 75c9f696b717a82bf663b4c545be66d2 files/digest-koffice-1.2.1-r1 67
+MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1-r1 68
+MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3-r1 68
+MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3-r2 68
+MD5 d261da2eaab2f46cd2f06609e5f41885 files/digest-koffice-1.3.4-r1 68
 MD5 4736559193af7398788799098e16c3c8 files/xpdf-CESA-2004-007-xpdf2-newer.diff 2828
diff --git a/app-office/koffice/files/digest-koffice-1.3.3-r2 b/app-office/koffice/files/digest-koffice-1.3.3-r2
new file mode 100644
index 000000000000..8c8f121cb5f5
--- /dev/null
+++ b/app-office/koffice/files/digest-koffice-1.3.3-r2
@@ -0,0 +1 @@
+MD5 2c3b745c6218a9dc9b3f60edea2dca2b koffice-1.3.3.tar.bz2 10739168
diff --git a/app-office/koffice/files/digest-koffice-1.3.4-r1 b/app-office/koffice/files/digest-koffice-1.3.4-r1
new file mode 100644
index 000000000000..27aee10e0979
--- /dev/null
+++ b/app-office/koffice/files/digest-koffice-1.3.4-r1
@@ -0,0 +1 @@
+MD5 79896426542b0cf07e2e15f84946905a koffice-1.3.4.tar.bz2 10765924
diff --git a/app-office/koffice/files/koffice_1_3_4_xpdf_security_integer_overflow.diff b/app-office/koffice/files/koffice_1_3_4_xpdf_security_integer_overflow.diff
new file mode 100644
index 000000000000..449806bd4fdb
--- /dev/null
+++ b/app-office/koffice/files/koffice_1_3_4_xpdf_security_integer_overflow.diff
@@ -0,0 +1,90 @@
+Index: Catalog.cc
+===================================================================
+RCS file: /home/kde/koffice/filters/kword/pdf/xpdf/xpdf/Catalog.cc,v
+retrieving revision 1.1.2.1
+retrieving revision 1.1.2.4
+diff -u -p -r1.1.2.1 -r1.1.2.4
+--- filters/kword/pdf/xpdf/xpdf/Catalog.cc	22 Oct 2004 12:13:56 -0000	1.1.2.1
++++ filters/kword/pdf/xpdf/xpdf/Catalog.cc	30 Oct 2004 16:43:47 -0000	1.1.2.4
+@@ -12,6 +12,7 @@
+ #pragma implementation
+ #endif
+ 
++#include <limits.h>
+ #include <stddef.h>
+ #include "gmem.h"
+ #include "Object.h"
+@@ -63,8 +64,8 @@ Catalog::Catalog(XRef *xrefA) {
+   }
+   pagesSize = numPages0 = obj.getInt();
+   obj.free();
+-  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+-      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++  if ((unsigned) pagesSize >= INT_MAX / sizeof(Page *) ||
++      (unsigned) pagesSize >= INT_MAX / sizeof(Ref)) {
+     error(-1, "Invalid 'pagesSize'");
+     ok = gFalse;
+     return;
+@@ -196,8 +197,8 @@ int Catalog::readPageTree(Dict *pagesDic
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
+-        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+-            pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++        if ((unsigned) pagesSize >= INT_MAX / sizeof(Page *) ||
++            (unsigned) pagesSize >= INT_MAX / sizeof(Ref)) {
+           error(-1, "Invalid 'pagesSize' parameter.");
+           goto err3;
+         }
+Index: XRef.cc
+===================================================================
+RCS file: /home/kde/koffice/filters/kword/pdf/xpdf/xpdf/XRef.cc,v
+retrieving revision 1.1.2.1
+retrieving revision 1.1.2.4
+diff -u -p -r1.1.2.1 -r1.1.2.4
+--- filters/kword/pdf/xpdf/xpdf/XRef.cc	22 Oct 2004 12:13:56 -0000	1.1.2.1
++++ filters/kword/pdf/xpdf/xpdf/XRef.cc	30 Oct 2004 16:43:47 -0000	1.1.2.4
+@@ -12,6 +12,7 @@
+ #pragma implementation
+ #endif
+ 
++#include <limits.h>
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
+@@ -76,7 +77,7 @@ XRef::XRef(BaseStream *strA, GString *ow
+ 
+   // trailer is ok - read the xref table
+   } else {
+-    if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++    if ((unsigned) size >= INT_MAX / sizeof(XRefEntry)) {
+       error(-1, "Invalid 'size' inside xref table.");
+       ok = gFalse;
+       errCode = errDamaged;
+@@ -273,7 +274,7 @@ GBool XRef::readXRef(Guint *pos) {
+     // table size
+     if (first + n > size) {
+       newSize = size + 256;
+-      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++      if ((unsigned) newSize >= INT_MAX / sizeof(XRefEntry)) {
+         error(-1, "Invalid 'newSize'");
+         goto err2;
+       }
+@@ -420,7 +421,7 @@ GBool XRef::constructXRef() {
+ 	    if (!strncmp(p, "obj", 3)) {
+ 	      if (num >= size) {
+ 		newSize = (num + 1 + 255) & ~255;
+-	        if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++	        if ((unsigned) newSize >= INT_MAX / sizeof(XRefEntry)) {
+ 	          error(-1, "Invalid 'obj' parameters.");
+ 	          return gFalse;
+ 	        }
+@@ -445,7 +446,7 @@ GBool XRef::constructXRef() {
+     } else if (!strncmp(p, "endstream", 9)) {
+       if (streamEndsLen == streamEndsSize) {
+ 	streamEndsSize += 64;
+-        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
++        if ((unsigned) streamEndsSize >= INT_MAX / sizeof(int)) {
+           error(-1, "Invalid 'endstream' parameter.");
+           return gFalse;
+         }
diff --git a/app-office/koffice/koffice-1.3.3-r2.ebuild b/app-office/koffice/koffice-1.3.3-r2.ebuild
new file mode 100644
index 000000000000..5f2f0d102c31
--- /dev/null
+++ b/app-office/koffice/koffice-1.3.3-r2.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/koffice-1.3.3-r2.ebuild,v 1.1 2004/10/31 17:02:45 carlo Exp $
+
+inherit kde eutils
+
+# TODO : mysql support
+# other refs from configure: jasper, qt-docs, doxygen, libxml2, libxslt, freetype, fontconfig, qt being built with sql support (???)
+
+DESCRIPTION="A free, integrated office suite for KDE, the K Desktop Environment."
+HOMEPAGE="http://www.koffice.org/"
+SRC_URI="mirror://kde/stable/${P}/src/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2"
+KEYWORDS="x86 ~amd64 ~ppc ~sparc ~alpha ~ppc64"
+
+IUSE=""
+SLOT="0"
+
+DEPEND=">=dev-lang/python-2.2.1
+	>=media-libs/libart_lgpl-2.3.9
+	>=media-gfx/imagemagick-5.4.5
+	>=app-text/wv2-0.1.8
+	dev-util/pkgconfig"
+need-kde 3.1
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/xpdf-CESA-2004-007-xpdf2-newer.diff
+	epatch ${FILESDIR}/koffice_1_3_4_xpdf_security_integer_overflow.diff
+}
+
+src_compile() {
+	export LIBPYTHON="`python-config --libs`"
+	use arts || DO_NOT_COMPILE="$DO_NOT_COMPILE kpresenter"
+	export DO_NOT_COMPILE="$DO_NOT_COMPILE"
+	kde_src_compile
+}
diff --git a/app-office/koffice/koffice-1.3.4-r1.ebuild b/app-office/koffice/koffice-1.3.4-r1.ebuild
new file mode 100644
index 000000000000..b3e8c8428bec
--- /dev/null
+++ b/app-office/koffice/koffice-1.3.4-r1.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/koffice-1.3.4-r1.ebuild,v 1.1 2004/10/31 17:02:45 carlo Exp $
+
+inherit kde eutils
+
+# TODO : mysql support
+# other refs from configure: jasper, qt-docs, doxygen, libxml2, libxslt, freetype, fontconfig, qt being built with sql support (???)
+
+DESCRIPTION="A free, integrated office suite for KDE, the K Desktop Environment."
+HOMEPAGE="http://www.koffice.org/"
+SRC_URI="mirror://kde/stable/${P}/src/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2"
+KEYWORDS="~x86 ~amd64 ~ppc ~sparc ~alpha ~ppc64"
+
+IUSE=""
+SLOT="0"
+
+DEPEND=">=dev-lang/python-2.2.1
+	>=media-libs/libart_lgpl-2.3.9
+	>=media-gfx/imagemagick-5.4.5
+	>=app-text/wv2-0.1.8
+	dev-util/pkgconfig"
+need-kde 3.1
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/koffice_1_3_4_xpdf_security_integer_overflow.diff
+}
+src_compile() {
+	export LIBPYTHON="`python-config --libs`"
+	kde_src_compile
+}