Version bump with security fixes from upstream, bug #276235

(Portage version: 2.2_rc33/cvs/Linux x86_64)

5 files changed, 275 insertions, 2 deletions

diff --git a/dev-ml/camlimages/ChangeLog b/dev-ml/camlimages/ChangeLog
index c5888eaf107a..9137bd73ea25 100644
--- a/dev-ml/camlimages/ChangeLog
+++ b/dev-ml/camlimages/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for dev-ml/camlimages
-# Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-ml/camlimages/ChangeLog,v 1.16 2008/09/02 18:06:25 aballier Exp $
+# Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/dev-ml/camlimages/ChangeLog,v 1.17 2009/07/24 20:51:30 aballier Exp $
+
+*camlimages-3.0.1 (24 Jul 2009)
+
+  24 Jul 2009; Alexis Ballier <aballier@gentoo.org>
+  +camlimages-3.0.1.ebuild, +files/camlimages-3.0.1-CVE-2009-2295.patch,
+  +files/camlimages-3.0.1-lablgtk.patch, metadata.xml:
+  Version bump with security fixes from upstream, bug #276235
 
   02 Sep 2008; Alexis Ballier <aballier@gentoo.org> -camlimages-2.20.ebuild:
   remove old
diff --git a/dev-ml/camlimages/camlimages-3.0.1.ebuild b/dev-ml/camlimages/camlimages-3.0.1.ebuild
new file mode 100644
index 000000000000..569699907313
--- /dev/null
+++ b/dev-ml/camlimages/camlimages-3.0.1.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-ml/camlimages/camlimages-3.0.1.ebuild,v 1.1 2009/07/24 20:51:30 aballier Exp $
+
+EAPI=2
+
+inherit eutils
+
+IUSE="doc gif gs gtk jpeg tiff truetype xpm"
+
+DESCRIPTION="An image manipulation library for ocaml"
+HOMEPAGE="http://gallium.inria.fr/camlimages/"
+SRC_URI="http://gallium.inria.fr/camlimages/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+
+RDEPEND=">=dev-lang/ocaml-3.10.2[ocamlopt]
+	gif? ( media-libs/giflib )
+	gtk? ( dev-ml/lablgtk )
+	gs? ( virtual/ghostscript )
+	jpeg? ( media-libs/jpeg )
+	tiff? ( media-libs/tiff )
+	media-libs/libpng
+	truetype? ( >=media-libs/freetype-2 )
+	xpm? ( x11-libs/libXpm )
+	"
+DEPEND="${DEPEND}
+	dev-ml/findlib"
+
+src_prepare() {
+	epatch "${FILESDIR}/${P}-lablgtk.patch"
+	epatch "${FILESDIR}/${P}-CVE-2009-2295.patch"
+}
+
+src_configure() {
+	econf \
+		$(use_with gif) \
+		$(use_with gs) \
+		$(use_with gtk lablgtk2) \
+		--without-lablgtk \
+		$(use_with jpeg) \
+		--with-png \
+		$(use_with tiff) \
+		$(use_with truetype freetype) \
+		$(use_with xpm)
+}
+
+src_compile() {
+	emake -j1 || die
+}
+
+src_install() {
+	emake DESTDIR="${D}" ocamlsitelibdir="$(ocamlfind printconf destdir)/${PN}" install || die
+	dodoc README
+	use doc && dohtml doc/*
+}
diff --git a/dev-ml/camlimages/files/camlimages-3.0.1-CVE-2009-2295.patch b/dev-ml/camlimages/files/camlimages-3.0.1-CVE-2009-2295.patch
new file mode 100644
index 000000000000..c94b9b11672e
--- /dev/null
+++ b/dev-ml/camlimages/files/camlimages-3.0.1-CVE-2009-2295.patch
@@ -0,0 +1,154 @@
+Index: src/gifread.c
+===================================================================
+--- src/gifread.c.orig
++++ src/gifread.c
+@@ -20,6 +20,8 @@
+ #include <caml/memory.h>
+ #include <caml/fail.h>
+ 
++#include "oversized.h"
++
+ #include <stdio.h>
+ #include <string.h>
+ 
+@@ -191,6 +193,9 @@ value dGifGetLine( value hdl )
+ 
+   GifFileType *GifFile = (GifFileType*) hdl;
+ 
++  if( oversized( GifFile->Image.Width, sizeof(GifPixelType) ) ){
++    failwith_oversized("gif");
++  }
+   buf = alloc_string( GifFile->Image.Width * sizeof(GifPixelType) ); 
+ 
+   if( DGifGetLine(GifFile, String_val(buf), GifFile->Image.Width ) 
+Index: src/jpegread.c
+===================================================================
+--- src/jpegread.c.orig
++++ src/jpegread.c
+@@ -20,6 +20,8 @@
+ #include <caml/memory.h>
+ #include <caml/fail.h>
+ 
++#include "oversized.h"
++
+ #include <stdio.h>
+ #include <string.h>
+ 
+@@ -156,6 +158,12 @@ read_JPEG_file (value name)
+    */ 
+   /* JSAMPLEs per row in output buffer */
+ 
++  if( oversized(cinfo.output_width, cinfo.output_components) ){
++    jpeg_destroy_decompress(&cinfo);
++    fclose(infile);
++    failwith_oversized("jpeg");
++  }
++
+   row_stride = cinfo.output_width * cinfo.output_components;
+ 
+   /* Make a one-row-high sample array that will go away when done with image */
+@@ -177,6 +185,12 @@ read_JPEG_file (value name)
+     jpeg_read_scanlines(&cinfo, buffer + cinfo.output_scanline, 1); 
+   }
+ 
++  if( oversized(row_stride, cinfo.output_height) ){
++    jpeg_destroy_decompress(&cinfo);
++    fclose(infile);
++    failwith_oversized("jpeg");
++  }
++
+   {
+     CAMLlocalN(r,3);
+     r[0] = Val_int(cinfo.output_width);
+@@ -352,6 +366,7 @@ value open_jpeg_file_for_read_start( jpe
+ 
+   { 
+     CAMLlocalN(r,3);
++    // CR jfuruse: integer overflow
+     r[0] = Val_int(cinfop->output_width);
+     r[1] = Val_int(cinfop->output_height);
+     r[2] = alloc_tuple(3);
+Index: src/oversized.h
+===================================================================
+--- /dev/null
++++ src/oversized.h
+@@ -0,0 +1,9 @@
++#include <limits.h>
++/* Test if x or y are negative, or if multiplying x * y would cause an
++ * arithmetic overflow.
++ */
++#define oversized(x, y)						\
++  ((x) < 0 || (y) < 0 || ((y) != 0 && (x) > INT_MAX / (y)))
++
++#define failwith_oversized(lib) \
++  failwith("#lib error: image contains oversized or bogus width and height");
+Index: src/pngread.c
+===================================================================
+--- src/pngread.c.orig
++++ src/pngread.c
+@@ -17,6 +17,8 @@
+ 
+ #include <png.h>
+ 
++#include "oversized.h"
++
+ #include <caml/mlvalues.h>
+ #include <caml/alloc.h>
+ #include <caml/memory.h>
+@@ -81,6 +83,9 @@ value read_png_file_as_rgb24( name )
+   png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
+ 	       &interlace_type, NULL, NULL);
+ 
++  if (oversized (width, height))
++    failwith_oversized("png");
++
+   if ( color_type == PNG_COLOR_TYPE_GRAY ||
+        color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) { 
+     png_set_gray_to_rgb(png_ptr); 
+@@ -102,10 +107,16 @@ value read_png_file_as_rgb24( name )
+ 
+   rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+ 
++  if (oversized (rowbytes, height))
++    failwith_oversized("png");
++
+   {
+     int i;
+     png_bytep *row_pointers;
+ 
++    if (oversized (sizeof (png_bytep), height))
++      failwith_oversized("png");
++
+     row_pointers = (png_bytep*) stat_alloc(sizeof(png_bytep) * height);
+ 
+     res = alloc_tuple(3);
+@@ -235,6 +246,9 @@ value read_png_file( name )
+   png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
+ 	       &interlace_type, NULL, NULL);
+ 
++  if (oversized (width, height))
++    failwith_oversized("png");
++
+   if ( color_type == PNG_COLOR_TYPE_GRAY ||
+        color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) { 
+     png_set_gray_to_rgb(png_ptr); 
+@@ -251,6 +265,9 @@ value read_png_file( name )
+ 
+   rowbytes = png_get_rowbytes(png_ptr, info_ptr);
+ 
++  if (oversized (rowbytes, height))
++    failwith_oversized("png");
++
+ /*
+ fprintf(stderr, "pngread.c: actual loading\n"); fflush(stderr);
+ */
+@@ -259,6 +276,9 @@ fprintf(stderr, "pngread.c: actual loadi
+     png_bytep *row_pointers;
+     char mesg[256];
+  
++    if (oversized (sizeof (png_bytep), height))
++      failwith_oversized("png");
++
+     row_pointers = (png_bytep*)stat_alloc(sizeof(png_bytep) * height);
+     res = alloc_tuple(3);
+ 
diff --git a/dev-ml/camlimages/files/camlimages-3.0.1-lablgtk.patch b/dev-ml/camlimages/files/camlimages-3.0.1-lablgtk.patch
new file mode 100644
index 000000000000..1b29dd509ed2
--- /dev/null
+++ b/dev-ml/camlimages/files/camlimages-3.0.1-lablgtk.patch
@@ -0,0 +1,51 @@
+Index: camlimages-3.0.1/examples/liv/liv.ml
+===================================================================
+--- camlimages-3.0.1.orig/examples/liv/liv.ml
++++ camlimages-3.0.1/examples/liv/liv.ml
+@@ -12,6 +12,10 @@
+ 
+ (* $Id: camlimages-3.0.1-lablgtk.patch,v 1.1 2009/07/24 20:51:30 aballier Exp $ *)
+ 
++
++module D = Display
++open D
++
+ open Images;;
+ open OImages;;
+ 
+@@ -21,14 +25,13 @@ open GMain;;
+ 
+ open Livmisc;;
+ open Gui;;
+-open Display;;
+ open Tout;;
+ 
+ open Gc;;
+ 
+ exception Skipped;;
+ 
+-let base_filters = ref ([] : Display.filter list);;
++let base_filters = ref ([] : D.filter list);;
+ 
+ let r = Gc.get () in
+ r.max_overhead <- 0; Gc.set r;
+@@ -52,15 +55,15 @@ Arg.parse [
+   "-root",
+     Arg.String
+       (function
+-       | "center" -> Display.root_mode := `CENTER
+-       | "random" -> Display.root_mode := `RANDOM
++       | "center" -> D.root_mode := `CENTER
++       | "random" -> D.root_mode := `RANDOM
+        | _ -> raise (Failure "root mode")),
+     ": on root [center|random]";
+   "-transition",
+     Arg.String
+       (function
+-       | "myst" -> Display.transition := `MYST
+-       | "transparent" -> Display.transition := `TRANSPARENT
++       | "myst" -> D.transition := `MYST
++       | "transparent" -> D.transition := `TRANSPARENT
+        | _ -> raise (Failure "transition")),
+     ": transition [myst|transparent]";
+   "-transparentborder",
diff --git a/dev-ml/camlimages/metadata.xml b/dev-ml/camlimages/metadata.xml
index 2193d772e351..f85e344ba8e2 100644
--- a/dev-ml/camlimages/metadata.xml
+++ b/dev-ml/camlimages/metadata.xml
@@ -2,4 +2,7 @@
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
 <herd>ml</herd>
+<use>
+	<flag name="gs">Ghostscript support (virtual/ghostscript)</flag>
+</use>
 </pkgmetadata>