Fix insecure temp file creation, security bug #198231.

(Portage version: 2.1.3.18)

4 files changed, 92 insertions, 1 deletions

diff --git a/dev-tex/feynmf/ChangeLog b/dev-tex/feynmf/ChangeLog
index 651813afac82..b5d3e8d9e69d 100644
--- a/dev-tex/feynmf/ChangeLog
+++ b/dev-tex/feynmf/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-tex/feynmf
 # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-tex/feynmf/ChangeLog,v 1.10 2007/10/15 21:40:42 aballier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-tex/feynmf/ChangeLog,v 1.11 2007/11/06 09:13:02 ulm Exp $
+
+*feynmf-1.08-r2 (06 Nov 2007)
+
+  06 Nov 2007; Ulrich Mueller <ulm@gentoo.org>
+  +files/feynmf-1.08-tempfile.patch, +feynmf-1.08-r2.ebuild:
+  Fix insecure temp file creation, security bug #198231.
 
   15 Oct 2007; Alexis Ballier <aballier@gentoo.org> feynmf-1.08-r1.ebuild:
   adapt deps for texlive, bug #195894
diff --git a/dev-tex/feynmf/feynmf-1.08-r2.ebuild b/dev-tex/feynmf/feynmf-1.08-r2.ebuild
new file mode 100644
index 000000000000..0deda27ffe08
--- /dev/null
+++ b/dev-tex/feynmf/feynmf-1.08-r2.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-tex/feynmf/feynmf-1.08-r2.ebuild,v 1.1 2007/11/06 09:13:02 ulm Exp $
+
+inherit eutils latex-package
+
+DESCRIPTION="Combined LaTeX/Metafont package for drawing of Feynman diagrams"
+HOMEPAGE="http://www.ctan.org/tex-archive/macros/latex/contrib/feynmf/"
+#Taken from: ftp.tug.ctan.org/tex-archive/macros/latex/contrib/${PN}.tar.gz
+SRC_URI="mirror://gentoo/${P}.tar.gz
+	doc? ( mirror://gentoo/${PN}-cnl.tar.gz )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+IUSE="doc"
+
+DEPEND="|| ( dev-texlive/texlive-metapost virtual/tetex )"
+RDEPEND="${DEPEND}
+	virtual/perl-File-Temp"
+
+S="${WORKDIR}/${PN}"
+
+src_unpack() {
+	unpack ${A}
+	epatch "${FILESDIR}/${P}.patch"
+	epatch "${FILESDIR}/${P}-tempfile.patch"
+}
+
+src_compile() {
+	addwrite /var/cache/fonts
+	emake MP=mpost all manual.ps || die "emake failed"
+	if use doc; then
+		emake -f Makefile.cnl ps || die "emake fmfcnl failed"
+	fi
+}
+
+src_install() {
+	newbin feynmf.pl feynmf
+	doman feynmf.1
+	insinto ${TEXMF}/tex/latex/${PN}; doins feynmf.sty feynmp.sty
+	insinto ${TEXMF}/metafont/${PN}; doins feynmf.mf
+	insinto ${TEXMF}/metapost/${PN}; doins feynmp.mp
+	dodoc README manual.ps template.tex
+	use doc && dodoc fmfcnl*.ps
+}
diff --git a/dev-tex/feynmf/files/digest-feynmf-1.08-r2 b/dev-tex/feynmf/files/digest-feynmf-1.08-r2
new file mode 100644
index 000000000000..45e424b08b27
--- /dev/null
+++ b/dev-tex/feynmf/files/digest-feynmf-1.08-r2
@@ -0,0 +1,6 @@
+MD5 689bb25c24cd7be7d625454cc16c26ec feynmf-1.08.tar.gz 286208
+RMD160 94b091e6cfe0ae26766bcb4a8d591cfa30b7b48c feynmf-1.08.tar.gz 286208
+SHA256 07bd8c23246fc3e8c7bab6590570e601dcbab2e7b07119cc052693c06d31bd0f feynmf-1.08.tar.gz 286208
+MD5 4357d09d7d7e38ad3d312942f303394b feynmf-cnl.tar.gz 49920
+RMD160 8c6aec2e050ed6cc9b3b7484b870543c3a7907b6 feynmf-cnl.tar.gz 49920
+SHA256 18bbfc2aedcb76f20c8817a1ee002962baa1172f5b2c9fb23f968268db2c75d5 feynmf-cnl.tar.gz 49920
diff --git a/dev-tex/feynmf/files/feynmf-1.08-tempfile.patch b/dev-tex/feynmf/files/feynmf-1.08-tempfile.patch
new file mode 100644
index 000000000000..5e3ec840dcc2
--- /dev/null
+++ b/dev-tex/feynmf/files/feynmf-1.08-tempfile.patch
@@ -0,0 +1,33 @@
+--- feynmf-orig/feynmf.pl	2007-11-06 08:32:37.000000000 +0100
++++ feynmf/feynmf.pl	2007-11-06 09:33:04.000000000 +0100
+@@ -119,6 +119,7 @@
+ require 5.000;
+ # use strict;
+ use File::Find;
++use File::Temp qw(tempfile);
+ use Getopt::Long;
+ 
+ ########################################################################
+@@ -270,18 +271,18 @@
+     my @tfm = @_;
+     # Prepare a fake temporary PL file
+     # (/dev/null won't do, because the font must not be empty):
+-    my ($pl) = "/tmp/feynmf$$.pl";
+     my ($tfm);
+     $pltotf_prog
+ 	or die "feynmf: fatal: pltopf programm required unless -notfm\n";
+-    open (PL, ">$pl") or die "feynmf: can't open temporary file $pl: $!\n";
++    my ($PL, $pl) = tempfile("/tmp/feynmfXXXXXX", SUFFIX => ".pl");
++    $PL or die "feynmf: can't open temporary file: $!\n";
+     push @temporay_files, $pl;
+-    print PL <<__END_PL__;
++    print $PL <<__END_PL__;
+       (FAMILY FEYNMF)
+       (DESIGNSIZE R 10.0)
+       (CHARACTER D 1 (CHARWD R 10.0) (CHARHT R 10.0))
+ __END_PL__
+-    close (PL);
++    close ($PL);
+     foreach $tfm (@tfm) {
+ 	maybe_run "$pltotf_prog $pl $tfm.tfm" unless -r "$tfm.tfm";
+     }