kjs heap based buffer overflow, #118550

(Portage version: 2.0.53)

7 files changed, 337 insertions, 14 deletions

diff --git a/kde-base/kdelibs/ChangeLog b/kde-base/kdelibs/ChangeLog
index e726f5260564..405f51a38d4f 100644
--- a/kde-base/kdelibs/ChangeLog
+++ b/kde-base/kdelibs/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for kde-base/kdelibs
-# Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/ChangeLog,v 1.300 2005/12/15 15:05:45 ranger Exp $
+# Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/ChangeLog,v 1.301 2006/01/20 14:50:28 carlo Exp $
+
+*kdelibs-3.5.0-r2 (20 Jan 2006)
+*kdelibs-3.4.3-r1 (20 Jan 2006)
+
+  20 Jan 2006; Carsten Lohrke <carlo@gentoo.org>
+  +files/post-3.4.3-kdelibs-kjs.diff, +kdelibs-3.4.3-r1.ebuild,
+  +kdelibs-3.5.0-r2.ebuild:
+  kjs heap based buffer overflow, #118550
 
   15 Dec 2005; Brent Baude <ranger@gentoo.org> kdelibs-3.4.3.ebuild:
   Remarking 3.4.3 ppc64 stable
diff --git a/kde-base/kdelibs/Manifest b/kde-base/kdelibs/Manifest
index aee120f2294a..cb854d5aeacf 100644
--- a/kde-base/kdelibs/Manifest
+++ b/kde-base/kdelibs/Manifest
@@ -1,21 +1,14 @@
-MD5 57b6f8ce8aa398b81afc3707374ab8eb ChangeLog 47830
-MD5 a0a423eb46bcca9f140b0a97645a0177 kdelibs-3.3.2-r10.ebuild 4318
-MD5 176460cf9160b02b1a157612af59e346 kdelibs-3.4.1-r1.ebuild 3363
-MD5 b75b773aa95374e55799e86e678173d6 kdelibs-3.4.1-r2.ebuild 3364
-MD5 12b3f3cc444cc940ed50e352054ccb7f kdelibs-3.4.2-r1.ebuild 3341
-MD5 2fd53a7c014e4527505ec32ec5425575 kdelibs-3.4.2.ebuild 3346
-MD5 a63c94e0dd87823f669a385d1e3a4b01 kdelibs-3.4.3.ebuild 3383
-MD5 d4581e4fb36f23fdb3d871207f79bb94 kdelibs-3.5.0-r1.ebuild 3758
-MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
-MD5 f0e4dcbb7b8e88eeecf66511befbc047 kdelibs-3.5.0.ebuild 3718
+MD5 49578c43b7bd3c1514b5165b08f06b1f ChangeLog 48079
 MD5 e8b51d92930950619b2139c22d4e1407 files/digest-kdelibs-3.3.2-r10 517
 MD5 b6eeb54c84f336414abfd45f4fa6a156 files/digest-kdelibs-3.4.1-r1 68
 MD5 b6eeb54c84f336414abfd45f4fa6a156 files/digest-kdelibs-3.4.1-r2 68
 MD5 ac733469cad0b673ee2a6fc35edc0e91 files/digest-kdelibs-3.4.2 68
 MD5 ac733469cad0b673ee2a6fc35edc0e91 files/digest-kdelibs-3.4.2-r1 68
 MD5 e7fe23c3618de82d63dfdc90fb483a86 files/digest-kdelibs-3.4.3 68
-MD5 15d3d3042e0bb2c9b640e8993aa234b1 files/kdelibs-3.5.0-bindnow.patch 1363
+MD5 e7fe23c3618de82d63dfdc90fb483a86 files/digest-kdelibs-3.4.3-r1 68
+MD5 3e56d0cc58ec7854ae2f9c23bb729028 files/digest-kdelibs-3.5.0 68
 MD5 3e56d0cc58ec7854ae2f9c23bb729028 files/digest-kdelibs-3.5.0-r1 68
+MD5 3e56d0cc58ec7854ae2f9c23bb729028 files/digest-kdelibs-3.5.0-r2 68
 MD5 a5d3cb18c9572d8ca3dd06cbe5d226f1 files/kde3-dcopidlng.patch 681
 MD5 25ab050b323a8efb2049fd770f50058b files/kdelibs-3.3.2-anchor-fix.patch 5947
 MD5 d3df6d042148fd884422822aaf4ffbab files/kdelibs-3.3.2-aspell-dir.patch 467
@@ -25,7 +18,19 @@ MD5 b291a4a134cac9072ad1140a78eee9ce files/kdelibs-3.4.1-kntlm.patch 1323
 MD5 4d3faaf48564cde79aac52957f7e6278 files/kdelibs-3.4.1-ktoolbar-crash.patch 2215
 MD5 4f827df22c4b05fdb50535c985ff5cb1 files/kdelibs-3.4.2-gmail-fix.patch 724
 MD5 b0a18256a9bb33e81f45573f07a341e1 files/kdelibs-3.4.3-inttypes.patch 365
+MD5 15d3d3042e0bb2c9b640e8993aa234b1 files/kdelibs-3.5.0-bindnow.patch 1363
 MD5 091d05a08330372ddbaf5ef9d426be53 files/kdelibs-3.5.0-kicker-crash.patch 1298
 MD5 7e082af5fd71b9b01d01a86f31646499 files/post-3.3.2-kdelibs-htmlframes2.patch 989
 MD5 138c3252883171d55ec24ed0318950fd files/post-3.3.2-kdelibs-kate.diff 2212
-MD5 3e56d0cc58ec7854ae2f9c23bb729028 files/digest-kdelibs-3.5.0 68
+MD5 ecc0ec13ce3b06e94e35aa8e937e02bf files/post-3.4.3-kdelibs-kjs.diff 1570
+MD5 a0a423eb46bcca9f140b0a97645a0177 kdelibs-3.3.2-r10.ebuild 4318
+MD5 176460cf9160b02b1a157612af59e346 kdelibs-3.4.1-r1.ebuild 3363
+MD5 b75b773aa95374e55799e86e678173d6 kdelibs-3.4.1-r2.ebuild 3364
+MD5 12b3f3cc444cc940ed50e352054ccb7f kdelibs-3.4.2-r1.ebuild 3341
+MD5 2fd53a7c014e4527505ec32ec5425575 kdelibs-3.4.2.ebuild 3346
+MD5 aafc38d20ddea52ae2b4bc04c8307699 kdelibs-3.4.3-r1.ebuild 3482
+MD5 a63c94e0dd87823f669a385d1e3a4b01 kdelibs-3.4.3.ebuild 3383
+MD5 d4581e4fb36f23fdb3d871207f79bb94 kdelibs-3.5.0-r1.ebuild 3758
+MD5 a3ec04fa994e1b8a728045dce65f12c4 kdelibs-3.5.0-r2.ebuild 3799
+MD5 f0e4dcbb7b8e88eeecf66511befbc047 kdelibs-3.5.0.ebuild 3718
+MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156
diff --git a/kde-base/kdelibs/files/digest-kdelibs-3.4.3-r1 b/kde-base/kdelibs/files/digest-kdelibs-3.4.3-r1
new file mode 100644
index 000000000000..4e9f447a881b
--- /dev/null
+++ b/kde-base/kdelibs/files/digest-kdelibs-3.4.3-r1
@@ -0,0 +1 @@
+MD5 0cd7c0c8a81e5d11b91b407a4aaaf3ff kdelibs-3.4.3.tar.bz2 16877867
diff --git a/kde-base/kdelibs/files/digest-kdelibs-3.5.0-r2 b/kde-base/kdelibs/files/digest-kdelibs-3.5.0-r2
new file mode 100644
index 000000000000..5d4155f9ff10
--- /dev/null
+++ b/kde-base/kdelibs/files/digest-kdelibs-3.5.0-r2
@@ -0,0 +1 @@
+MD5 2b11d654e2ea1a3cd16dcfdcbb7d1915 kdelibs-3.5.0.tar.bz2 15379557
diff --git a/kde-base/kdelibs/files/post-3.4.3-kdelibs-kjs.diff b/kde-base/kdelibs/files/post-3.4.3-kdelibs-kjs.diff
new file mode 100644
index 000000000000..998f389edfb1
--- /dev/null
+++ b/kde-base/kdelibs/files/post-3.4.3-kdelibs-kjs.diff
@@ -0,0 +1,49 @@
+Index: kjs/function.cpp
+===================================================================
+--- kjs/function.cpp	(revision 495921)
++++ kjs/function.cpp	(working copy)
+@@ -77,7 +77,8 @@ UString encodeURI(ExecState *exec, UStri
+       }
+       else if (C.uc >= 0xD800 && C.uc <= 0xDBFF) {
+ 
+-	if (k == string.size()) {
++        // we need two chars
++	if (k + 1 >= string.size()) {
+ 	  Object err = Error::create(exec,URIError);
+ 	  exec->setException(err);
+ 	  free(encbuf);
+@@ -197,6 +198,10 @@ UString decodeURI(ExecState *exec, UStri
+     }
+ 
+     k += 2;
++
++    if (decbufLen+2 >= decbufAlloc)
++        decbuf = (UChar*)realloc(decbuf,(decbufAlloc *= 2)*sizeof(UChar));
++
+     if ((B & 0x80) == 0) {
+       // Single-byte character
+       C = B;
+@@ -257,6 +262,12 @@ UString decodeURI(ExecState *exec, UStri
+ 	assert(n == 4);
+ 	unsigned long uuuuu = ((octets[0] & 0x07) << 2) | ((octets[1] >> 4) & 0x03);
+ 	unsigned long vvvv = uuuuu-1;
++	if (vvvv > 0x0F) {
++          Object err = Error::create(exec,URIError);
++	  exec->setException(err);
++	  free(decbuf);
++	  return UString();
++	}        
+ 	unsigned long wwww = octets[1] & 0x0F;
+ 	unsigned long xx = (octets[2] >> 4) & 0x03;
+ 	unsigned long yyyy = octets[2] & 0x0F;
+@@ -270,9 +281,7 @@ UString decodeURI(ExecState *exec, UStri
+     }
+ 
+     if (reservedSet.find(C) < 0) {
+-      if (decbufLen+1 >= decbufAlloc)
+-	decbuf = (UChar*)realloc(decbuf,(decbufAlloc *= 2)*sizeof(UChar));
+-      decbuf[decbufLen++] = C;
++        decbuf[decbufLen++] = C;
+     }
+     else {
+       while (decbufLen+k-start >= decbufAlloc)
diff --git a/kde-base/kdelibs/kdelibs-3.4.3-r1.ebuild b/kde-base/kdelibs/kdelibs-3.4.3-r1.ebuild
new file mode 100644
index 000000000000..b3a0b843b716
--- /dev/null
+++ b/kde-base/kdelibs/kdelibs-3.4.3-r1.ebuild
@@ -0,0 +1,127 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/kdelibs-3.4.3-r1.ebuild,v 1.1 2006/01/20 14:50:28 carlo Exp $
+
+inherit kde flag-o-matic eutils multilib
+set-kdedir 3.4
+
+DESCRIPTION="KDE libraries needed by all kde programs"
+HOMEPAGE="http://www.kde.org/"
+SRC_URI="mirror://kde/stable/${PV}/src/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="3.4"
+KEYWORDS="alpha ~amd64 hppa ~ia64 ~mips ppc ppc64 ~sparc x86"
+IUSE="alsa arts cups doc jpeg2k kerberos openexr spell ssl tiff zeroconf"
+
+# kde.eclass has kdelibs in DEPEND, and we can't have that in here.
+# so we recreate the entire DEPEND from scratch.
+RDEPEND="$(qt_min_version 3.3.3)
+	arts? ( ~kde-base/arts-${PV} )
+	app-arch/bzip2
+	>=media-libs/freetype-2
+	media-libs/fontconfig
+	>=dev-libs/libxslt-1.1.4
+	>=dev-libs/libxml2-2.6.6
+	>=dev-libs/libpcre-4.2
+	media-libs/libart_lgpl
+	net-dns/libidn
+	virtual/utempter
+	ssl? ( >=dev-libs/openssl-0.9.7d )
+	alsa? ( media-libs/alsa-lib )
+	cups? ( >=net-print/cups-1.1.19 )
+	tiff? ( media-libs/tiff )
+	kerberos? ( virtual/krb5 )
+	jpeg2k? ( media-libs/jasper )
+	openexr? ( >=media-libs/openexr-1.2 )
+	spell? ( || ( app-text/aspell
+	              app-text/ispell ) )
+	zeroconf? ( net-misc/mDNSResponder )
+	virtual/fam
+	virtual/ghostscript"
+
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	sys-devel/gettext
+	dev-util/pkgconfig"
+
+pkg_setup() {
+	# Workaround collision with <=kdeadmin-3.4.1 (bug #100968).
+	rm -f "${ROOT}${KDEDIR}/share/mimelnk/application/x-debian-package.desktop"
+}
+
+src_unpack() {
+	kde_src_unpack
+
+	# Configure patch. Applied for 3.5.
+	epatch "${FILESDIR}/kdelibs-3.4.1-configure.patch"
+
+	# Missing <inttypes.h> include causes compilation to bork
+	epatch "${FILESDIR}/kdelibs-3.4.3-inttypes.patch"
+
+	# kjs heap based buffer overflow, bug 118550
+	epatch "${FILESDIR}/post-3.4.3-kdelibs-kjs.diff"
+
+	# for the configure patch
+	make -f admin/Makefile.common || die
+}
+
+src_compile() {
+	myconf="--with-distribution=Gentoo
+	        --enable-libfam $(use_enable kernel_linux dnotify)
+	        --with-libart --with-libidn --with-utempter
+	        $(use_with alsa) $(use_with arts) $(use_with ssl)
+	        $(use_with kerberos gssapi) $(use_with tiff)
+	        $(use_with jpeg2k jasper) $(use_with openexr)
+	        $(use_enable cups) $(use_enable zeroconf dnssd)"
+
+	if use spell && has_version app-text/aspell; then
+		myconf="${myconf} --with-aspell"
+	else
+		myconf="${myconf} --without-aspell"
+	fi
+
+	myconf="${myconf} --disable-fast-malloc"
+
+	# fix bug 58179, bug 85593
+	# kdelibs-3.4.0 needed -fno-gcse; 3.4.1 needs -mminimal-toc; this needs a
+	# closer look... - corsair
+	use ppc64 && append-flags "-mminimal-toc"
+
+	kde_src_compile
+
+	if use doc; then
+		make apidox || die
+	fi
+}
+
+src_install() {
+	kde_src_install
+
+	if use doc; then
+		make DESTDIR="${D}" install-apidox || die
+	fi
+
+	# Needed to create lib -> lib64 symlink for amd64 2005.0 profile
+	if [ "${SYMLINK_LIB}" = "yes" ]; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) ${KDEDIR}/lib
+	fi
+
+	if ! use arts ; then
+		dodir /etc/env.d
+
+		# List all the multilib libdirs
+		local libdirs
+		for libdir in $(get_all_libdirs); do
+			libdirs="${libdirs}:${PREFIX}/${libdir}"
+		done
+
+		cat <<EOF > ${D}/etc/env.d/46kdepaths-${SLOT} # number goes down with version upgrade
+PATH=${PREFIX}/bin
+ROOTPATH=${PREFIX}/sbin:${PREFIX}/bin
+LDPATH=${libdirs:1}
+CONFIG_PROTECT="${PREFIX}/share/config ${PREFIX}/env ${PREFIX}/shutdown"
+EOF
+	fi
+
+}
diff --git a/kde-base/kdelibs/kdelibs-3.5.0-r2.ebuild b/kde-base/kdelibs/kdelibs-3.5.0-r2.ebuild
new file mode 100644
index 000000000000..2d2cea64091c
--- /dev/null
+++ b/kde-base/kdelibs/kdelibs-3.5.0-r2.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/kdelibs-3.5.0-r2.ebuild,v 1.1 2006/01/20 14:50:28 carlo Exp $
+inherit kde flag-o-matic eutils multilib
+set-kdedir 3.5
+
+DESCRIPTION="KDE libraries needed by all kde programs"
+HOMEPAGE="http://www.kde.org/"
+#SRC_URI="mirror://kde/stable/${PV}/src/${P}.tar.bz2"
+SRC_URI="mirror://kde/stable/3.5/src/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="3.5"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="acl alsa arts cups doc jpeg2k kerberos openexr spell ssl tiff zeroconf"
+
+# kde.eclass has kdelibs in DEPEND, and we can't have that in here.
+# so we recreate the entire DEPEND from scratch.
+RDEPEND="$(qt_min_version 3.3.3)
+	arts? ( ~kde-base/arts-${PV} )
+	app-arch/bzip2
+	>=media-libs/freetype-2
+	media-libs/fontconfig
+	>=dev-libs/libxslt-1.1.4
+	>=dev-libs/libxml2-2.6.6
+	>=dev-libs/libpcre-4.2
+	media-libs/libart_lgpl
+	net-dns/libidn
+	virtual/utempter
+	acl? ( kernel_linux? ( sys-apps/acl ) )
+	ssl? ( >=dev-libs/openssl-0.9.7d )
+	alsa? ( media-libs/alsa-lib )
+	cups? ( >=net-print/cups-1.1.19 )
+	tiff? ( media-libs/tiff )
+	kerberos? ( virtual/krb5 )
+	jpeg2k? ( media-libs/jasper )
+	openexr? ( >=media-libs/openexr-1.2 )
+	spell? ( || ( app-text/aspell
+	              app-text/ispell ) )
+	zeroconf? ( net-misc/mDNSResponder )
+	virtual/fam
+	virtual/ghostscript"
+
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	sys-devel/gettext
+	dev-util/pkgconfig"
+
+PATCHES="${FILESDIR}/${P}-bindnow.patch
+	${FILESDIR}/${P}-kicker-crash.patch
+	${FILESDIR}/post-3.4.3-kdelibs-kjs.diff"
+
+src_compile() {
+	# hspell is disabled because it requires version 0.9 of hspell that
+	# is not in portage yet; leaving it to autodetection tries to use it
+	# and then fails because of missing required functions
+
+	myconf="--with-distribution=Gentoo
+	        --enable-libfam $(use_enable kernel_linux dnotify)
+	        --with-libart --with-libidn --with-utempter
+	        $(use_with acl) $(use_with ssl)
+	        $(use_with alsa) $(use_with arts)
+	        $(use_with kerberos gssapi) $(use_with tiff)
+	        $(use_with jpeg2k jasper) $(use_with openexr)
+	        $(use_enable cups) $(use_enable zeroconf dnssd)
+	        --without-hspell"
+
+	if use spell && has_version app-text/aspell; then
+		myconf="${myconf} --with-aspell"
+	else
+		myconf="${myconf} --without-aspell"
+	fi
+
+	myconf="${myconf} --disable-fast-malloc"
+
+	# fix bug 58179, bug 85593
+	# kdelibs-3.4.0 needed -fno-gcse; 3.4.1 needs -mminimal-toc; this needs a
+	# closer look... - corsair
+	use ppc64 && append-flags "-mminimal-toc"
+
+	export BINDNOW_FLAGS="$(bindnow-flags)"
+
+	kde_src_compile
+
+	if use doc; then
+		make apidox || die
+	fi
+}
+
+src_install() {
+	kde_src_install
+
+	if use doc; then
+		make DESTDIR="${D}" install-apidox || die
+	fi
+
+	# Needed to create lib -> lib64 symlink for amd64 2005.0 profile
+	if [ "${SYMLINK_LIB}" = "yes" ]; then
+		dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) ${KDEDIR}/lib
+	fi
+
+	if ! use arts ; then
+		dodir /etc/env.d
+
+		# List all the multilib libdirs
+		local libdirs
+		for libdir in $(get_all_libdirs); do
+			libdirs="${libdirs}:${PREFIX}/${libdir}"
+		done
+
+		cat <<EOF > ${D}/etc/env.d/45kdepaths-${SLOT} # number goes down with version upgrade
+PATH=${PREFIX}/bin
+ROOTPATH=${PREFIX}/sbin:${PREFIX}/bin
+LDPATH=${libdirs:1}
+CONFIG_PROTECT="${PREFIX}/share/config ${PREFIX}/env ${PREFIX}/shutdown"
+EOF
+	fi
+
+}
+
+pkg_postinst() {
+	if use zeroconf; then
+		echo
+		einfo "To make zeroconf support available in KDE"
+		einfo "make sure that the 'mdnsd' daemon is running."
+		einfo "Make sure also that multicast dns lookups are"
+		einfo "enabled by editing the 'hosts:' line in"
+		einfo "/etc/nsswitch.conf to include 'mdns', e.g.:"
+		einfo "hosts: files mdns dns"
+		echo
+	fi
+}