Version bumped to -r3 to address security bug #59948.

5 files changed, 241 insertions, 3 deletions

diff --git a/media-libs/xine-lib/ChangeLog b/media-libs/xine-lib/ChangeLog
index 22e650a69c0a..bbbd32f1823c 100644
--- a/media-libs/xine-lib/ChangeLog
+++ b/media-libs/xine-lib/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-libs/xine-lib
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/xine-lib/ChangeLog,v 1.135 2004/08/05 00:23:48 lv Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/xine-lib/ChangeLog,v 1.136 2004/08/10 19:03:09 chriswhite Exp $
+
+*xine-lib-1_rc5-r3 (11 Aug 2004)
+
+  11 Aug 2004; Chris White <chriswhite@gentoo.org>
+  +files/xine-lib-1_rc5-vcd_overflow.patch, +xine-lib-1_rc5-r3.ebuild:
+  Version bump to fix security issues stated in Bug #59948.
 
   04 Aug 2004; Travis Tilley <lv@gentoo.org> xine-lib-1_rc5-r2.ebuild:
   stable on amd64
diff --git a/media-libs/xine-lib/Manifest b/media-libs/xine-lib/Manifest
index 846eaeae470a..2aa0cb0af089 100644
--- a/media-libs/xine-lib/Manifest
+++ b/media-libs/xine-lib/Manifest
@@ -1,11 +1,12 @@
-MD5 51ef9c2a06ccd7b3ac70b60571ad1ea3 ChangeLog 22996
+MD5 d582b9bbe015dd398f57b1b52b9c6b00 ChangeLog 23213
 MD5 0118256c86331c5cbf93ea4fbb2adcdf metadata.xml 310
 MD5 3d849500b17b5ad075102cf70d75b7c4 xine-lib-0.9.13-r3.ebuild 3354
 MD5 c639cbd78aac77ed3cff247df68d2608 xine-lib-1_rc2.ebuild 3934
 MD5 21f16ff9e27523f78078b77e1bd41c54 xine-lib-1_rc3-r1.ebuild 4042
-MD5 3b8bfa094edbffef04fb581860f88606 xine-lib-1_rc4-r1.ebuild 4989
 MD5 342f5acc8a2e99672e90f384dc6abf8e xine-lib-1_rc4.ebuild 4462
 MD5 e2791de1d507eca21bd557c673474f9c xine-lib-1_rc5-r2.ebuild 5113
+MD5 3b8bfa094edbffef04fb581860f88606 xine-lib-1_rc4-r1.ebuild 4989
+MD5 09efc41011214cd3e9e09087314e6803 xine-lib-1_rc5-r3.ebuild 5200
 MD5 bcd5f2b8999f92c2f7215009f5ae1490 files/configure-64bit-define.patch 221
 MD5 f1570a69c99207f65b5cdf1d154bbcd4 files/digest-xine-lib-0.9.13-r3 68
 MD5 f90bfe4a0ee80eecb38fc34022ccab7e files/digest-xine-lib-1_rc2 67
@@ -29,3 +30,5 @@ MD5 0cf698a9ff87a3595140d92df7b900b6 files/xine-lib-configure.patch 342
 MD5 aa54582a91933533008c1211dcbcfb35 files/xine-lib-disable-directfb.patch 4169
 MD5 3cbdef8aa211184b96474addb4f7c5d6 files/xine-lib-gcc34.patch 423
 MD5 dcb0c79c0bb106397aad42f6d936627d files/xineconfig.patch-0.9.13 601
+MD5 ff56a363d07445735a05afe1dc7f6f56 files/xine-lib-1_rc5-vcd_overflow.patch 1754
+MD5 044cbe825fc480693aec675808e4c679 files/digest-xine-lib-1_rc5-r3 67
diff --git a/media-libs/xine-lib/files/digest-xine-lib-1_rc5-r3 b/media-libs/xine-lib/files/digest-xine-lib-1_rc5-r3
new file mode 100644
index 000000000000..538dc38af828
--- /dev/null
+++ b/media-libs/xine-lib/files/digest-xine-lib-1_rc5-r3
@@ -0,0 +1 @@
+MD5 703c3e68d60524598d4d9e527fe38286 xine-lib-1-rc5.tar.gz 7052663
diff --git a/media-libs/xine-lib/files/xine-lib-1_rc5-vcd_overflow.patch b/media-libs/xine-lib/files/xine-lib-1_rc5-vcd_overflow.patch
new file mode 100644
index 000000000000..5fd9ea6fc701
--- /dev/null
+++ b/media-libs/xine-lib/files/xine-lib-1_rc5-vcd_overflow.patch
@@ -0,0 +1,55 @@
+--- src/input/vcd/xineplug_inp_vcd.c.old	2004-08-11 02:55:35.296492264 +0900
++++ src/input/vcd/xineplug_inp_vcd.c	2004-08-11 02:59:45.897395136 +0900
+@@ -48,6 +48,7 @@
+ #define SHORT_PLUGIN_NAME "VCD"
+ #define MRL_PREFIX "vcd://"
+ #define MRL_PREFIX_LEN strlen(MRL_PREFIX)
++#define MRL_MAX_LEN 1024
+ 
+ #define xine_config_entry_t xine_cfg_entry_t
+ 
+@@ -474,7 +475,7 @@
+     return false;
+   }
+ 
+-  count = sscanf (p, "%[^@]@%1[EePpSsTt]%u", 
++  count = sscanf (p, "%1024[^@]@%1[EePpSsTt]%u", 
+ 		  device_str, type_str, &num);
+   itemid->num = num;
+   
+@@ -498,7 +499,7 @@
+     {
+       /* No device/file given, so use the default device and try again. */
+       if (NULL == default_vcd_device) return false;
+-      strcpy(device_str, default_vcd_device);
++      strncpy(device_str, default_vcd_device, MRL_MAX_LEN);
+       if (p[0] == '@') p++;
+       count = sscanf (p, "%1[EePpSsTt]%u", type_str, &num);
+       type_str[0] = toupper(type_str[0]);
+@@ -790,7 +791,7 @@
+ vcd_class_get_dir (input_class_t *this_gen, const char *filename, 
+                     int *num_files) {
+ 
+-  char             intended_vcd_device[1024]="";
++  char             intended_vcd_device[MRL_MAX_LEN+1]="";
+   vcdinfo_itemid_t itemid;
+ 
+   vcd_input_class_t *class = (vcd_input_class_t *) this_gen;
+@@ -922,7 +923,7 @@
+ static char *
+ vcd_class_get_identifier (input_class_t *this_gen) {
+   dbg_print((INPUT_DBG_CALL|INPUT_DBG_EXT), "called\n");
+-  return SHORT_PLUGIN_NAME;
++  return strdup(SHORT_PLUGIN_NAME);
+ }
+ 
+ /* 
+@@ -1452,7 +1453,7 @@
+ {
+   vcd_input_class_t  *class = (vcd_input_class_t *) class_gen;
+ 
+-  char intended_vcd_device[1024]="";
++  char intended_vcd_device[MRL_MAX_LEN+1]="";
+   vcdinfo_itemid_t itemid;
+   char *check_mrl=NULL;
+   bool used_default;
diff --git a/media-libs/xine-lib/xine-lib-1_rc5-r3.ebuild b/media-libs/xine-lib/xine-lib-1_rc5-r3.ebuild
new file mode 100644
index 000000000000..08d5ae75964a
--- /dev/null
+++ b/media-libs/xine-lib/xine-lib-1_rc5-r3.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/xine-lib/xine-lib-1_rc5-r3.ebuild,v 1.1 2004/08/10 19:03:09 chriswhite Exp $
+
+inherit eutils flag-o-matic gcc libtool
+
+# This should normally be empty string, unless a release has a suffix.
+MY_PKG_SUFFIX=""
+
+DESCRIPTION="Core libraries for Xine movie player"
+HOMEPAGE="http://xine.sourceforge.net/"
+SRC_URI="mirror://sourceforge/xine/${PN}-${PV/_/-}${MY_PKG_SUFFIX}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="1"
+KEYWORDS="~x86 ~ppc ~hppa ~sparc ~amd64 -ia64 ~alpha ~ppc64"
+IUSE="arts esd avi nls dvd aalib X directfb oggvorbis alsa gnome sdl speex theora ipv6 altivec"
+
+RDEPEND="oggvorbis? ( media-libs/libvorbis )
+	!amd64? ( X? ( virtual/x11 ) )
+	amd64? ( X? ( || ( x11-base/xorg-x11 >=x11-base/xfree-4.3.0-r6 ) ) )
+	avi? ( x86? ( >=media-libs/win32codecs-0.50
+	       media-libs/divx4linux ) )
+	esd? ( media-sound/esound )
+	dvd? ( >=media-libs/libdvdcss-1.2.7 )
+	arts? ( kde-base/arts )
+	alsa? ( media-libs/alsa-lib )
+	aalib? ( media-libs/aalib )
+	!sparc? ( directfb? ( >=dev-libs/DirectFB-0.9.9
+		    dev-util/pkgconfig ) )
+	gnome? ( >=gnome-base/gnome-vfs-2.0
+			dev-util/pkgconfig )
+	>=media-libs/flac-1.0.4
+	sdl? ( >=media-libs/libsdl-1.1.5 )
+	>=media-libs/libfame-0.9.0
+	>=media-libs/xvid-0.9.0
+	theora? ( media-libs/libtheora )
+	speex? ( media-libs/speex )"
+DEPEND="${RDEPEND}
+	nls? ( sys-devel/gettext )"
+
+S=${WORKDIR}/${PN}-${PV/_/-}${MY_PKG_SUFFIX}
+
+pkg_setup() {
+	# Make sure that the older libraries are not installed (bug #15081).
+	if [ `has_version =media-libs/xine-lib-0.9.13*` ]
+	then
+		eerror "Please uninstall older xine libraries.";
+		eerror "The compilation cannot proceed.";
+		die
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+
+	# gcc2 fixes provided by <T.Henderson@cs.ucl.ac.uk> in #26534
+	#epatch ${FILESDIR}/${P}-gcc2_fix.patch
+	# preserve CFLAGS added by drobbins, -O3 isn't as good as -O2 most of the time
+	epatch ${FILESDIR}/protect-CFLAGS.patch-${PV}-r1
+	# plasmaroo: Kernel 2.6 headers patch
+	epatch ${FILESDIR}/${PN}-2.6.patch
+	# force 32 bit userland
+	[ ${ARCH} = "sparc" ] && epatch ${FILESDIR}/${P}-configure-sparc.patch
+
+	# always_inline means inline-or-fail, so it's no suprise that xine-lib
+	# fails to compile with gcc 3.4 when this one inline fails
+	#epatch ${FILESDIR}/xine-lib-gcc34.patch
+
+	elibtoolize #40317
+
+	# Fix building on amd64, #49569
+	#use amd64 && epatch ${FILESDIR}/configure-64bit-define.patch
+
+	# Fix detection of hppa2.0 and hppa1.1 CHOST
+	use hppa && sed -e 's/hppa-/hppa*-linux-/' -i ${S}/configure
+
+	# fixes vcd overflow as per bug #59948
+	epatch ${FILESDIR}/${P}-vcd_overflow.patch
+}
+
+src_compile() {
+	filter-flags -maltivec -mabi=altivec
+	filter-flags -fstack-protector -fPIC
+	filter-flags -fforce-addr
+	filter-flags -momit-leaf-frame-pointer #46339
+	filter-flags -funroll-all-loops #55420
+
+	if [ "`gcc-major-version`" -ge "3" -a "`gcc-minor-version`" -ge "4" ]; then
+		append-flags -fno-web #49509
+		filter-flags -fno-unit-at-a-time #55202
+		append-flags -funit-at-a-time #55202
+	fi
+
+	is-flag -O? || append-flags -O1 #31243
+
+	# fix build errors with sse2 #49482
+	if use x86 ; then
+		if [ `gcc-major-version` -eq 3 ] ; then
+			append-flags -mno-sse2 `test_flag -mno-sse3`
+			filter-mfpmath sse
+		fi
+	fi
+
+	# Use the built-in dvdnav plugin.
+	local myconf="--with-included-dvdnav"
+
+	use avi	&& use x86 \
+		&& myconf="${myconf} --with-w32-path=/usr/lib/win32" \
+		|| myconf="${myconf} --disable-asf"
+
+	use sparc \
+		&& myconf="${myconf} --enable-vis --build=${CHOST}"
+
+	use amd64 \
+		&& myconf="${myconf} --with-xv-path=/usr/X11R6/lib"
+
+	# Fix compilation-errors on PowerPC #45393 & #55460
+	if use ppc ; then
+		append-flags -U__ALTIVEC__
+		myconf="${myconf} `use_enable altivec`"
+	fi
+
+	# The default CFLAGS (-O) is the only thing working on hppa.
+	if use hppa && [ "`gcc-version`" != "3.4" ] ; then
+		unset CFLAGS
+	else
+		append-flags -ffunction-sections
+	fi
+
+	econf \
+		`use_enable X x11` `use_with X x` `use_enable X shm` `use_enable X xft` \
+		`use_enable esd` \
+		`use_enable nls` \
+		`use_enable alsa` \
+		`use_enable arts` \
+		`use_enable aalib` \
+		`use_enable oggvorbis ogg` `use_enable oggvorbis vorbis` \
+		`use_enable sdl sdltest` \
+		`use_enable ipv6` \
+		`use_enable directfb` \
+		${myconf} || die "Configure failed"
+
+	emake -j1 || die "Parallel make failed"
+}
+
+src_install() {
+	einstall || die "Install failed"
+
+	# Xine's makefiles install some file incorrectly. (Gentoo bug #8583, #16112).
+	dodir /usr/share/xine/libxine1/fonts
+	mv ${D}/usr/share/*.xinefont.gz ${D}/usr/share/xine/libxine1/fonts/
+
+	dodoc AUTHORS COPYING ChangeLog INSTALL README TODO
+	cd ${S}/doc
+	dodoc dataflow.dia README*
+}
+
+pkg_postinst() {
+	einfo
+	einfo "Please note, a new version of xine-lib has been installed,"
+	einfo "for library consistency you need to unmerge old versions"
+	einfo "of xine-lib before merging xine-ui."
+	einfo
+	einfo "This library version 1 is incompatible with the plugins,"
+	einfo "designed for the prior library versions (such as xine-d4d,"
+	einfo "xine-d5d, xine-dmd, and xine-dvdnav."
+	einfo
+	einfo "Also make sure to remove your ~/.xine if upgrading from"
+	einfo "a previous version."
+	einfo
+}