Add patch to resolve buffer overflow. Bug 329031.

(Portage version: 2.2.0_alpha90/cvs/Linux x86_64)

3 files changed, 88 insertions, 1 deletions

diff --git a/net-libs/libvncserver/ChangeLog b/net-libs/libvncserver/ChangeLog
index 1aa257538f02..cd6963757a3e 100644
--- a/net-libs/libvncserver/ChangeLog
+++ b/net-libs/libvncserver/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-libs/libvncserver
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/ChangeLog,v 1.50 2012/03/08 02:49:25 floppym Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/ChangeLog,v 1.51 2012/03/08 03:32:17 floppym Exp $
+
+*libvncserver-0.9.8.2-r1 (08 Mar 2012)
+
+  08 Mar 2012; Mike Gilbert <floppym@gentoo.org>
+  +files/libvncserver-memcpy.patch, +libvncserver-0.9.8.2-r1.ebuild:
+  Add patch to resolve buffer overflow. Bug 329031.
 
   08 Mar 2012; Mike Gilbert <floppym@gentoo.org> metadata.xml:
   Make myself the maintainer.
diff --git a/net-libs/libvncserver/files/libvncserver-memcpy.patch b/net-libs/libvncserver/files/libvncserver-memcpy.patch
new file mode 100644
index 000000000000..af5289e68d21
--- /dev/null
+++ b/net-libs/libvncserver/files/libvncserver-memcpy.patch
@@ -0,0 +1,23 @@
+Fix a buffer overflow on platforms where sizeof(long) > sizeof(int).
+https://bugs.gentoo.org/show_bug.cgi?id=329031
+
+--- libvncserver/tightvnc-filetransfer/filetransfermsg.c
++++ libvncserver/tightvnc-filetransfer/filetransfermsg.c
+@@ -393,7 +393,7 @@
+ CreateFileDownloadZeroSizeDataMsg(unsigned long mTime)
+ {
+ 	FileTransferMsg fileDownloadZeroSizeDataMsg;
+-	int length = sz_rfbFileDownloadDataMsg + sizeof(int);
++	int length = sz_rfbFileDownloadDataMsg + sizeof(mTime);
+ 	rfbFileDownloadDataMsg *pFDD = NULL;
+ 	char *pFollow = NULL;
+ 	
+@@ -413,7 +413,7 @@
+ 	pFDD->compressedSize = Swap16IfLE(0);
+ 	pFDD->realSize = Swap16IfLE(0);
+ 	
+-	memcpy(pFollow, &mTime, sizeof(unsigned long));
++	memcpy(pFollow, &mTime, sizeof(mTime));
+ 
+ 	fileDownloadZeroSizeDataMsg.data	= pData;
+ 	fileDownloadZeroSizeDataMsg.length	= length;
diff --git a/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild b/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild
new file mode 100644
index 000000000000..635ba25ad8c7
--- /dev/null
+++ b/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/libvncserver/libvncserver-0.9.8.2-r1.ebuild,v 1.1 2012/03/08 03:32:17 floppym Exp $
+
+EAPI="4"
+
+inherit eutils libtool
+
+DESCRIPTION="library for creating vnc servers"
+HOMEPAGE="http://libvncserver.sourceforge.net/"
+SRC_URI="http://libvncserver.sourceforge.net/LibVNCServer-${PV/_}.tar.gz
+	mirror://sourceforge/libvncserver/LibVNCServer-${PV/_}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd ~amd64-linux ~x86-linux"
+IUSE="no24bpp crypt gnutls ipv6 +jpeg test threads +zlib"
+
+DEPEND="crypt? ( dev-libs/libgcrypt )
+	gnutls? ( net-libs/gnutls )
+	jpeg? ( virtual/jpeg )
+	zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}"/LibVNCServer-${PV/_}
+
+src_prepare() {
+	sed -i -r \
+		-e '/^CFLAGS =/d' \
+		-e "/^SUBDIRS/s:\<($(use test || echo 'test|')client_examples|examples)\>::g" \
+		Makefile.in || die
+
+	# Bug 329031.
+	epatch "${FILESDIR}/${PN}-memcpy.patch"
+
+	elibtoolize
+}
+
+src_configure() {
+	econf \
+		--without-x11vnc \
+		$(use_with !no24bpp 24bpp) \
+		$(use_with crypt gcrypt) \
+		$(use_with ipv6) \
+		$(use_with jpeg) \
+		$(use_with threads pthread) \
+		$(use_with zlib)
+}
+
+src_compile() {
+	default
+	emake -C examples noinst_PROGRAMS=storepasswd
+}
+
+src_install() {
+	emake install DESTDIR="${D}"
+	dodoc AUTHORS ChangeLog NEWS README TODO
+}