From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 0240E138334 for ; Thu, 15 Aug 2019 11:36:26 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1E77CE07D7; Thu, 15 Aug 2019 11:36:26 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id F044FE07D7 for ; Thu, 15 Aug 2019 11:36:25 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 16870349BC9 for ; Thu, 15 Aug 2019 11:36:23 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 2EAF04D4 for ; Thu, 15 Aug 2019 11:36:21 +0000 (UTC) From: "Mart Raudsepp" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mart Raudsepp" Message-ID: <1565868956.39892b09bb0b45155d545c6fd9fec43a99ca4ecc.leio@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: x11-libs/pango/files/, x11-libs/pango/ X-VCS-Repository: repo/gentoo X-VCS-Files: x11-libs/pango/files/1.42.4-CVE-2019-1010238.patch x11-libs/pango/pango-1.42.4-r2.ebuild X-VCS-Directories: x11-libs/pango/ x11-libs/pango/files/ X-VCS-Committer: leio X-VCS-Committer-Name: Mart Raudsepp X-VCS-Revision: 39892b09bb0b45155d545c6fd9fec43a99ca4ecc X-VCS-Branch: master Date: Thu, 15 Aug 2019 11:36:21 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 572a8dc6-1d4a-4aa9-a973-bc55c07fca71 X-Archives-Hash: 5445723f18d55dcd358d3471332b8225 commit: 39892b09bb0b45155d545c6fd9fec43a99ca4ecc Author: Mart Raudsepp gentoo org> AuthorDate: Thu Aug 15 11:30:15 2019 +0000 Commit: Mart Raudsepp gentoo org> CommitDate: Thu Aug 15 11:35:56 2019 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=39892b09 x11-libs/pango: fix CVE-2019-1010238 Bug: https://bugs.gentoo.org/692110 Package-Manager: Portage-2.3.62, Repoman-2.3.12 Signed-off-by: Mart Raudsepp gentoo.org> x11-libs/pango/files/1.42.4-CVE-2019-1010238.patch | 34 ++++++++++ x11-libs/pango/pango-1.42.4-r2.ebuild | 72 ++++++++++++++++++++++ 2 files changed, 106 insertions(+) diff --git a/x11-libs/pango/files/1.42.4-CVE-2019-1010238.patch b/x11-libs/pango/files/1.42.4-CVE-2019-1010238.patch new file mode 100644 index 00000000000..eaf0784c1b3 --- /dev/null +++ b/x11-libs/pango/files/1.42.4-CVE-2019-1010238.patch @@ -0,0 +1,34 @@ +From 490f8979a260c16b1df055eab386345da18a2d54 Mon Sep 17 00:00:00 2001 +From: Matthias Clasen +Date: Wed, 10 Jul 2019 20:26:23 -0400 +Subject: [PATCH] bidi: Be safer against bad input + +Don't run off the end of an array that we +allocated to certain length. + +Closes: https://gitlab.gnome.org/GNOME/pango/issues/342 +--- + pango/pango-bidi-type.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/pango/pango-bidi-type.c b/pango/pango-bidi-type.c +index 3e46b66c..5c02dbbb 100644 +--- a/pango/pango-bidi-type.c ++++ b/pango/pango-bidi-type.c +@@ -181,8 +181,11 @@ pango_log2vis_get_embedding_levels (const gchar *text, + for (i = 0, p = text; p < text + length; p = g_utf8_next_char(p), i++) + { + gunichar ch = g_utf8_get_char (p); +- FriBidiCharType char_type; +- char_type = fribidi_get_bidi_type (ch); ++ FriBidiCharType char_type = fribidi_get_bidi_type (ch); ++ ++ if (i == n_chars) ++ break; ++ + bidi_types[i] = char_type; + ored_types |= char_type; + if (FRIBIDI_IS_STRONG (char_type)) +-- +2.21.0 + diff --git a/x11-libs/pango/pango-1.42.4-r2.ebuild b/x11-libs/pango/pango-1.42.4-r2.ebuild new file mode 100644 index 00000000000..7d103157839 --- /dev/null +++ b/x11-libs/pango/pango-1.42.4-r2.ebuild @@ -0,0 +1,72 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 +GNOME2_LA_PUNT="yes" + +inherit gnome2 multilib-minimal toolchain-funcs + +DESCRIPTION="Internationalized text layout and rendering library" +HOMEPAGE="https://www.pango.org/" +SRC_URI+=" https://dev.gentoo.org/~leio/distfiles/${P}-patchset.tar.xz" + +LICENSE="LGPL-2+ FTL" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" + +IUSE="X +introspection test" + +RDEPEND=" + >=media-libs/harfbuzz-1.4.2:=[glib(+),truetype(+),${MULTILIB_USEDEP}] + >=dev-libs/glib-2.50.2:2[${MULTILIB_USEDEP}] + >=media-libs/fontconfig-2.12.92:1.0=[${MULTILIB_USEDEP}] + >=media-libs/freetype-2.5.0.1:2=[${MULTILIB_USEDEP}] + >=x11-libs/cairo-1.12.14-r4:=[X?,${MULTILIB_USEDEP}] + >=dev-libs/fribidi-0.19.7[${MULTILIB_USEDEP}] + introspection? ( >=dev-libs/gobject-introspection-0.9.5:= ) + X? ( + >=x11-libs/libXrender-0.9.8[${MULTILIB_USEDEP}] + >=x11-libs/libX11-1.6.2[${MULTILIB_USEDEP}] + >=x11-libs/libXft-2.3.1-r1[${MULTILIB_USEDEP}] + ) +" +DEPEND="${RDEPEND} + dev-util/glib-utils + >=dev-util/gtk-doc-am-1.20 + virtual/pkgconfig[${MULTILIB_USEDEP}] + test? ( media-fonts/cantarell ) + X? ( x11-base/xorg-proto ) + !<=sys-devel/autoconf-2.63:2.5 +" + +PATCHES=( + "${WORKDIR}"/patches/ # bug fix cherry-picks from master by 20190216; each patch has commit id of origin/master included and will be part of 1.43.1/1.44 + "${FILESDIR}"/${PV}-CVE-2019-1010238.patch +) + +src_prepare() { + gnome2_src_prepare + # This should be updated if next release fails to pre-generate the manpage as well, or src_prepare removed if is properly generated + # https://gitlab.gnome.org/GNOME/pango/issues/270 + cp -v "${FILESDIR}"/${PV}-pango-view.1.in "${S}/utils/pango-view.1.in" || die +} + +multilib_src_configure() { + tc-export CXX + + ECONF_SOURCE=${S} \ + gnome2_src_configure \ + --with-cairo \ + $(multilib_native_use_enable introspection) \ + $(use_with X xft) \ + "$(usex X --x-includes="${EPREFIX}/usr/include" "")" \ + "$(usex X --x-libraries="${EPREFIX}/usr/$(get_libdir)" "")" + + if multilib_is_native_abi; then + ln -s "${S}"/docs/html docs/html || die + fi +} + +multilib_src_install() { + gnome2_src_install +}