games/openarena: Fix CVE-2017-6903

[kami]

Summary

games/openarena: Fix CVE-2017-6903

- Backport fix based on patchset for urbanterror [1]

[1] https://github.com/Barbatos/ioq3-for-UrbanTerror-4/pull/73

PR: 217911
#Reviewed by: miwi
Approved by: miwi (mentor)
MFH: 2017Q2
Security: CVE-2017-6903
Security: e48355d7-1548-11e7-8611-0090f5f2f347
#Differential Revision: D10176

Test Plan

Poudriere on all 10.3 and 11.0 completed.
bsda2/makeplist (tests all options individually) completed.

[koobs]

• Add a VuXML entry, add it to this changeset (even if committed separately)
• Security: should point to a VuXML (UU)ID (created in previous step), please update SUMMARY
• Add MFH: XXXQX to commit log (SUMMARY) for documenting a merge to quarterly branch
• For reference lines, [X] should be at the beginning of the line. Eg: [1] https://github.com/mickael9/ioq3-for-UrbanTerror-4/tree/fix-cve-2017-6903 not at the end.
• Ideally link to pull requests or issues, not repositories as they don't immediately show the changeset. Update URL to [1] https://github.com/Barbatos/ioq3-for-UrbanTerror-4/pull/73
• For patches with upstream references (commits, bugs, mailing lists), add comments to the patch header, like: https://patch-diff.githubusercontent.com/raw/Barbatos/ioq3-for-UrbanTerror-4/pull/73.patch

[kami]

In D10176#210717, @koobs wrote:

• For patches with upstream references (commits, bugs, mailing lists), add comments to the patch header, like: https://patch-diff.githubusercontent.com/raw/Barbatos/ioq3-for-UrbanTerror-4/pull/73.patch

I made the other changes, but that seems very impractical. Should I add that to every patch file?

How do I document which section of the patch is part of which change/security fix?

[kami]

• Explicitly use sdl (master switched to sdl)
• USES=tar:bzip2 instead of EXTRACT_SUFX

[kami]

build logs:
https://people.freebsd.org/~kami/poudriere/openarena-0.8.8.s1910_3,1.log
https://people.freebsd.org/~kami/poudriere/openarena-server-0.8.8.s1910_3,1.log