Index: head/graphics/libwmf/Makefile =================================================================== --- head/graphics/libwmf/Makefile (revision 559850) +++ head/graphics/libwmf/Makefile (revision 559851) @@ -1,54 +1,60 @@ # Created by: Chris Piazza # $FreeBSD$ PORTNAME= libwmf -PORTVERSION= 0.2.8.4 -PORTREVISION= 15 +DISTVERSIONPREFIX= v +DISTVERSION= 0.2.12 CATEGORIES= graphics -MASTER_SITES= SF/wvware/${PORTNAME}/${PORTVERSION} MAINTAINER= ports@FreeBSD.org COMMENT= Tools and library for converting Microsoft WMF (windows metafile) LICENSE= GPLv2+ LICENSE_FILE= ${WRKSRC}/COPYING LIB_DEPENDS= libpng.so:graphics/png \ - libfreetype.so:print/freetype2 + libfreetype.so:print/freetype2 \ + libgd.so:graphics/gd \ + libexpat.so:textproc/expat2 -USES= gnome jpeg libtool -USE_GNOME= libxml2 +USES= autoreconf:build jpeg libtool localbase pkgconfig +USE_GITHUB= yes +GH_ACCOUNT= caolanm USE_LDCONFIG= yes GNU_CONFIGURE= yes -CONFIGURE_ARGS= --with-sys-gd=no \ - --with-png=${LOCALBASE} --with-jpeg=${LOCALBASE} \ - --with-gsfontdir=${LOCALBASE}/share/ghostscript/fonts +CONFIGURE_ARGS= --with-gsfontdir=${LOCALBASE}/share/ghostscript/fonts INSTALL_TARGET= install-strip PORTDOCS= * CONFLICTS?= libwmf-nox11-[0-9]* OPTIONS_DEFINE= X11 DOCS OPTIONS_DEFAULT=X11 OPTIONS_SUB= yes X11_USES= xorg X11_USE= XORG=x11 X11_CONFIGURE_OFF=--with-x=no +pre-configure: + @(cd ${CONFIGURE_WRKSRC} && ${SETENV} AUTOHEADER="${TRUE}" \ + ${LOCALBASE}/bin/autoreconf -vif -Ipatches) + +post-configure: + @${REINPLACE_CMD} -e 's|autoheader|autoheader -Ipatches|g' \ + ${WRKSRC}/Makefile + post-patch: - @${REINPLACE_CMD} -e 's|src include fonts doc|src include fonts|g' \ - ${WRKSRC}/Makefile.in @${REINPLACE_CMD} -e \ 's|@LIBWMF_GDK_PIXBUF_TRUE@|#|g ; \ s|@LIBWMF_GDK_PIXBUF_FALSE@||g ; \ s|: install-loaderLTLIBRARIES|:|g' ${WRKSRC}/src/Makefile.in post-install-DOCS-on: @${MKDIR} ${STAGEDIR}${DOCSDIR} @${TAR} -C ${WRKSRC}/doc --exclude '*Makefile*' -cf - . | \ ${TAR} -C ${STAGEDIR}${DOCSDIR} --unlink -xf - .include Index: head/graphics/libwmf/distinfo =================================================================== --- head/graphics/libwmf/distinfo (revision 559850) +++ head/graphics/libwmf/distinfo (revision 559851) @@ -1,2 +1,3 @@ -SHA256 (libwmf-0.2.8.4.tar.gz) = 5b345c69220545d003ad52bfd035d5d6f4f075e65204114a9e875e84895a7cf8 -SIZE (libwmf-0.2.8.4.tar.gz) = 2169375 +TIMESTAMP = 1608812851 +SHA256 (caolanm-libwmf-v0.2.12_GH0.tar.gz) = 464ff63605d7eaf61a4a12dbd420f7a41a4d854675d8caf37729f5bc744820e2 +SIZE (caolanm-libwmf-v0.2.12_GH0.tar.gz) = 3043572 Index: head/graphics/libwmf/files/patch-rh1227243-CVE-2015-0848 =================================================================== --- head/graphics/libwmf/files/patch-rh1227243-CVE-2015-0848 (revision 559850) +++ head/graphics/libwmf/files/patch-rh1227243-CVE-2015-0848 (nonexistent) @@ -1,20 +0,0 @@ ---- src/ipa/ipa/bmp.h 2015-06-02 11:35:04.072201795 +0100 -+++ src/ipa/ipa/bmp.h 2015-06-02 11:35:20.647406414 +0100 -@@ -1145,8 +1143,15 @@ - } - } - else -- { /* Convert run-length encoded raster pixels. */ -- DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image); -+ { -+ if (bmp_info.bits_per_pixel == 8) /* Convert run-length encoded raster pixels. */ -+ { -+ DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image); -+ } -+ else -+ { WMF_ERROR (API,"Unexpected pixel depth"); -+ API->err = wmf_E_BadFormat; -+ } - } - - if (ERR (API)) Property changes on: head/graphics/libwmf/files/patch-rh1227243-CVE-2015-0848 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2007-3472 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2007-3472 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2007-3472 (nonexistent) @@ -1,61 +0,0 @@ -Patch modified slightly from upstream CentOS version - ---- src/extra/gd/gd.c -+++ src/extra/gd/gd.c -@@ -106,6 +106,18 @@ - gdImagePtr im; - unsigned long cpa_size; - -+ if (overflow2(sx, sy)) { -+ return NULL; -+ } -+ -+ if (overflow2(sizeof (int *), sy)) { -+ return NULL; -+ } -+ -+ if (overflow2(sizeof(int), sx)) { -+ return NULL; -+ } -+ - im = (gdImage *) gdMalloc (sizeof (gdImage)); - if (im == 0) return 0; - memset (im, 0, sizeof (gdImage)); ---- src/extra/gd/gdhelpers.c 2010-12-06 11:47:31.000000000 +0000 -+++ src/extra/gd/gdhelpers.c 2010-12-06 11:48:04.000000000 +0000 -@@ -2,6 +2,7 @@ - #include "gdhelpers.h" - #include - #include -+#include - - /* TBB: gd_strtok_r is not portable; provide an implementation */ - -@@ -94,3 +95,18 @@ - { - free (ptr); - } -+ -+int overflow2(int a, int b) -+{ -+ if(a < 0 || b < 0) { -+ fprintf(stderr, "gd warning: one parameter to a memory allocation multiplication is negative, failing operation gracefully\n"); -+ return 1; -+ } -+ if(b == 0) -+ return 0; -+ if(a > INT_MAX / b) { -+ fprintf(stderr, "gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\n"); -+ return 1; -+ } -+ return 0; -+} ---- src/extra/gd/gdhelpers.h 2010-12-06 11:47:17.000000000 +0000 -+++ src/extra/gd/gdhelpers.h 2010-12-06 11:48:36.000000000 +0000 -@@ -15,4 +15,6 @@ - void *gdMalloc(size_t size); - void *gdRealloc(void *ptr, size_t size); - -+int overflow2(int a, int b); -+ - #endif /* GDHELPERS_H */ Property changes on: head/graphics/libwmf/files/patch-CVE-2007-3472 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-cve-2009-1364 =================================================================== --- head/graphics/libwmf/files/patch-cve-2009-1364 (revision 559850) +++ head/graphics/libwmf/files/patch-cve-2009-1364 (nonexistent) @@ -1,10 +0,0 @@ ---- src/extra/gd/gd_clip.c -+++ src/extra/gd/gd_clip.c -@@ -70,6 +70,7 @@ - { more = gdRealloc (im->clip->list,(im->clip->max + 8) * sizeof (gdClipRectangle)); - if (more == 0) return; - im->clip->max += 8; -+ im->clip->list = more; - } - im->clip->list[im->clip->count] = (*rect); - im->clip->count++; Property changes on: head/graphics/libwmf/files/patch-cve-2009-1364 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2007-0455 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2007-0455 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2007-0455 (nonexistent) @@ -1,11 +0,0 @@ ---- src/extra/gd/gdft.c 2010-12-06 11:18:26.000000000 +0000 -+++ src/extra/gd/gdft.c 2010-12-06 11:21:09.000000000 +0000 -@@ -811,7 +811,7 @@ - { - ch = c & 0xFF; /* don't extend sign */ - } -- next++; -+ if (*next) next++; - } - else - { Property changes on: head/graphics/libwmf/files/patch-CVE-2007-0455 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2007-3473 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2007-3473 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2007-3473 (nonexistent) @@ -1,13 +0,0 @@ ---- src/extra/gd/gd.c -+++ src/extra/gd/gd.c -@@ -2483,6 +2483,10 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm (FILE * fd) - } - bytes = (w * h / 8) + 1; - im = gdImageCreate (w, h); -+ if (!im) { -+ return 0; -+ } -+ - gdImageColorAllocate (im, 255, 255, 255); - gdImageColorAllocate (im, 0, 0, 0); - x = 0; Property changes on: head/graphics/libwmf/files/patch-CVE-2007-3473 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2009-3546 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2009-3546 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2009-3546 (nonexistent) @@ -1,13 +0,0 @@ ---- src/extra/gd/gd_gd.c 2010-12-06 14:56:06.000000000 +0000 -+++ src/extra/gd/gd_gd.c 2010-12-06 14:57:04.000000000 +0000 -@@ -42,6 +42,10 @@ - { - goto fail1; - } -+ if (&im->colorsTotal > gdMaxColors) -+ { -+ goto fail1; -+ } - } - /* Int to accommodate truecolor single-color transparency */ - if (!gdGetInt (&im->transparent, in)) Property changes on: head/graphics/libwmf/files/patch-CVE-2009-3546 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-cve-2006-3376 =================================================================== --- head/graphics/libwmf/files/patch-cve-2006-3376 (revision 559850) +++ head/graphics/libwmf/files/patch-cve-2006-3376 (nonexistent) @@ -1,27 +0,0 @@ ---- src/player.c -+++ src/player.c -@@ -23,6 +23,7 @@ - - #include - #include -+#include - #include - #include - -@@ -132,8 +133,14 @@ - } - } - --/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char)); -- */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); -+ if (MAX_REC_SIZE(API) > UINT32_MAX / 2) -+ { -+ API->err = wmf_E_InsMem; -+ WMF_DEBUG (API,"bailing..."); -+ return (API->err); -+ } -+ -+ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); - - if (ERR (API)) - { WMF_DEBUG (API,"bailing..."); Property changes on: head/graphics/libwmf/files/patch-cve-2006-3376 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2007-2756 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2007-2756 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2007-2756 (nonexistent) @@ -1,16 +0,0 @@ ---- src/extra/gd/gd_png.c 1 Apr 2007 20:41:01 -0000 1.21.2.1 -+++ src/extra/gd/gd_png.c 16 May 2007 19:06:11 -0000 -@@ -78,8 +78,11 @@ - gdPngReadData (png_structp png_ptr, - png_bytep data, png_size_t length) - { -- gdGetBuf (data, length, (gdIOCtx *) -- png_get_io_ptr (png_ptr)); -+ int check; -+ check = gdGetBuf (data, length, (gdIOCtx *) png_get_io_ptr (png_ptr)); -+ if (check != length) { -+ png_error(png_ptr, "Read Error: truncated data"); -+ } - } - - static void Property changes on: head/graphics/libwmf/files/patch-CVE-2007-2756 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CVE-2007-3477 =================================================================== --- head/graphics/libwmf/files/patch-CVE-2007-3477 (revision 559850) +++ head/graphics/libwmf/files/patch-CVE-2007-3477 (nonexistent) @@ -1,38 +0,0 @@ ---- src/extra/gd/gd.c -+++ src/extra/gd/gd.c -@@ -1335,10 +1335,31 @@ - int w2, h2; - w2 = w / 2; - h2 = h / 2; -- while (e < s) -- { -- e += 360; -- } -+ -+ if ((s % 360) == (e % 360)) { -+ s = 0; e = 360; -+ } else { -+ if (s > 360) { -+ s = s % 360; -+ } -+ -+ if (e > 360) { -+ e = e % 360; -+ } -+ -+ while (s < 0) { -+ s += 360; -+ } -+ -+ while (e < s) { -+ e += 360; -+ } -+ -+ if (s == e) { -+ s = 0; e = 360; -+ } -+ } -+ - for (i = s; (i <= e); i++) - { - int x, y; Property changes on: head/graphics/libwmf/files/patch-CVE-2007-3477 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-deb784192-CVE-2015-4696 =================================================================== --- head/graphics/libwmf/files/patch-deb784192-CVE-2015-4696 (revision 559850) +++ head/graphics/libwmf/files/patch-deb784192-CVE-2015-4696 (nonexistent) @@ -1,23 +0,0 @@ ---- src/player/meta.h -+++ src/player/meta.h -@@ -2585,6 +2585,8 @@ - polyrect.BR[i] = clip->rects[i].BR; - } - -+ if (FR->region_clip) FR->region_clip (API,&polyrect); -+ - wmf_free (API,polyrect.TL); - wmf_free (API,polyrect.BR); - } -@@ -2593,9 +2595,10 @@ - polyrect.BR = 0; - - polyrect.count = 0; -+ -+ if (FR->region_clip) FR->region_clip (API,&polyrect); - } - -- if (FR->region_clip) FR->region_clip (API,&polyrect); - - return (changed); - } Property changes on: head/graphics/libwmf/files/patch-deb784192-CVE-2015-4696 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-deb784205-CVE-2015-4695 =================================================================== --- head/graphics/libwmf/files/patch-deb784205-CVE-2015-4695 (revision 559850) +++ head/graphics/libwmf/files/patch-deb784205-CVE-2015-4695 (nonexistent) @@ -1,58 +0,0 @@ -Index: src/player/meta.h -=================================================================== ---- libwmf-0.2.8.4.orig/src/player/meta.h -+++ src/player/meta.h -@@ -1565,7 +1565,7 @@ static int meta_rgn_create (wmfAPI* API, - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); -@@ -2142,7 +2142,7 @@ static int meta_dib_brush (wmfAPI* API,w - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); -@@ -3067,7 +3067,7 @@ static int meta_pen_create (wmfAPI* API, - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); -@@ -3181,7 +3181,7 @@ static int meta_brush_create (wmfAPI* AP - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); -@@ -3288,7 +3288,7 @@ static int meta_font_create (wmfAPI* API - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); -@@ -3396,7 +3396,7 @@ static int meta_palette_create (wmfAPI* - objects = P->objects; - - i = 0; -- while (objects[i].type && (i < NUM_OBJECTS (API))) i++; -+ while ((i < NUM_OBJECTS (API)) && objects[i].type) i++; - - if (i == NUM_OBJECTS (API)) - { WMF_ERROR (API,"Object out of range!"); Property changes on: head/graphics/libwmf/files/patch-deb784205-CVE-2015-4695 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-gd_png.c =================================================================== --- head/graphics/libwmf/files/patch-gd_png.c (revision 559850) +++ head/graphics/libwmf/files/patch-gd_png.c (nonexistent) @@ -1,11 +0,0 @@ ---- src/extra/gd/gd_png.c.orig 2010-03-28 12:44:53.000000000 +0200 -+++ src/extra/gd/gd_png.c 2010-03-28 12:45:16.000000000 +0200 -@@ -136,7 +136,7 @@ - /* first do a quick check that the file really is a PNG image; could - * have used slightly more general png_sig_cmp() function instead */ - gdGetBuf (sig, 8, infile); -- if (!png_check_sig (sig, 8)) -+ if (png_sig_cmp (sig, 0, 8)) - return NULL; /* bad signature */ - - #ifndef PNG_SETJMP_NOT_SUPPORTED Property changes on: head/graphics/libwmf/files/patch-gd_png.c ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-CAN-2004-0941 =================================================================== --- head/graphics/libwmf/files/patch-CAN-2004-0941 (revision 559850) +++ head/graphics/libwmf/files/patch-CAN-2004-0941 (nonexistent) @@ -1,17 +0,0 @@ ---- src/extra/gd/gd_png.c 2004-11-11 14:02:37.407589824 -0500 -+++ src/extra/gd/gd_png.c 2004-11-11 14:04:29.672522960 -0500 -@@ -188,6 +188,14 @@ - - png_get_IHDR (png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, - &interlace_type, NULL, NULL); -+ if (overflow2(sizeof (int), width)) -+ { -+ return NULL; -+ } -+ if (overflow2(sizeof (int) * width, height)) -+ { -+ return NULL; -+ } - if ((color_type == PNG_COLOR_TYPE_RGB) || - (color_type == PNG_COLOR_TYPE_RGB_ALPHA)) - { Property changes on: head/graphics/libwmf/files/patch-CAN-2004-0941 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-rh1227243-CVE-2015-4588 =================================================================== --- head/graphics/libwmf/files/patch-rh1227243-CVE-2015-4588 (revision 559850) +++ head/graphics/libwmf/files/patch-rh1227243-CVE-2015-4588 (nonexistent) @@ -1,111 +0,0 @@ -diff -ru src/ipa/ipa/bmp.h src/ipa/ipa/bmp.h ---- src/ipa/ipa/bmp.h 2015-06-03 09:30:59.410501271 +0100 -+++ src/ipa/ipa/bmp.h 2015-06-03 09:31:05.775572630 +0100 -@@ -859,7 +859,7 @@ - % - % - */ --static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels) -+static int DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels) - { int byte; - int count; - int i; -@@ -870,12 +870,14 @@ - U32 u; - - unsigned char* q; -+ unsigned char* end; - - for (u = 0; u < ((U32) bmp->width * (U32) bmp->height); u++) pixels[u] = 0; - - byte = 0; - x = 0; - q = pixels; -+ end = pixels + bmp->width * bmp->height; - - for (y = 0; y < bmp->height; ) - { count = ReadBlobByte (src); -@@ -884,7 +886,10 @@ - { /* Encoded mode. */ - byte = ReadBlobByte (src); - for (i = 0; i < count; i++) -- { if (compression == 1) -+ { -+ if (q == end) -+ return 0; -+ if (compression == 1) - { (*(q++)) = (unsigned char) byte; - } - else -@@ -896,13 +901,15 @@ - else - { /* Escape mode. */ - count = ReadBlobByte (src); -- if (count == 0x01) return; -+ if (count == 0x01) return 1; - switch (count) - { - case 0x00: - { /* End of line. */ - x = 0; - y++; -+ if (y >= bmp->height) -+ return 0; - q = pixels + y * bmp->width; - break; - } -@@ -910,13 +917,20 @@ - { /* Delta mode. */ - x += ReadBlobByte (src); - y += ReadBlobByte (src); -+ if (y >= bmp->height) -+ return 0; -+ if (x >= bmp->width) -+ return 0; - q = pixels + y * bmp->width + x; - break; - } - default: - { /* Absolute mode. */ - for (i = 0; i < count; i++) -- { if (compression == 1) -+ { -+ if (q == end) -+ return 0; -+ if (compression == 1) - { (*(q++)) = ReadBlobByte (src); - } - else -@@ -943,7 +957,7 @@ - byte = ReadBlobByte (src); /* end of line */ - byte = ReadBlobByte (src); - -- return; -+ return 1; - } - - /* -@@ -1146,7 +1160,10 @@ - { - if (bmp_info.bits_per_pixel == 8) /* Convert run-length encoded raster pixels. */ - { -- DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image); -+ if (!DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image)) -+ { WMF_ERROR (API,"corrupt bmp"); -+ API->err = wmf_E_BadFormat; -+ } - } - else - { WMF_ERROR (API,"Unexpected pixel depth"); -diff -ru src/ipa/ipa.h src/ipa/ipa.h ---- src/ipa/ipa.h 2015-06-03 09:30:59.410501271 +0100 -+++ src/ipa/ipa.h 2015-06-03 09:31:08.687605277 +0100 -@@ -48,7 +48,7 @@ - static unsigned short ReadBlobLSBShort (BMPSource*); - static unsigned long ReadBlobLSBLong (BMPSource*); - static long TellBlob (BMPSource*); --static void DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*); -+static int DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*); - static void ReadBMPImage (wmfAPI*,wmfBMP*,BMPSource*); - static int ExtractColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned int,unsigned int); - static void SetColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned char,unsigned int,unsigned int); Property changes on: head/graphics/libwmf/files/patch-rh1227243-CVE-2015-4588 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/graphics/libwmf/files/patch-configure.ac =================================================================== --- head/graphics/libwmf/files/patch-configure.ac (nonexistent) +++ head/graphics/libwmf/files/patch-configure.ac (revision 559851) @@ -0,0 +1,51 @@ +--- configure.ac.orig 2019-02-01 17:51:32 UTC ++++ configure.ac +@@ -391,40 +391,19 @@ AC_ARG_WITH(freetype,[ --with-freetype=DIR use fr + fi + ]) + +-if [ test -n "$FREETYPE_DIR" ]; then +- AC_PATH_PROG(FREETYPE_CONFIG,freetype-config, ,[$FREETYPE_DIR/bin:$PATH]) +-else +- AC_PATH_PROG(FREETYPE_CONFIG,freetype-config) +-fi ++PKG_CHECK_MODULES(FREETYPE2, freetype2, ++ CFLAGS="$CFLAGS $FREETYPE2_CFLAGS" ++ LDFLAGS="$LDFLAGS $FREETYPE2_LIBS", ++ AC_MSG_ERROR([*** Unable to find FreeType2 library (http://www.freetype.org/)]) ++) + +-if [ test -n "$FREETYPE_CONFIG" ]; then +- if [ test -n "$FREETYPE_DIR" ]; then +- freetype_cflags="`$FREETYPE_CONFIG --cflags` -I$FREETYPE_DIR/include" +- freetype_libs=`$FREETYPE_CONFIG --libs` +- else +- freetype_cflags=`$FREETYPE_CONFIG --cflags` +- freetype_libs=`$FREETYPE_CONFIG --libs` +- fi +-else +- if [ test -n "$FREETYPE_DIR" ]; then +- freetype_cflags="-I$FREETYPE_DIR/include/freetype2 -I$FREETYPE_DIR/include" +- freetype_libs="-L$FREETYPE_DIR/lib -lfreetype" +- else +- freetype_cflags="" +- freetype_libs="-lfreetype" +- fi +-fi +- +-CPPFLAGS="$freetype_cflags $CPPFLAGS" +-LDFLAGS="$LDFLAGS $freetype_libs" +- + AC_CHECK_LIB(freetype,FT_Init_FreeType,[ +- WMF_FT_LDFLAGS="$freetype_libs" ++ WMF_FT_LDFLAGS="$FREETYPE2_LIBS" + ],[ AC_MSG_ERROR([* * * freetype(2) is required * * *]) + ]) + AC_CHECK_HEADER(ft2build.h,[ +- WMF_FT_CFLAGS="$freetype_cflags" +- WMF_FT_CONFIG_CFLAGS="$freetype_cflags" ++ WMF_FT_CFLAGS="$FREETYPE2_CFLAGS" ++ WMF_FT_CONFIG_CFLAGS="$FREETYPE2_CFLAGS" + ],[ AC_MSG_ERROR([* * * freetype(2) is required * * *]) + ]) + Property changes on: head/graphics/libwmf/files/patch-configure.ac ___________________________________________________________________ Added: fbsd:nokeywords ## -0,0 +1 ## +ON \ No newline at end of property Index: head/graphics/libwmf/files/patch-src_extra_gd_gd__png.c =================================================================== --- head/graphics/libwmf/files/patch-src_extra_gd_gd__png.c (nonexistent) +++ head/graphics/libwmf/files/patch-src_extra_gd_gd__png.c (revision 559851) @@ -0,0 +1,11 @@ +--- src/extra/gd/gd_png.c.orig 2019-02-01 17:51:32 UTC ++++ src/extra/gd/gd_png.c +@@ -138,7 +138,7 @@ gdImageCreateFromPngCtx (gdIOCtx * infile) + /* first do a quick check that the file really is a PNG image; could + * have used slightly more general png_sig_cmp() function instead */ + gdGetBuf (sig, 8, infile); +- if (!png_check_sig (sig, 8)) ++ if (png_sig_cmp (sig, 0, 8)) + return NULL; /* bad signature */ + + #ifndef PNG_SETJMP_NOT_SUPPORTED Property changes on: head/graphics/libwmf/files/patch-src_extra_gd_gd__png.c ___________________________________________________________________ Added: fbsd:nokeywords ## -0,0 +1 ## +yes \ No newline at end of property Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property Index: head/graphics/libwmf/pkg-plist =================================================================== --- head/graphics/libwmf/pkg-plist (revision 559850) +++ head/graphics/libwmf/pkg-plist (revision 559851) @@ -1,66 +1,67 @@ bin/libwmf-config bin/libwmf-fontmap bin/wmf2eps bin/wmf2fig bin/wmf2gd bin/wmf2svg %%X11%%bin/wmf2x include/libwmf/api.h include/libwmf/canvas.h include/libwmf/color.h include/libwmf/defs.h include/libwmf/eps.h include/libwmf/fig.h include/libwmf/font.h include/libwmf/foreign.h include/libwmf/fund.h include/libwmf/gd/gd.h include/libwmf/gd/gd_clip.h include/libwmf/gd/gd_io.h include/libwmf/gd/gdcache.h include/libwmf/gd/gdfontg.h include/libwmf/gd/gdfontl.h include/libwmf/gd/gdfontmb.h include/libwmf/gd/gdfonts.h include/libwmf/gd/gdfontt.h include/libwmf/gd.h include/libwmf/ipa.h include/libwmf/macro.h include/libwmf/svg.h include/libwmf/types.h include/libwmf/x.h lib/libwmf-0.2.so.7 -lib/libwmf-0.2.so.7.1.0 +lib/libwmf-0.2.so.7.1.4 lib/libwmf.a lib/libwmf.so lib/libwmflite-0.2.so.7 -lib/libwmflite-0.2.so.7.0.1 +lib/libwmflite-0.2.so.7.0.5 lib/libwmflite.a lib/libwmflite.so +libdata/pkgconfig/libwmf.pc %%DATADIR%%/fonts/fontmap -%%DATADIR%%/fonts/n019003l.afm -%%DATADIR%%/fonts/n019003l.pfb -%%DATADIR%%/fonts/n019004l.afm -%%DATADIR%%/fonts/n019004l.pfb -%%DATADIR%%/fonts/n019023l.afm -%%DATADIR%%/fonts/n019023l.pfb -%%DATADIR%%/fonts/n019024l.afm -%%DATADIR%%/fonts/n019024l.pfb -%%DATADIR%%/fonts/n021003l.afm -%%DATADIR%%/fonts/n021003l.pfb -%%DATADIR%%/fonts/n021004l.afm -%%DATADIR%%/fonts/n021004l.pfb -%%DATADIR%%/fonts/n021023l.afm -%%DATADIR%%/fonts/n021023l.pfb -%%DATADIR%%/fonts/n021024l.afm -%%DATADIR%%/fonts/n021024l.pfb -%%DATADIR%%/fonts/n022003l.afm -%%DATADIR%%/fonts/n022003l.pfb -%%DATADIR%%/fonts/n022004l.afm -%%DATADIR%%/fonts/n022004l.pfb -%%DATADIR%%/fonts/n022023l.afm -%%DATADIR%%/fonts/n022023l.pfb -%%DATADIR%%/fonts/n022024l.afm -%%DATADIR%%/fonts/n022024l.pfb -%%DATADIR%%/fonts/s050000l.afm -%%DATADIR%%/fonts/s050000l.pfb +%%DATADIR%%/fonts/NimbusMonoPS-Bold.afm +%%DATADIR%%/fonts/NimbusMonoPS-Bold.t1 +%%DATADIR%%/fonts/NimbusMonoPS-BoldItalic.afm +%%DATADIR%%/fonts/NimbusMonoPS-BoldItalic.t1 +%%DATADIR%%/fonts/NimbusMonoPS-Italic.afm +%%DATADIR%%/fonts/NimbusMonoPS-Italic.t1 +%%DATADIR%%/fonts/NimbusMonoPS-Regular.afm +%%DATADIR%%/fonts/NimbusMonoPS-Regular.t1 +%%DATADIR%%/fonts/NimbusRoman-Bold.afm +%%DATADIR%%/fonts/NimbusRoman-Bold.t1 +%%DATADIR%%/fonts/NimbusRoman-BoldItalic.afm +%%DATADIR%%/fonts/NimbusRoman-BoldItalic.t1 +%%DATADIR%%/fonts/NimbusRoman-Italic.afm +%%DATADIR%%/fonts/NimbusRoman-Italic.t1 +%%DATADIR%%/fonts/NimbusRoman-Regular.afm +%%DATADIR%%/fonts/NimbusRoman-Regular.t1 +%%DATADIR%%/fonts/NimbusSans-Bold.afm +%%DATADIR%%/fonts/NimbusSans-Bold.t1 +%%DATADIR%%/fonts/NimbusSans-BoldItalic.afm +%%DATADIR%%/fonts/NimbusSans-BoldItalic.t1 +%%DATADIR%%/fonts/NimbusSans-Italic.afm +%%DATADIR%%/fonts/NimbusSans-Italic.t1 +%%DATADIR%%/fonts/NimbusSans-Regular.afm +%%DATADIR%%/fonts/NimbusSans-Regular.t1 +%%DATADIR%%/fonts/StandardSymbolsPS.afm +%%DATADIR%%/fonts/StandardSymbolsPS.t1