media-gfx/optipng: CVE-2017-16938

Package-Manager: Portage-2.3.16, Repoman-2.3.6

2 files changed, 81 insertions, 0 deletions

diff --git a/media-gfx/optipng/files/optipng-0.7.6-cve-2017-16938.patch b/media-gfx/optipng/files/optipng-0.7.6-cve-2017-16938.patch
new file mode 100644
index 000000000000..71edf20cfefe
--- /dev/null
+++ b/media-gfx/optipng/files/optipng-0.7.6-cve-2017-16938.patch
@@ -0,0 +1,22 @@
+From e05fb81a20541833a2d62ce08552b18c0920b9a1 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Sat, 25 Nov 2017 23:17:46 -0500
+Subject: [PATCH] gifread: Detect indirect circular dependencies in LZW tables
+
+---
+ src/gifread/gifread.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/gifread/gifread.c b/src/gifread/gifread.c
+index 0123456789abcdef..0123456789abcdef 100644
+--- a/src/gifread/gifread.c
++++ b/src/gifread/gifread.c
+@@ -499,6 +499,8 @@ static int LZWReadByte(int init_flag, int input_code_size, FILE *stream)
+             *sp++ = table[1][code];
+             if (code == table[0][code])
+                 GIFError("GIF/LZW error: circular table entry");
++            if ((size_t)(sp - stack) >= sizeof(stack) / sizeof(stack[0]))
++                GIFError("GIF/LZW error: circular table");
+             code = table[0][code];
+         }
+ 
diff --git a/media-gfx/optipng/optipng-0.7.6-r2.ebuild b/media-gfx/optipng/optipng-0.7.6-r2.ebuild
new file mode 100644
index 000000000000..b5096a87c8f6
--- /dev/null
+++ b/media-gfx/optipng/optipng-0.7.6-r2.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Compress PNG files without affecting image quality"
+HOMEPAGE="http://optipng.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="ZLIB"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~ppc ~ppc64 ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~x86-solaris"
+IUSE=""
+
+RDEPEND="sys-libs/zlib
+	media-libs/libpng:0"
+DEPEND="${RDEPEND}
+	sys-apps/findutils"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-0.7.5-estonian.patch
+	epatch "${FILESDIR}"/${PN}-0.7.6-cve-2017-1000229.patch  # bug 637936
+	epatch "${FILESDIR}"/${PN}-0.7.6-cve-2017-16938.patch  # bug 639690
+
+	rm -R src/{libpng,zlib} || die
+	find . -type d -name build -exec rm -R {} + || die
+
+	# next release is almost a complete rewrite, so plug this compilation
+	# problem in anticipation of the much (c)leaner(?) rewrite
+	sed -i \
+		-e 's/^#ifdef AT_FDCWD/#if defined(AT_FDCWD) \&\& !(defined (__SVR4) \&\& defined (__sun))/' \
+		src/optipng/osys.c || die
+
+	tc-export CC AR RANLIB
+	export LD=$(tc-getCC)
+
+	eapply_user
+}
+
+src_configure() {
+	./configure \
+		-with-system-libpng \
+		-with-system-zlib \
+		|| die "configure failed"
+}
+
+src_compile() {
+	emake -C src/optipng
+}
+
+src_install() {
+	dodoc README.txt doc/*.txt
+	dohtml doc/*.html
+	doman src/${PN}/man/${PN}.1
+
+	dobin src/${PN}/${PN}
+}