Mon Apr 9 15:56:21 2012 UTC ()
Add patch for CVE-2012-1610 from http://www.imagemagick.org/discourse-server/viewtopic.php?t=20629


(tez)
diff -r1.178 -r1.179 pkgsrc/graphics/ImageMagick/Makefile
diff -r1.110 -r1.111 pkgsrc/graphics/ImageMagick/distinfo
diff -r0 -r1.1 pkgsrc/graphics/ImageMagick/patches/patch-magick_profile.c
diff -r1.1 -r1.2 pkgsrc/graphics/ImageMagick/patches/patch-magick_property.c
cvs diff -r1.178 -r1.179 pkgsrc/graphics/ImageMagick/Makefile (switch to unified diff)

--- pkgsrc/graphics/ImageMagick/Makefile 2012/03/30 03:50:47 1.178
+++ pkgsrc/graphics/ImageMagick/Makefile 2012/04/09 15:56:21 1.179
@@ -1,85 +1,85 @@ @@ -1,85 +1,85 @@
1# $NetBSD: Makefile,v 1.178 2012/03/30 03:50:47 taca Exp $ 1# $NetBSD: Makefile,v 1.179 2012/04/09 15:56:21 tez Exp $
2 2
3.include "Makefile.common" 3.include "Makefile.common"
4 4
5PKGNAME= ImageMagick-${DISTVERSION} 5PKGNAME= ImageMagick-${DISTVERSION}
6PKGREVISION= 1 6PKGREVISION= 2
7 7
8MAINTAINER= adam@NetBSD.org 8MAINTAINER= adam@NetBSD.org
9COMMENT= Package for display and interactive manipulation of images 9COMMENT= Package for display and interactive manipulation of images
10 10
11CONFLICTS= geomview<1.8.1nb2 # used to have a program named 'animate' 11CONFLICTS= geomview<1.8.1nb2 # used to have a program named 'animate'
12 12
13PKG_DESTDIR_SUPPORT= user-destdir 13PKG_DESTDIR_SUPPORT= user-destdir
14PKG_INSTALLATION_TYPES= overwrite pkgviews 14PKG_INSTALLATION_TYPES= overwrite pkgviews
15 15
16USE_LANGUAGES= c c++ c99 16USE_LANGUAGES= c c++ c99
17USE_TOOLS+= gmake pkg-config 17USE_TOOLS+= gmake pkg-config
18CONFIGURE_ARGS+= --disable-assert 18CONFIGURE_ARGS+= --disable-assert
19CONFIGURE_ARGS+= --with-fontconfig 19CONFIGURE_ARGS+= --with-fontconfig
20CONFIGURE_ARGS+= --with-ltdl-include=${BUILDLINK_PREFIX.libltdl}/include 20CONFIGURE_ARGS+= --with-ltdl-include=${BUILDLINK_PREFIX.libltdl}/include
21CONFIGURE_ARGS+= --with-ltdl-lib=${BUILDLINK_PREFIX.libltdl}/lib 21CONFIGURE_ARGS+= --with-ltdl-lib=${BUILDLINK_PREFIX.libltdl}/lib
22CONFIGURE_ARGS+= --with-xml=yes 22CONFIGURE_ARGS+= --with-xml=yes
23CONFIGURE_ARGS+= --without-perl 23CONFIGURE_ARGS+= --without-perl
24PKGCONFIG_OVERRIDE= Magick++/lib/ImageMagick++.pc.in 24PKGCONFIG_OVERRIDE= Magick++/lib/ImageMagick++.pc.in
25PKGCONFIG_OVERRIDE+= magick/ImageMagick.pc.in 25PKGCONFIG_OVERRIDE+= magick/ImageMagick.pc.in
26 26
27GCC_REQD+= 2.95.3 27GCC_REQD+= 2.95.3
28 28
29PLIST_SUBST+= IM_MAJOR_VER=${IM_MAJOR_VER:Q} 29PLIST_SUBST+= IM_MAJOR_VER=${IM_MAJOR_VER:Q}
30PLIST_SUBST+= IM_MAJOR_LIB_VER=${IM_MAJOR_LIB_VER:Q} 30PLIST_SUBST+= IM_MAJOR_LIB_VER=${IM_MAJOR_LIB_VER:Q}
31 31
32TEST_TARGET= check 32TEST_TARGET= check
33 33
34.include "options.mk" 34.include "options.mk"
35 35
36.if !empty(MACHINE_PLATFORM:MNetBSD-*-sparc64) 36.if !empty(MACHINE_PLATFORM:MNetBSD-*-sparc64)
37GCC_REQD+= 3.0 37GCC_REQD+= 3.0
38.endif 38.endif
39 39
40# Avoid compiler bug on "mipsel" (cobalt?) 40# Avoid compiler bug on "mipsel" (cobalt?)
41.if ${MACHINE_ARCH} == "mipsel" 41.if ${MACHINE_ARCH} == "mipsel"
42CFLAGS+= -O 42CFLAGS+= -O
43.endif 43.endif
44 44
45PKG_SYSCONFSUBDIR= ImageMagick 45PKG_SYSCONFSUBDIR= ImageMagick
46EGDIR= ${PREFIX}/share/examples/ImageMagick 46EGDIR= ${PREFIX}/share/examples/ImageMagick
47CONF_FILES= ${EGDIR}/coder.xml ${PKG_SYSCONFDIR}/coder.xml 47CONF_FILES= ${EGDIR}/coder.xml ${PKG_SYSCONFDIR}/coder.xml
48CONF_FILES+= ${EGDIR}/colors.xml ${PKG_SYSCONFDIR}/colors.xml 48CONF_FILES+= ${EGDIR}/colors.xml ${PKG_SYSCONFDIR}/colors.xml
49CONF_FILES+= ${EGDIR}/delegates.xml ${PKG_SYSCONFDIR}/delegates.xml 49CONF_FILES+= ${EGDIR}/delegates.xml ${PKG_SYSCONFDIR}/delegates.xml
50CONF_FILES+= ${EGDIR}/log.xml ${PKG_SYSCONFDIR}/log.xml 50CONF_FILES+= ${EGDIR}/log.xml ${PKG_SYSCONFDIR}/log.xml
51CONF_FILES+= ${EGDIR}/magic.xml ${PKG_SYSCONFDIR}/magic.xml 51CONF_FILES+= ${EGDIR}/magic.xml ${PKG_SYSCONFDIR}/magic.xml
52CONF_FILES+= ${EGDIR}/mime.xml ${PKG_SYSCONFDIR}/mime.xml 52CONF_FILES+= ${EGDIR}/mime.xml ${PKG_SYSCONFDIR}/mime.xml
53CONF_FILES+= ${EGDIR}/policy.xml ${PKG_SYSCONFDIR}/policy.xml 53CONF_FILES+= ${EGDIR}/policy.xml ${PKG_SYSCONFDIR}/policy.xml
54CONF_FILES+= ${EGDIR}/sRGB.icc ${PKG_SYSCONFDIR}/sRGB.icc 54CONF_FILES+= ${EGDIR}/sRGB.icc ${PKG_SYSCONFDIR}/sRGB.icc
55CONF_FILES+= ${EGDIR}/thresholds.xml ${PKG_SYSCONFDIR}/thresholds.xml 55CONF_FILES+= ${EGDIR}/thresholds.xml ${PKG_SYSCONFDIR}/thresholds.xml
56CONF_FILES+= ${EGDIR}/type-dejavu.xml ${PKG_SYSCONFDIR}/type-dejavu.xml 56CONF_FILES+= ${EGDIR}/type-dejavu.xml ${PKG_SYSCONFDIR}/type-dejavu.xml
57CONF_FILES+= ${EGDIR}/type-ghostscript.xml ${PKG_SYSCONFDIR}/type-ghostscript.xml 57CONF_FILES+= ${EGDIR}/type-ghostscript.xml ${PKG_SYSCONFDIR}/type-ghostscript.xml
58CONF_FILES+= ${EGDIR}/type-windows.xml ${PKG_SYSCONFDIR}/type-windows.xml 58CONF_FILES+= ${EGDIR}/type-windows.xml ${PKG_SYSCONFDIR}/type-windows.xml
59CONF_FILES+= ${EGDIR}/type.xml ${PKG_SYSCONFDIR}/type.xml 59CONF_FILES+= ${EGDIR}/type.xml ${PKG_SYSCONFDIR}/type.xml
60 60
61SUBST_CLASSES+= fix-cfg 61SUBST_CLASSES+= fix-cfg
62SUBST_STAGE.fix-cfg= pre-configure 62SUBST_STAGE.fix-cfg= pre-configure
63SUBST_MESSAGE.fix-cfg= Fixing configure.xml. 63SUBST_MESSAGE.fix-cfg= Fixing configure.xml.
64SUBST_FILES.fix-cfg= config/configure.xml.in 64SUBST_FILES.fix-cfg= config/configure.xml.in
65SUBST_VARS.fix-cfg= CONFIGURE_ARGS 65SUBST_VARS.fix-cfg= CONFIGURE_ARGS
66 66
67SUBST_CLASSES+= fix-etc 67SUBST_CLASSES+= fix-etc
68SUBST_STAGE.fix-etc= pre-configure 68SUBST_STAGE.fix-etc= pre-configure
69SUBST_MESSAGE.fix-etc= Handle configuration files. 69SUBST_MESSAGE.fix-etc= Handle configuration files.
70SUBST_FILES.fix-etc= Makefile.in 70SUBST_FILES.fix-etc= Makefile.in
71SUBST_SED.fix-etc= -e 's,^configlibdir =.*,configlibdir = $$(DATA_DIR)/examples/ImageMagick,' 71SUBST_SED.fix-etc= -e 's,^configlibdir =.*,configlibdir = $$(DATA_DIR)/examples/ImageMagick,'
72 72
73.include "../../archivers/bzip2/buildlink3.mk" 73.include "../../archivers/bzip2/buildlink3.mk"
74.include "../../archivers/xz/buildlink3.mk" 74.include "../../archivers/xz/buildlink3.mk"
75.include "../../devel/libltdl/buildlink3.mk" 75.include "../../devel/libltdl/buildlink3.mk"
76.include "../../fonts/fontconfig/buildlink3.mk" 76.include "../../fonts/fontconfig/buildlink3.mk"
77.include "../../graphics/freetype2/buildlink3.mk" 77.include "../../graphics/freetype2/buildlink3.mk"
78.include "../../graphics/lcms/buildlink3.mk" 78.include "../../graphics/lcms/buildlink3.mk"
79.include "../../graphics/openexr/buildlink3.mk" 79.include "../../graphics/openexr/buildlink3.mk"
80.include "../../graphics/libwebp/buildlink3.mk" 80.include "../../graphics/libwebp/buildlink3.mk"
81.include "../../graphics/png/buildlink3.mk" 81.include "../../graphics/png/buildlink3.mk"
82.include "../../graphics/tiff/buildlink3.mk" 82.include "../../graphics/tiff/buildlink3.mk"
83.include "../../math/fftw/buildlink3.mk" 83.include "../../math/fftw/buildlink3.mk"
84.include "../../textproc/libxml2/buildlink3.mk" 84.include "../../textproc/libxml2/buildlink3.mk"
85.include "../../mk/bsd.pkg.mk" 85.include "../../mk/bsd.pkg.mk"
cvs diff -r1.110 -r1.111 pkgsrc/graphics/ImageMagick/distinfo (switch to unified diff)

--- pkgsrc/graphics/ImageMagick/distinfo 2012/03/30 03:50:47 1.110
+++ pkgsrc/graphics/ImageMagick/distinfo 2012/04/09 15:56:21 1.111
@@ -1,8 +1,9 @@ @@ -1,8 +1,9 @@
1$NetBSD: distinfo,v 1.110 2012/03/30 03:50:47 taca Exp $ 1$NetBSD: distinfo,v 1.111 2012/04/09 15:56:21 tez Exp $
2 2
3SHA1 (ImageMagick-6.7.5-10.tar.bz2) = e19d7d5148de58d56a02d68049bb5d3ba470f53c 3SHA1 (ImageMagick-6.7.5-10.tar.bz2) = e19d7d5148de58d56a02d68049bb5d3ba470f53c
4RMD160 (ImageMagick-6.7.5-10.tar.bz2) = 5ff5b7ddc773beb048773cc252c5d306eaf28e50 4RMD160 (ImageMagick-6.7.5-10.tar.bz2) = 5ff5b7ddc773beb048773cc252c5d306eaf28e50
5Size (ImageMagick-6.7.5-10.tar.bz2) = 10416791 bytes 5Size (ImageMagick-6.7.5-10.tar.bz2) = 10416791 bytes
6SHA1 (patch-coders_jpeg.c) = 77e47f58ee3c46888f2edeafa1964e5145b65c25 6SHA1 (patch-coders_jpeg.c) = 77e47f58ee3c46888f2edeafa1964e5145b65c25
7SHA1 (patch-coders_tiff.c) = ff11a7fe6f47cd3fb7afeab986851ac417366722 7SHA1 (patch-coders_tiff.c) = ff11a7fe6f47cd3fb7afeab986851ac417366722
8SHA1 (patch-magick_property.c) = 19c345afac494a6599ef65a8a273f52095071127 8SHA1 (patch-magick_profile.c) = e991adc22b072a967fc3459d68cd6ab1e91610c6
 9SHA1 (patch-magick_property.c) = 105e9f3cfa3aa098296513c594e24759b1713c5b
File Added: pkgsrc/graphics/ImageMagick/patches/Attic/patch-magick_profile.c
$NetBSD: patch-magick_profile.c,v 1.1 2012/04/09 15:56:21 tez Exp $

* Fix for CVE-2012-1610.

--- magick/profile.c.orig	2012-04-09 14:19:45.161695800 +0000
+++ magick/profile.c
@@ -6727,8 +6727,10 @@ MagickExport MagickBooleanType SyncImage
       format=(ssize_t) ReadProfileShort(endian,q+2);
       if ((format-1) >= EXIF_NUM_FORMATS)
         break;
-      components=(int) ReadProfileLong(endian,q+4);
+      components=(ssize_t) ((int) ReadProfileLong(endian,q+4));
       number_bytes=(size_t) components*format_bytes[format];
+      if (number_bytes < components)
+        break;  /* prevent overflow */
       if (number_bytes <= 4)
         p=q+8;
       else
cvs diff -r1.1 -r1.2 pkgsrc/graphics/ImageMagick/patches/Attic/patch-magick_property.c (switch to unified diff)

--- pkgsrc/graphics/ImageMagick/patches/Attic/patch-magick_property.c 2012/03/30 03:50:47 1.1
+++ pkgsrc/graphics/ImageMagick/patches/Attic/patch-magick_property.c 2012/04/09 15:56:21 1.2
@@ -1,15 +1,25 @@ @@ -1,15 +1,25 @@
1$NetBSD: patch-magick_property.c,v 1.1 2012/03/30 03:50:47 taca Exp $ 1$NetBSD: patch-magick_property.c,v 1.2 2012/04/09 15:56:21 tez Exp $
2 2
3* Fix for CVE-2012-0259. 3* Fix for CVE-2012-0259.
 4* Fix for CVE-2012-1610.
4 5
5--- magick/property.c.orig 2012-03-01 01:41:19.000000000 +0000 6--- magick/property.c.orig 2012-03-01 01:41:19.000000000 +0000
6+++ magick/property.c 7+++ magick/property.c
7@@ -1309,6 +1309,8 @@ static MagickBooleanType GetEXIFProperty 8@@ -1286,6 +1286,8 @@ static MagickBooleanType GetEXIFProperty
 9 break;
 10 components=(ssize_t) ((int) ReadPropertyLong(endian,q+4));
 11 number_bytes=(size_t) components*tag_bytes[format];
 12+ if (number_bytes < components)
 13+ break; /* prevent overflow */
 14 if (number_bytes <= 4)
 15 p=q+8;
 16 else
 17@@ -1309,6 +1311,8 @@ static MagickBooleanType GetEXIFProperty
8 buffer[MaxTextExtent], 18 buffer[MaxTextExtent],
9 *value; 19 *value;
10  20
11+ value = NULL; 21+ value = NULL;
12+ *buffer = '\0'; 22+ *buffer = '\0';
13 switch (format) 23 switch (format)
14 { 24 {
15 case EXIF_FMT_BYTE: 25 case EXIF_FMT_BYTE: