Pullup ticket #3898 - requested by wiz
editors/emacs24-nox11: security patch
editors/emacs24: security patch

Revisions pulled up:
- editors/emacs24-nox11/Makefile                                1.3
- editors/emacs24-nox11/version.mk                              1.2
- editors/emacs24/Makefile                                      1.4
- editors/emacs24/distinfo                                      1.3-1.4
- editors/emacs24/patches/patch-aa                              1.2
- editors/emacs24/patches/patch-ab                              1.2
- editors/emacs24/patches/patch-lisp_files.el                   1.1

---
   Module Name:	pkgsrc
   Committed By:	marino
   Date:		Fri Aug 10 10:08:14 UTC 2012

   Modified Files:
   	pkgsrc/editors/emacs24: distinfo
   	pkgsrc/editors/emacs24/patches: patch-aa patch-ab

   Log Message:
   editors/emacs24: update configure* patches for DragonFly

   DragonFly needs libc explicitly defined for its linker.
   The temacs utility still segfaults, but at least it builds now.

---
   Module Name:	pkgsrc
   Committed By:	jmmv
   Date:		Sat Aug 11 17:21:04 UTC 2012

   Modified Files:
   	pkgsrc/editors/emacs24-nox11: version.mk

   Log Message:
   Fix the build of emacs modules when EMACS_TYPE=emacs24nox.

   The emacs flavor is 'emacs' and the package dependency is 'emacs-nox11',
   not 'emacs24' nor 'emacs24-nox11' (respectively).

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Aug 13 06:38:50 UTC 2012

   Modified Files:
   	pkgsrc/editors/emacs24: Makefile distinfo
   	pkgsrc/editors/emacs24-nox11: Makefile

   Log Message:
   Fix CVE-2012-3479:
   When the Emacs user option `enable-local-variables' is set to `:safe'
   (the default value is t), Emacs should automatically refuse to evaluate
   `eval' forms in file-local variable sections.  Due to the bug, Emacs
   instead automatically evaluates such `eval' forms.  Thus, if the user
   changes the value of `enable-local-variables' to `:safe', visiting a
   malicious file can cause automatic execution of arbitrary Emacs Lisp
   code with the permissions of the user.

   Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Aug 13 06:39:06 UTC 2012

   Added Files:
   	pkgsrc/editors/emacs24/patches: patch-lisp_files.el

   Log Message:
   Fix CVE-2012-3479:
   When the Emacs user option `enable-local-variables' is set to `:safe'
   (the default value is t), Emacs should automatically refuse to evaluate
   `eval' forms in file-local variable sections.  Due to the bug, Emacs
   instead automatically evaluates such `eval' forms.  Thus, if the user
   changes the value of `enable-local-variables' to `:safe', visiting a
   malicious file can cause automatic execution of arbitrary Emacs Lisp
   code with the permissions of the user.

   Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155


(tron)

$NetBSD: patch-lisp_files.el,v 1.1.2.2 2012/08/13 11:50:52 tron Exp $

CVE-2012-3479:
When the Emacs user option `enable-local-variables' is set to `:safe'
(the default value is t), Emacs should automatically refuse to evaluate
`eval' forms in file-local variable sections.  Due to the bug, Emacs
instead automatically evaluates such `eval' forms.  Thus, if the user
changes the value of `enable-local-variables' to `:safe', visiting a
malicious file can cause automatic execution of arbitrary Emacs Lisp
code with the permissions of the user.

Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155

--- lisp/files.el.orig	2012-05-14 12:00:02.000000000 +0000
+++ lisp/files.el
@@ -3107,11 +3107,16 @@ DIR-NAME is the name of the associated d
 	      ;; Obey `enable-local-eval'.
 	      ((eq var 'eval)
 	       (when enable-local-eval
-		 (push elt all-vars)
-		 (or (eq enable-local-eval t)
-		     (hack-one-local-variable-eval-safep (eval (quote val)))
-		     (safe-local-variable-p var val)
-		     (push elt unsafe-vars))))
+		 (let ((safe (or (hack-one-local-variable-eval-safep
+				  (eval (quote val)))
+				 ;; In case previously marked safe (bug#5636).
+				 (safe-local-variable-p var val))))
+		   ;; If not safe and e-l-v = :safe, ignore totally.
+		   (when (or safe (not (eq enable-local-variables :safe)))
+		     (push elt all-vars)
+		     (or (eq enable-local-eval t)
+			 safe
+			 (push elt unsafe-vars))))))
 	      ;; Ignore duplicates (except `mode') in the present list.
 	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
 	      ;; Accept known-safe variables.