Fri Aug 14 17:07:03 2020 UTC ()
Pullup ticket #6294 - requested by wiz
textproc/hunspell: security fix

Revisions pulled up:
- textproc/hunspell/Makefile                                    1.32
- textproc/hunspell/distinfo                                    1.13
- textproc/hunspell/patches/patch-src_hunspell_suggestmgr.cxx   1.1

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Aug  3 11:19:28 UTC 2020

   Modified Files:
   	pkgsrc/textproc/hunspell: Makefile distinfo
   Added Files:
   	pkgsrc/textproc/hunspell/patches: patch-src_hunspell_suggestmgr.cxx

   Log Message:
   hunspell: fix CVE-2019-16707 using upstream patch

   Bump PKGREVISION.


(bsiegert)
diff -r1.31 -r1.31.8.1 pkgsrc/textproc/hunspell/Makefile
diff -r1.12 -r1.12.14.1 pkgsrc/textproc/hunspell/distinfo
diff -r0 -r1.1.2.2 pkgsrc/textproc/hunspell/patches/patch-src_hunspell_suggestmgr.cxx
cvs diff -r1.31 -r1.31.8.1 pkgsrc/textproc/hunspell/Makefile (expand / switch to unified diff)

--- pkgsrc/textproc/hunspell/Makefile 2019/08/11 13:23:24 1.31
+++ pkgsrc/textproc/hunspell/Makefile 2020/08/14 17:07:02 1.31.8.1
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.31 2019/08/11 13:23:24 wiz Exp $ 1# $NetBSD: Makefile,v 1.31.8.1 2020/08/14 17:07:02 bsiegert Exp $
2 2
3DISTNAME= hunspell-1.7.0 3DISTNAME= hunspell-1.7.0
4PKGREVISION= 1 4PKGREVISION= 2
5CATEGORIES= textproc 5CATEGORIES= textproc
6MASTER_SITES= ${MASTER_SITE_GITHUB:=hunspell/} 6MASTER_SITES= ${MASTER_SITE_GITHUB:=hunspell/}
7GITHUB_TAG= v${PKGVERSION_NOREV} 7GITHUB_TAG= v${PKGVERSION_NOREV}
8 8
9MAINTAINER= ahoka@NetBSD.org 9MAINTAINER= ahoka@NetBSD.org
10HOMEPAGE= https://hunspell.github.io/ 10HOMEPAGE= https://hunspell.github.io/
11COMMENT= Improved spellchecker 11COMMENT= Improved spellchecker
12LICENSE= mpl-1.1 OR gnu-lgpl-v2.1 OR gnu-gpl-v2 12LICENSE= mpl-1.1 OR gnu-lgpl-v2.1 OR gnu-gpl-v2
13 13
14GNU_CONFIGURE= yes 14GNU_CONFIGURE= yes
15USE_LIBTOOL= yes 15USE_LIBTOOL= yes
16USE_TOOLS+= pkg-config perl:run autoreconf autoconf automake 16USE_TOOLS+= pkg-config perl:run autoreconf autoconf automake
17USE_PKGLOCALEDIR= yes 17USE_PKGLOCALEDIR= yes
cvs diff -r1.12 -r1.12.14.1 pkgsrc/textproc/hunspell/distinfo (expand / switch to unified diff)

--- pkgsrc/textproc/hunspell/distinfo 2018/11/16 13:02:20 1.12
+++ pkgsrc/textproc/hunspell/distinfo 2020/08/14 17:07:02 1.12.14.1
@@ -1,10 +1,11 @@ @@ -1,10 +1,11 @@
1$NetBSD: distinfo,v 1.12 2018/11/16 13:02:20 bsiegert Exp $ 1$NetBSD: distinfo,v 1.12.14.1 2020/08/14 17:07:02 bsiegert Exp $
2 2
3SHA1 (hunspell-1.7.0.tar.gz) = e42ea8342a191b9cd7da57d0d6ad4ae1566c5dcc 3SHA1 (hunspell-1.7.0.tar.gz) = e42ea8342a191b9cd7da57d0d6ad4ae1566c5dcc
4RMD160 (hunspell-1.7.0.tar.gz) = 52c7dbf21f460a0b61ea7d0378ef314773887fde 4RMD160 (hunspell-1.7.0.tar.gz) = 52c7dbf21f460a0b61ea7d0378ef314773887fde
5SHA512 (hunspell-1.7.0.tar.gz) = 8149b2e8b703a0610c9ca5160c2dfad3cf3b85b16b3f0f5cfcb7ebb802473b2d499e8e2d0a637a97a37a24d62424e82d3880809210d3f043fa17a4970d47c903 5SHA512 (hunspell-1.7.0.tar.gz) = 8149b2e8b703a0610c9ca5160c2dfad3cf3b85b16b3f0f5cfcb7ebb802473b2d499e8e2d0a637a97a37a24d62424e82d3880809210d3f043fa17a4970d47c903
6Size (hunspell-1.7.0.tar.gz) = 482156 bytes 6Size (hunspell-1.7.0.tar.gz) = 482156 bytes
7SHA1 (patch-aa) = 8c6102ddb2e449b6f1abc23f679e0f6f38bfd0b5 7SHA1 (patch-aa) = 8c6102ddb2e449b6f1abc23f679e0f6f38bfd0b5
8SHA1 (patch-ab) = ee127b1d8f55ceefa807c2fa440885b4fa5d029c 8SHA1 (patch-ab) = ee127b1d8f55ceefa807c2fa440885b4fa5d029c
9SHA1 (patch-ac) = c25cdfe80452cb4ca9850354c9fa8581c787c086 9SHA1 (patch-ac) = c25cdfe80452cb4ca9850354c9fa8581c787c086
 10SHA1 (patch-src_hunspell_suggestmgr.cxx) = e1460987dd787720d9783cdf6cd2b060a68d74da
10SHA1 (patch-src_tools_Makefile.am) = e5f67855c48e04fe12deb90904c9c27e2441a8cf 11SHA1 (patch-src_tools_Makefile.am) = e5f67855c48e04fe12deb90904c9c27e2441a8cf
File Added: pkgsrc/textproc/hunspell/patches/Attic/patch-src_hunspell_suggestmgr.cxx
$NetBSD: patch-src_hunspell_suggestmgr.cxx,v 1.1.2.2 2020/08/14 17:07:02 bsiegert Exp $

Fix CVE-2019-16707
https://github.com/hunspell/hunspell/commit/ac938e2ecb48ab4dd21298126c7921689d60571b#diff-783289d6b6330291ec79bf507002106e

--- src/hunspell/suggestmgr.cxx.orig	2018-11-12 20:38:56.000000000 +0000
+++ src/hunspell/suggestmgr.cxx
@@ -2040,7 +2040,7 @@ int SuggestMgr::leftcommonsubstring(
   int l2 = su2.size();
   // decapitalize dictionary word
   if (complexprefixes) {
-    if (su1[l1 - 1] == su2[l2 - 1])
+    if (l1 && l2 && su1[l1 - 1] == su2[l2 - 1])
       return 1;
   } else {
     unsigned short idx = su2.empty() ? 0 : (su2[0].h << 8) + su2[0].l;