Fri Nov 5 19:28:53 2021 UTC ()
Pullup ticket #6530 - requested by nia
www/firefox91: security fix

Revisions pulled up:
- www/firefox91/Makefile                                        1.8
- www/firefox91/PLIST                                           1.3
- www/firefox91/distinfo                                        1.6
- www/firefox91/patches/patch-modules_fdlibm_src_math__private.h 1.1

---
   Module Name:	pkgsrc
   Committed By:	nia
   Date:		Wed Nov  3 19:19:40 UTC 2021

   Modified Files:
   	pkgsrc/www/firefox91: Makefile PLIST distinfo
   Added Files:
   	pkgsrc/www/firefox91/patches: patch-modules_fdlibm_src_math__private.h

   Log Message:
   firefox91: update to 91.3.0

   Security Vulnerabilities fixed in Firefox ESR 91.3

       #CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets

       #CVE-2021-38504: Use-after-free in file picker dialog

       #CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode
       without notification or warning

       #CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass
       the Same-Origin-Policy on services hosted on other ports

       #MOZ-2021-0008: Use-after-free in HTTP2 Session object

       #CVE-2021-38508: Permission Prompt could be overlaid, resulting in user
       confusion and potential spoofing

       #CVE-2021-38509: Javascript alert box could have been spoofed onto an
       arbitrary domain

       #CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac
       OS

       #MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3


(bsiegert)
diff -r1.5.2.1 -r1.5.2.2 pkgsrc/www/firefox91/Makefile
diff -r1.2 -r1.2.2.1 pkgsrc/www/firefox91/PLIST
diff -r1.2.2.1 -r1.2.2.2 pkgsrc/www/firefox91/distinfo
diff -r0 -r1.1.2.2 pkgsrc/www/firefox91/patches/patch-modules_fdlibm_src_math__private.h
cvs diff -r1.5.2.1 -r1.5.2.2 pkgsrc/www/firefox91/Makefile (expand / switch to unified diff)

--- pkgsrc/www/firefox91/Makefile 2021/10/11 18:36:20 1.5.2.1
+++ pkgsrc/www/firefox91/Makefile 2021/11/05 19:28:52 1.5.2.2
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.5.2.1 2021/10/11 18:36:20 bsiegert Exp $ 1# $NetBSD: Makefile,v 1.5.2.2 2021/11/05 19:28:52 bsiegert Exp $
2 2
3FIREFOX_VER= ${MOZ_BRANCH}${MOZ_BRANCH_MINOR} 3FIREFOX_VER= ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
4MOZ_BRANCH= 91.2 4MOZ_BRANCH= 91.3
5MOZ_BRANCH_MINOR= .0esr 5MOZ_BRANCH_MINOR= .0esr
6 6
7DISTNAME= firefox-${FIREFOX_VER}.source 7DISTNAME= firefox-${FIREFOX_VER}.source
8PKGNAME= ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox91-/} 8PKGNAME= ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox91-/}
9CATEGORIES= www 9CATEGORIES= www
10MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/} 10MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
11EXTRACT_SUFX= .tar.xz 11EXTRACT_SUFX= .tar.xz
12 12
13DISTFILES= ${DEFAULT_DISTFILES} nodejs-output-91.0.tgz 13DISTFILES= ${DEFAULT_DISTFILES} nodejs-output-91.0.tgz
14SITES.nodejs-output-91.0.tgz= ${MASTER_SITE_LOCAL} 14SITES.nodejs-output-91.0.tgz= ${MASTER_SITE_LOCAL}
15 15
16MAINTAINER= ryoon@NetBSD.org 16MAINTAINER= ryoon@NetBSD.org
17HOMEPAGE= https://www.mozilla.org/en-US/firefox/ 17HOMEPAGE= https://www.mozilla.org/en-US/firefox/
cvs diff -r1.2 -r1.2.2.1 pkgsrc/www/firefox91/PLIST (expand / switch to unified diff)

--- pkgsrc/www/firefox91/PLIST 2021/09/16 17:47:13 1.2
+++ pkgsrc/www/firefox91/PLIST 2021/11/05 19:28:52 1.2.2.1
@@ -1,24 +1,25 @@ @@ -1,24 +1,25 @@
1@comment $NetBSD: PLIST,v 1.2 2021/09/16 17:47:13 nia Exp $ 1@comment $NetBSD: PLIST,v 1.2.2.1 2021/11/05 19:28:52 bsiegert Exp $
2bin/firefox91 2bin/firefox91
3lib/firefox91/application.ini 3lib/firefox91/application.ini
4lib/firefox91/browser/chrome/icons/default/default128.png 4lib/firefox91/browser/chrome/icons/default/default128.png
5lib/firefox91/browser/chrome/icons/default/default16.png 5lib/firefox91/browser/chrome/icons/default/default16.png
6lib/firefox91/browser/chrome/icons/default/default32.png 6lib/firefox91/browser/chrome/icons/default/default32.png
7lib/firefox91/browser/chrome/icons/default/default48.png 7lib/firefox91/browser/chrome/icons/default/default48.png
8lib/firefox91/browser/chrome/icons/default/default64.png 8lib/firefox91/browser/chrome/icons/default/default64.png
9lib/firefox91/browser/features/doh-rollout@mozilla.org.xpi 9lib/firefox91/browser/features/doh-rollout@mozilla.org.xpi
10lib/firefox91/browser/features/formautofill@mozilla.org.xpi 10lib/firefox91/browser/features/formautofill@mozilla.org.xpi
11lib/firefox91/browser/features/pictureinpicture@mozilla.org.xpi 11lib/firefox91/browser/features/pictureinpicture@mozilla.org.xpi
 12lib/firefox91/browser/features/proxy-failover@mozilla.com.xpi
12lib/firefox91/browser/features/screenshots@mozilla.org.xpi 13lib/firefox91/browser/features/screenshots@mozilla.org.xpi
13lib/firefox91/browser/features/webcompat-reporter@mozilla.org.xpi 14lib/firefox91/browser/features/webcompat-reporter@mozilla.org.xpi
14lib/firefox91/browser/features/webcompat@mozilla.org.xpi 15lib/firefox91/browser/features/webcompat@mozilla.org.xpi
15lib/firefox91/browser/omni.ja 16lib/firefox91/browser/omni.ja
16lib/firefox91/defaults/pref/channel-prefs.js 17lib/firefox91/defaults/pref/channel-prefs.js
17lib/firefox91/dependentlibs.list 18lib/firefox91/dependentlibs.list
18lib/firefox91/firefox91 19lib/firefox91/firefox91
19lib/firefox91/firefox91-bin 20lib/firefox91/firefox91-bin
20lib/firefox91/fonts/TwemojiMozilla.ttf 21lib/firefox91/fonts/TwemojiMozilla.ttf
21lib/firefox91/gmp-clearkey/0.1/libclearkey.so 22lib/firefox91/gmp-clearkey/0.1/libclearkey.so
22lib/firefox91/gmp-clearkey/0.1/manifest.json 23lib/firefox91/gmp-clearkey/0.1/manifest.json
23lib/firefox91/liblgpllibs.so 24lib/firefox91/liblgpllibs.so
24${PLIST.ffvpx}lib/firefox91/libmozavcodec.so 25${PLIST.ffvpx}lib/firefox91/libmozavcodec.so
cvs diff -r1.2.2.1 -r1.2.2.2 pkgsrc/www/firefox91/distinfo (expand / switch to unified diff)

--- pkgsrc/www/firefox91/distinfo 2021/10/11 18:36:20 1.2.2.1
+++ pkgsrc/www/firefox91/distinfo 2021/11/05 19:28:52 1.2.2.2
@@ -1,19 +1,17 @@ @@ -1,19 +1,17 @@
1$NetBSD: distinfo,v 1.2.2.1 2021/10/11 18:36:20 bsiegert Exp $ 1$NetBSD: distinfo,v 1.2.2.2 2021/11/05 19:28:52 bsiegert Exp $
2 2
3RMD160 (firefox-91.2.0esr.source.tar.xz) = 410ea5ccd338f115134fb814a903812f82a4557a 3SHA512 (firefox-91.3.0esr.source.tar.xz) = 7cf6efd165acc134bf576715580c103a2fc10ab928ede4c18f69908c62a04eb0f60affa8ceafd5883b393c31b85cae6821d0ae063c9e78117456d475947deaa9
4SHA512 (firefox-91.2.0esr.source.tar.xz) = f4cff7e43ff9927cbab3f02d37d360ee8bb0dbe988e280cb0638ee67bfe3c76e3a0469336de1b212fba66c958d58594b1739aafee1ebb84695d098c1e5c77b9d 4Size (firefox-91.3.0esr.source.tar.xz) = 381117132 bytes
5Size (firefox-91.2.0esr.source.tar.xz) = 381665824 bytes 
6RMD160 (nodejs-output-91.0.tgz) = b21fe976a919cd891a757eaba2f4006d8e4ab747 
7SHA512 (nodejs-output-91.0.tgz) = 3a457101a4aaa5ae955b77c41ba6b0d98eb5dd0ae9d6d8cc77c0c7bc0e844238a9c0d86cd1838ffb6a37ad8851f871c21e4ca1bb59d11e58fc42c5fec88c298c 5SHA512 (nodejs-output-91.0.tgz) = 3a457101a4aaa5ae955b77c41ba6b0d98eb5dd0ae9d6d8cc77c0c7bc0e844238a9c0d86cd1838ffb6a37ad8851f871c21e4ca1bb59d11e58fc42c5fec88c298c
8Size (nodejs-output-91.0.tgz) = 201061 bytes 6Size (nodejs-output-91.0.tgz) = 201061 bytes
9SHA1 (patch-aa) = 15b8567cee2af9853f6949c80345ffcb1fd3852a 7SHA1 (patch-aa) = 15b8567cee2af9853f6949c80345ffcb1fd3852a
10SHA1 (patch-browser_app_profile_firefox.js) = 89cea0a66457c96ad0b94aaa524aa5942ad781d0 8SHA1 (patch-browser_app_profile_firefox.js) = 89cea0a66457c96ad0b94aaa524aa5942ad781d0
11SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678 9SHA1 (patch-build_moz.configure_rust.configure) = 25ddfacd29cebbc6db005dbe61a2a7446d480678
12SHA1 (patch-config_gcc-stl-wrapper.template.h) = 9d88c7b1ccfdd3c6bd2dcd9530a36ad4a501d97a 10SHA1 (patch-config_gcc-stl-wrapper.template.h) = 9d88c7b1ccfdd3c6bd2dcd9530a36ad4a501d97a
13SHA1 (patch-config_makefiles_rust.mk) = 72d7e9ecee3ccf7ef5f741aac8e35509b41ab7b8 11SHA1 (patch-config_makefiles_rust.mk) = 72d7e9ecee3ccf7ef5f741aac8e35509b41ab7b8
14SHA1 (patch-dom_base_nsAttrName.h) = ac7ba441a3b27df2855cf2673eea36b1cb44ad49 12SHA1 (patch-dom_base_nsAttrName.h) = ac7ba441a3b27df2855cf2673eea36b1cb44ad49
15SHA1 (patch-gfx_angle_checkout_src_common_third__party_smhasher_src_PMurHash.cpp) = e458c9c8dc66edc69c1874734af28a77fc5e3993 13SHA1 (patch-gfx_angle_checkout_src_common_third__party_smhasher_src_PMurHash.cpp) = e458c9c8dc66edc69c1874734af28a77fc5e3993
16SHA1 (patch-gfx_angle_checkout_src_compiler_translator_InfoSink.h) = 2f73c76c48852613e0c55c1680fcc2a9eb3cf4ef 14SHA1 (patch-gfx_angle_checkout_src_compiler_translator_InfoSink.h) = 2f73c76c48852613e0c55c1680fcc2a9eb3cf4ef
17SHA1 (patch-gfx_cairo_cairo_src_cairo-type1-subset.c) = 89a9d934ef76706c552c0b81e6cbc0f45b1ffd2c 15SHA1 (patch-gfx_cairo_cairo_src_cairo-type1-subset.c) = 89a9d934ef76706c552c0b81e6cbc0f45b1ffd2c
18SHA1 (patch-gfx_skia_skia_src_core_SkCpu.cpp) = 36218819254f3681b9c717d652ea78c9f20d49ad 16SHA1 (patch-gfx_skia_skia_src_core_SkCpu.cpp) = 36218819254f3681b9c717d652ea78c9f20d49ad
19SHA1 (patch-gfx_thebes_gfxPlatform.cpp) = f6f8996f0818a1b890698c7cc5054d49cb1e8924 17SHA1 (patch-gfx_thebes_gfxPlatform.cpp) = f6f8996f0818a1b890698c7cc5054d49cb1e8924
@@ -22,23 +20,24 @@ SHA1 (patch-ipc_chromium_src_base_messag @@ -22,23 +20,24 @@ SHA1 (patch-ipc_chromium_src_base_messag
22SHA1 (patch-ipc_chromium_src_base_platform__thread__posix.cc) = 35d20981d33ccdb1d8ffb8039e48798777f11658 20SHA1 (patch-ipc_chromium_src_base_platform__thread__posix.cc) = 35d20981d33ccdb1d8ffb8039e48798777f11658
23SHA1 (patch-ipc_glue_GeckoChildProcessHost.cpp) = 260c29bacd8bf265951b7a412f850bf2b292c836 21SHA1 (patch-ipc_glue_GeckoChildProcessHost.cpp) = 260c29bacd8bf265951b7a412f850bf2b292c836
24SHA1 (patch-js_src_jit_ProcessExecutableMemory.cpp) = fad103cc698f9828ad58f742231984ec2bc27605 22SHA1 (patch-js_src_jit_ProcessExecutableMemory.cpp) = fad103cc698f9828ad58f742231984ec2bc27605
25SHA1 (patch-js_src_jit_arm64_vixl_MozCpu-vixl.cpp) = fdc522e3fb626b1b8a2ebf19ad60bfc25dfa4183 23SHA1 (patch-js_src_jit_arm64_vixl_MozCpu-vixl.cpp) = fdc522e3fb626b1b8a2ebf19ad60bfc25dfa4183
26SHA1 (patch-js_src_jsfriendapi.h) = b5cb687dbbda314fe0f16521c1c042c105c4bbe4 24SHA1 (patch-js_src_jsfriendapi.h) = b5cb687dbbda314fe0f16521c1c042c105c4bbe4
27SHA1 (patch-js_src_util_NativeStack.cpp) = a0a16d8d8d78d3cc3f4d2a508586f1a7821f7dba 25SHA1 (patch-js_src_util_NativeStack.cpp) = a0a16d8d8d78d3cc3f4d2a508586f1a7821f7dba
28SHA1 (patch-js_src_vm_ArrayBufferObject.cpp) = 0501fdcae11568ae4ea78e0d2f6b3750b7a67d47 26SHA1 (patch-js_src_vm_ArrayBufferObject.cpp) = 0501fdcae11568ae4ea78e0d2f6b3750b7a67d47
29SHA1 (patch-media_ffvpx_libavutil_arm_bswap.h) = de58daa0fd23d4fec50426602b65c9ea5862558a 27SHA1 (patch-media_ffvpx_libavutil_arm_bswap.h) = de58daa0fd23d4fec50426602b65c9ea5862558a
30SHA1 (patch-media_libcubeb_src_cubeb__alsa.c) = 31536f36cb33f16da309527b50eda9b721608115 28SHA1 (patch-media_libcubeb_src_cubeb__alsa.c) = 31536f36cb33f16da309527b50eda9b721608115
31SHA1 (patch-media_libcubeb_src_moz.build) = e4e64a1135cf4157ae5b6f7c1710ebd076953479 29SHA1 (patch-media_libcubeb_src_moz.build) = e4e64a1135cf4157ae5b6f7c1710ebd076953479
32SHA1 (patch-media_libpng_pngpriv.h) = c8084332560017cd7c9b519b61d125fa28af0dbc 30SHA1 (patch-media_libpng_pngpriv.h) = c8084332560017cd7c9b519b61d125fa28af0dbc
33SHA1 (patch-media_libtheora_lib_info.c) = f6dbf536d73859a1ff78304c2e9f6a6f74dac01f 31SHA1 (patch-media_libtheora_lib_info.c) = f6dbf536d73859a1ff78304c2e9f6a6f74dac01f
34SHA1 (patch-media_webrtc_trunk_webrtc_modules_video__capture_linux_device__info__linux.cc) = f495b64d33db4940c0dfe8c36ddf82aa752b25d9 32SHA1 (patch-media_webrtc_trunk_webrtc_modules_video__capture_linux_device__info__linux.cc) = f495b64d33db4940c0dfe8c36ddf82aa752b25d9
 33SHA1 (patch-modules_fdlibm_src_math__private.h) = 6ae3b0077b4a8c6088c35769fa1972cfc44ea9c1
35SHA1 (patch-mozglue_misc_Uptime.cpp) = daefe25ef1ebc8e4d3735017b9e8ac68c4710a00 34SHA1 (patch-mozglue_misc_Uptime.cpp) = daefe25ef1ebc8e4d3735017b9e8ac68c4710a00
36SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = 13e512c7ee9fa1e14ba415d62fa853e5fbfc91c0 35SHA1 (patch-nsprpub_pr_src_pthreads_ptsynch.c) = 13e512c7ee9fa1e14ba415d62fa853e5fbfc91c0
37SHA1 (patch-security_nss_lib_freebl_mpi_mpi.c) = a7cd867916524770609d1c307a65b315b88456f4 36SHA1 (patch-security_nss_lib_freebl_mpi_mpi.c) = a7cd867916524770609d1c307a65b315b88456f4
38SHA1 (patch-toolkit_components_terminator_nsTerminator.cpp) = 1c1397f6177728cf9deb2b74708069b9d09509c3 37SHA1 (patch-toolkit_components_terminator_nsTerminator.cpp) = 1c1397f6177728cf9deb2b74708069b9d09509c3
39SHA1 (patch-toolkit_modules_subprocess_subprocess__shared__unix.js) = 22a39e54e042ab2270a3cb54e4e307c8900cad12 38SHA1 (patch-toolkit_modules_subprocess_subprocess__shared__unix.js) = 22a39e54e042ab2270a3cb54e4e307c8900cad12
40SHA1 (patch-toolkit_moz.configure) = bb6b7a358302e254e31016c3053088e6ed089f5a 39SHA1 (patch-toolkit_moz.configure) = bb6b7a358302e254e31016c3053088e6ed089f5a
41SHA1 (patch-toolkit_mozapps_installer_packager.mk) = 706635b76a7b525794aba95e95544f09e18bb662 40SHA1 (patch-toolkit_mozapps_installer_packager.mk) = 706635b76a7b525794aba95e95544f09e18bb662
42SHA1 (patch-widget_gtk_DMABufSurface.cpp) = 72bc9554f075734df12e1748fb8965dce8318de5 41SHA1 (patch-widget_gtk_DMABufSurface.cpp) = 72bc9554f075734df12e1748fb8965dce8318de5
43SHA1 (patch-xpcom_base_nscore.h) = 1ac4d34d3c9e80bc1ac966c6c84cb320bc0fa1ec 42SHA1 (patch-xpcom_base_nscore.h) = 1ac4d34d3c9e80bc1ac966c6c84cb320bc0fa1ec
44SHA1 (patch-xpcom_reflect_xptcall_md_unix_moz.build) = f7e491c7b62a5332066473bfc815e0050672a372 43SHA1 (patch-xpcom_reflect_xptcall_md_unix_moz.build) = f7e491c7b62a5332066473bfc815e0050672a372
File Added: pkgsrc/www/firefox91/patches/patch-modules_fdlibm_src_math__private.h
$NetBSD: patch-modules_fdlibm_src_math__private.h,v 1.1.2.2 2021/11/05 19:28:53 bsiegert Exp $

* Fix PR pkg/56457, build failure on NetBSD/i386.
  Do not use FreeBSD-specific definition.

--- modules/fdlibm/src/math_private.h.orig	2021-09-27 22:47:42.000000000 +0000
+++ modules/fdlibm/src/math_private.h
@@ -30,8 +30,8 @@
  * Adapted from https://github.com/freebsd/freebsd-src/search?q=__double_t
  */
 
-typedef double      __double_t;
-typedef __double_t  double_t;
+#include <math.h>
+typedef double_t __double_t;
 
 /*
  * The original fdlibm code used statements like: