commit: d22654152913bd32909e73a9347ab22d7053f44d Author: Jeroen Roovers <jer <AT> gentoo <DOT> org> AuthorDate: Sat Sep 16 11:50:49 2017 +0000 Commit: Jeroen Roovers <jer <AT> gentoo <DOT> org> CommitDate: Sat Sep 16 11:51:24 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d2265415
net-dns/libidn: Add CVE-2017-14062 patch. Package-Manager: Portage-2.3.8, Repoman-2.3.3 .../libidn/files/libidn-1.33-CVE-2017-14062.patch | 32 ++++++ net-dns/libidn/libidn-1.33-r1.ebuild | 125 +++++++++++++++++++++ 2 files changed, 157 insertions(+) diff --git a/net-dns/libidn/files/libidn-1.33-CVE-2017-14062.patch b/net-dns/libidn/files/libidn-1.33-CVE-2017-14062.patch new file mode 100644 index 00000000000..2ddf3fdd6be --- /dev/null +++ b/net-dns/libidn/files/libidn-1.33-CVE-2017-14062.patch @@ -0,0 +1,32 @@ +From e9e81b8063b095b02cf104bb992fa9bf9515b9d8 Mon Sep 17 00:00:00 2001 +From: =?utf8?q?Tim=20R=C3=BChsen?= <[email protected]> +Date: Fri, 1 Sep 2017 10:04:48 +0200 +Subject: [PATCH] lib/punycode.c (decode_digit): Fix integer overflow + +This fix is a backport from libidn2 and addresses +CVE-2017-14062. +--- + lib/punycode.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/punycode.c b/lib/punycode.c +index 86819a7..49250a1 100644 +--- a/lib/punycode.c ++++ b/lib/punycode.c +@@ -88,10 +88,10 @@ enum + /* point (for use in representing integers) in the range 0 to */ + /* base-1, or base if cp does not represent a value. */ + +-static punycode_uint +-decode_digit (punycode_uint cp) ++static unsigned ++decode_digit (int cp) + { +- return cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 : ++ return (unsigned) cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 : + cp - 97 < 26 ? cp - 97 : base; + } + +-- +1.9.1 + diff --git a/net-dns/libidn/libidn-1.33-r1.ebuild b/net-dns/libidn/libidn-1.33-r1.ebuild new file mode 100644 index 00000000000..ffda81d116b --- /dev/null +++ b/net-dns/libidn/libidn-1.33-r1.ebuild @@ -0,0 +1,125 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 +inherit elisp-common java-pkg-opt-2 mono-env multilib-minimal libtool + +DESCRIPTION="Internationalized Domain Names (IDN) implementation" +HOMEPAGE="https://www.gnu.org/software/libidn/"; +SRC_URI="mirror://gnu/libidn/${P}.tar.gz" + +LICENSE="GPL-2 GPL-3 LGPL-3 java? ( Apache-2.0 )" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" +IUSE="doc emacs java mono nls static-libs" + +DOCS=( AUTHORS ChangeLog FAQ NEWS README THANKS TODO ) +COMMON_DEPEND=" + emacs? ( virtual/emacs ) + mono? ( >=dev-lang/mono-0.95 ) +" +DEPEND="${COMMON_DEPEND} + nls? ( + >=sys-devel/gettext-0.17 + ) + java? ( + >=virtual/jdk-1.5 + ) +" +RDEPEND="${COMMON_DEPEND} + nls? ( + >=virtual/libintl-0-r1[${MULTILIB_USEDEP}] + ) + java? ( + >=virtual/jre-1.5 + ) + abi_x86_32? ( + !<=app-emulation/emul-linux-x86-baselibs-20140508-r5 + !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] + ) +" +PATCHES=( + "${FILESDIR}"/${PN}-1.33-CVE-2017-14062.patch +) + +pkg_setup() { + mono-env_pkg_setup + java-pkg-opt-2_pkg_setup +} + +src_prepare() { + default + + # bundled, with wrong bytecode + rm "${S}/java/${P}.jar" || die + + # prevent triggering doc updates after punycode.c patch + touch doc/texi/punycode* || die + touch doc/man/punycode* || die + + elibtoolize # for Solaris shared objects +} + +multilib_src_configure() { + ECONF_SOURCE=${S} GJDOC=javadoc \ + econf \ + $(multilib_native_use_enable java) \ + $(multilib_native_use_enable mono csharp mono) \ + $(use_enable nls) \ + $(use_enable static-libs static) \ + --disable-silent-rules \ + --disable-valgrind-tests \ + --with-lispdir="${EPREFIX}${SITELISP}/${PN}" \ + --with-packager-bug-reports="https://bugs.gentoo.org"; \ + --with-packager-version="r${PR}" \ + --with-packager="Gentoo" +} + +multilib_src_compile() { + default + + if multilib_is_native_abi; then + use emacs && elisp-compile "${S}"/src/*.el + use java && use doc && emake -C java/src/main/java javadoc + fi +} + +multilib_src_test() { + # only run libidn specific tests and not gnulib tests (bug #539356) + emake -C tests check +} + +multilib_src_install() { + emake DESTDIR="${D}" install + + if multilib_is_native_abi && use java; then + java-pkg_newjar java/${P}.jar ${PN}.jar + rm -r "${ED}"/usr/share/java || die + use doc && java-pkg_dojavadoc "${S}"/doc/java + fi +} + +multilib_src_install_all() { + if use emacs; then + # *.el are installed by the build system + elisp-install ${PN} "${S}"/src/*.elc + elisp-site-file-install "${FILESDIR}/50${PN}-gentoo.el" + else + rm -r "${ED}/usr/share/emacs" || die + fi + + einstalldocs + if use doc ; then + dohtml -r doc/reference/html/. + fi + + prune_libtool_files +} + +pkg_postinst() { + use emacs && elisp-site-regen +} + +pkg_postrm() { + use emacs && elisp-site-regen +}
