Grab patch from Fedora for CAN-2005-0758.

Package-Manager: portage-2.1_pre4-r1

5 files changed, 144 insertions, 6 deletions

diff --git a/app-arch/bzip2/ChangeLog b/app-arch/bzip2/ChangeLog
index 24d5b1a1354a..d515220d07b9 100644
--- a/app-arch/bzip2/ChangeLog
+++ b/app-arch/bzip2/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-arch/bzip2
-# Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-arch/bzip2/ChangeLog,v 1.32 2005/09/09 15:07:17 agriffis Exp $
+# Copyright 1999-2006 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-arch/bzip2/ChangeLog,v 1.33 2006/02/06 23:20:17 vapier Exp $
+
+*bzip2-1.0.3-r6 (06 Feb 2006)
+
+  06 Feb 2006; Mike Frysinger <vapier@gentoo.org>
+  +files/bzip2-1.0.2-bzgrep.patch, +bzip2-1.0.3-r6.ebuild:
+  Grab patch from Fedora for CAN-2005-0758.
 
   09 Sep 2005; Aron Griffis <agriffis@gentoo.org> bzip2-1.0.3-r5.ebuild:
   Mark 1.0.3-r5 stable on alpha
diff --git a/app-arch/bzip2/Manifest b/app-arch/bzip2/Manifest
index e07d3ddf6fc1..b226cad48b04 100644
--- a/app-arch/bzip2/Manifest
+++ b/app-arch/bzip2/Manifest
@@ -1,21 +1,52 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-MD5 e8594894f72aa5202f24461a98fec22c ChangeLog 7150
+MD5 5cabed7ca888596b7249aed14c499d59 ChangeLog 7333
+RMD160 e6ba357349ae19bac24fd30b882dfa20cd67727b ChangeLog 7333
+SHA256 f839fd3ac5199deebd1e05b930f2f7cf3848fff080423aacba81f810f1612159 ChangeLog 7333
 MD5 a8859052e282ebc02dafdb66abf24dec bzip2-1.0.3-r5.ebuild 2220
+RMD160 7f3a8e66079eb79ba56b7bb0297f4d972f5afc52 bzip2-1.0.3-r5.ebuild 2220
+SHA256 edb05fcb75ce487ad0699eba566b35957fe470476db25bd88b07005dc5d2c54b bzip2-1.0.3-r5.ebuild 2220
+MD5 adf49755f7eb8e6a1c270d53d60e4fcc bzip2-1.0.3-r6.ebuild 2278
+RMD160 0f5e7702d4781c24ffaa9ef76ab5a8c5d46ea53d bzip2-1.0.3-r6.ebuild 2278
+SHA256 2fa315f48f2021e46d716eda5703f4350537a8e97364b8e32792e54a0943989b bzip2-1.0.3-r6.ebuild 2278
 MD5 cc73bebefba3a38c58fc49b49d7d25a7 files/bzip2-1.0.2-NULL-ptr-check.patch 838
+RMD160 fb3131d6770357f9515c4fe7862fb83846ead484 files/bzip2-1.0.2-NULL-ptr-check.patch 838
+SHA256 68b3fb53c688499c79b0fc4d1d69903bfeb599f4ad852d50f5643a1e26d26e3e files/bzip2-1.0.2-NULL-ptr-check.patch 838
+MD5 dbeea89d55ec8759ef24434afc2316ab files/bzip2-1.0.2-bzgrep.patch 626
+RMD160 4e9a2d4ff8d6954fb3b81e048c2dce14019d89f4 files/bzip2-1.0.2-bzgrep.patch 626
+SHA256 17db9eb083bcca2b31b000d209fbde9707d0ef3a22e9ba0bbc836e67d9dafc0e files/bzip2-1.0.2-bzgrep.patch 626
 MD5 a0833247f0c02ccb65cceb33ea521457 files/bzip2-1.0.2-chmod.patch 2780
+RMD160 24997a18f8bcce8a273c9610a72de612c7d5a29a files/bzip2-1.0.2-chmod.patch 2780
+SHA256 68d77b0cf362d7ef19a5c546de1e821abf682bde7a7b5095c4299cbf37c45acb files/bzip2-1.0.2-chmod.patch 2780
 MD5 5f7a98f0aaaed6554126d30e28383ee0 files/bzip2-1.0.2-progress.patch 6141
+RMD160 213842d0d7742dce4c1d938b79134b9e910bc8ec files/bzip2-1.0.2-progress.patch 6141
+SHA256 a76f6d082a1a1fef2eff111177d7c7568e1d457fb2b98cde71bbbe6ea1c7c787 files/bzip2-1.0.2-progress.patch 6141
 MD5 be84e51b1bd56731f5d7762980e3ad47 files/bzip2-1.0.3-makefile-CFLAGS.patch 489
+RMD160 c880da9de5bf47790d5f4965844a1a5877f46952 files/bzip2-1.0.3-makefile-CFLAGS.patch 489
+SHA256 e3f828c8ab7588c644e9aa49a973fdce75f0fd6fb817b9dbc5ebee1f08b19d61 files/bzip2-1.0.3-makefile-CFLAGS.patch 489
 MD5 55623d1117616943ca093e67c20e8ae1 files/bzip2-1.0.3-no-test.patch 161
+RMD160 8611ae7d6fe578e7fd24585e158c10468caca2f1 files/bzip2-1.0.3-no-test.patch 161
+SHA256 806dcb0f9f46a2b0b3ef04212405708198a25e281617e27a44c565948c159a49 files/bzip2-1.0.3-no-test.patch 161
 MD5 d1cf85cb43e35c9ecba9954295318ab8 files/bzip2-1.0.3-saneso.patch 323
+RMD160 d240f6d8d23f0584ee4bb4171935897a18f0c09e files/bzip2-1.0.3-saneso.patch 323
+SHA256 4b016b5831f6102bdd1f9d766609ee287f952a749d72f70e408fcc0adfd614c1 files/bzip2-1.0.3-saneso.patch 323
 MD5 613ebf0fa8c5fd2ed2973ffe0d727e2a files/bzip2-1.0.3-shared-largefile-support.patch 404
+RMD160 b8720c32af7133135bc81ef3e9b1b906ef6b6d44 files/bzip2-1.0.3-shared-largefile-support.patch 404
+SHA256 a253e534237980430bd5a5eb2d6f142c0b6ec2be644bc827126548a479dcfd85 files/bzip2-1.0.3-shared-largefile-support.patch 404
 MD5 f413035bf75710d87670f302692e1233 files/digest-bzip2-1.0.3-r5 63
+RMD160 a97b15b14f13e5ccb2cbea59393c72fd0db89686 files/digest-bzip2-1.0.3-r5 63
+SHA256 2044dd5d2b881f3f79d9ff9aa104ebe12674f2dc43c2d20da52eb356283ad76d files/digest-bzip2-1.0.3-r5 63
+MD5 f413035bf75710d87670f302692e1233 files/digest-bzip2-1.0.3-r6 63
+RMD160 a97b15b14f13e5ccb2cbea59393c72fd0db89686 files/digest-bzip2-1.0.3-r6 63
+SHA256 2044dd5d2b881f3f79d9ff9aa104ebe12674f2dc43c2d20da52eb356283ad76d files/digest-bzip2-1.0.3-r6 63
 MD5 9a09f8d531c582e78977dbfd96edc1f2 metadata.xml 164
+RMD160 f43cbec30b7074319087c9acffdb9354b17b0db3 metadata.xml 164
+SHA256 f5f2891f2a4791cd31350bb2bb572131ad7235cd0eeb124c9912c187ac10ce92 metadata.xml 164
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.2 (GNU/Linux)
 
-iD8DBQFDyImm2+ySkm8kpY0RAsZ9AJ9MA8x1EiIGpyrWTnA20yypEpExhQCghWiF
-SoEu71k+I/Wyv0YX680Kmxs=
-=Womr
+iD8DBQFD59nJ2+ySkm8kpY0RAsquAKCiqjuU+dwmGUHtrJ3mtR+svSsYcgCfX072
+P/VYW8gZghV9fY2KiLnJAYg=
+=A/rP
 -----END PGP SIGNATURE-----
diff --git a/app-arch/bzip2/bzip2-1.0.3-r6.ebuild b/app-arch/bzip2/bzip2-1.0.3-r6.ebuild
new file mode 100644
index 000000000000..45ead007ed11
--- /dev/null
+++ b/app-arch/bzip2/bzip2-1.0.3-r6.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-arch/bzip2/bzip2-1.0.3-r6.ebuild,v 1.1 2006/02/06 23:20:17 vapier Exp $
+
+inherit eutils multilib toolchain-funcs flag-o-matic
+
+DESCRIPTION="A high-quality data compressor used extensively by Gentoo Linux"
+HOMEPAGE="http://www.bzip.org/"
+SRC_URI="http://www.bzip.org/${PV}/${P}.tar.gz"
+
+LICENSE="BZIP2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="build static"
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${PN}-1.0.2-bzgrep.patch
+	epatch "${FILESDIR}"/${PN}-1.0.2-NULL-ptr-check.patch
+	epatch "${FILESDIR}"/${P}-makefile-CFLAGS.patch
+	epatch "${FILESDIR}"/${P}-saneso.patch
+	epatch "${FILESDIR}"/${P}-shared-largefile-support.patch
+	epatch "${FILESDIR}"/${PN}-1.0.2-progress.patch
+	epatch "${FILESDIR}"/${PN}-1.0.2-chmod.patch
+	epatch "${FILESDIR}"/${P}-no-test.patch
+	sed -i -e 's:\$(PREFIX)/man:\$(PREFIX)/share/man:g' Makefile || die "sed manpath"
+
+	# - Generate symlinks instead of hardlinks
+	# - pass custom variables to control libdir
+	sed -i \
+		-e 's:ln $(PREFIX)/bin/:ln -s :' \
+		-e 's:$(PREFIX)/lib:$(PREFIX)/$(LIBDIR):g' \
+		Makefile || die "sed links"
+}
+
+src_compile() {
+	local makeopts="
+		CC=$(tc-getCC)
+		AR=$(tc-getAR)
+		RANLIB=$(tc-getRANLIB)
+	"
+	if ! use build ; then
+		emake ${makeopts} -f Makefile-libbz2_so all || die "Make failed libbz2"
+	fi
+	use static && append-flags -static
+	emake ${makeopts} all || die "Make failed"
+
+	if ! tc-is-cross-compiler ; then
+		make check || die "test failed"
+	fi
+}
+
+src_install() {
+	if ! use build ; then
+		make PREFIX="${D}"/usr LIBDIR=$(get_libdir) install || die
+
+		# move bzip2 binaries to / and use the shared libbz2.so
+		mv "${D}"/usr/bin "${D}"/
+		into /
+		if ! use static ; then
+			newbin bzip2-shared bzip2 || die "dobin shared"
+		fi
+		dolib.so "${S}"/libbz2.so.${PV} || die "dolib shared"
+		for v in libbz2.so{,.{${PV%%.*},${PV%.*}}} ; do
+			dosym libbz2.so.${PV} /$(get_libdir)/${v}
+		done
+		gen_usr_ldscript libbz2.so
+
+		dodoc README* CHANGES Y2K_INFO bzip2.txt manual.*
+	else
+		into /
+		dobin bzip2 || die "dobin bzip2"
+	fi
+
+	dosym bzip2 /bin/bzcat
+	dosym bzip2 /bin/bunzip2
+}
diff --git a/app-arch/bzip2/files/bzip2-1.0.2-bzgrep.patch b/app-arch/bzip2/files/bzip2-1.0.2-bzgrep.patch
new file mode 100644
index 000000000000..bec6a66af761
--- /dev/null
+++ b/app-arch/bzip2/files/bzip2-1.0.2-bzgrep.patch
@@ -0,0 +1,20 @@
+Ripped from Fedora
+
+* Fri Nov 25 2005 Ivana Varekova <varekova@redhat.com> 1.0.3-2
+- fix bug 174172 - CAN-2005-0758 bzgrep has security issue in sed usage
+
+--- bzip2-1.0.2/bzgrep.flaw	2005-06-16 08:51:21.000000000 -0400
++++ bzip2-1.0.2/bzgrep	2005-06-16 08:55:20.000000000 -0400
+@@ -63,7 +63,11 @@
+     bzip2 -cdfq "$i" | $grep $opt "$pat"
+     r=$?
+   else
+-    bzip2 -cdfq "$i" | $grep $opt "$pat" | sed "s|^|${i}:|"
++    j=${i//\\/\\\\}
++    j=${j//|/\\|}
++    j=${j//&/\\&}
++    j=`printf "%s" "$j" | tr '\n' ' '`
++    bzip2 -cdfq "$i" | $grep $opt "$pat" | sed "s|^|${j}:|"
+     r=$?
+   fi
+   test "$r" -ne 0 && res="$r"
diff --git a/app-arch/bzip2/files/digest-bzip2-1.0.3-r6 b/app-arch/bzip2/files/digest-bzip2-1.0.3-r6
new file mode 100644
index 000000000000..24bf9c7e285a
--- /dev/null
+++ b/app-arch/bzip2/files/digest-bzip2-1.0.3-r6
@@ -0,0 +1 @@
+MD5 8a716bebecb6e647d2e8a29ea5d8447f bzip2-1.0.3.tar.gz 669075