Added a security fix for #142387.

(Portage version: 2.1-r1)

5 files changed, 96 insertions, 3 deletions

diff --git a/media-libs/dumb/ChangeLog b/media-libs/dumb/ChangeLog
index 5b67e9bdcdf6..ca1db64b21e0 100644
--- a/media-libs/dumb/ChangeLog
+++ b/media-libs/dumb/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for media-libs/dumb
 # Copyright 2000-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/ChangeLog,v 1.24 2006/07/22 15:54:47 tcort Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/ChangeLog,v 1.25 2006/08/03 15:44:19 joker Exp $
+
+*dumb-0.9.3-r1 (03 Aug 2006)
+
+  03 Aug 2006; Christian Birchinger <joker@gentoo.org>
+  +files/dumb-0.9.3_CVE-2006-3668.patch, dumb-0.9.3.ebuild,
+  +dumb-0.9.3-r1.ebuild:
+  Added a security fix for #142387
 
   22 Jul 2006; Thomas Cort <tcort@gentoo.org> dumb-0.9.3.ebuild:
   Stable on alpha wrt Bug #134990.
diff --git a/media-libs/dumb/dumb-0.9.3-r1.ebuild b/media-libs/dumb/dumb-0.9.3-r1.ebuild
new file mode 100644
index 000000000000..a6837e50facf
--- /dev/null
+++ b/media-libs/dumb/dumb-0.9.3-r1.ebuild
@@ -0,0 +1,67 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3-r1.ebuild,v 1.1 2006/08/03 15:44:19 joker Exp $
+
+IUSE="debug"
+
+inherit eutils
+
+DESCRIPTION="IT/XM/S3M/MOD player library with click removal and IT filters"
+HOMEPAGE="http://dumb.sourceforge.net/"
+SRC_URI="mirror://sourceforge/dumb/${P}.tar.gz"
+
+KEYWORDS="alpha amd64 ia64 ppc sparc x86"
+LICENSE="DUMB-0.9.2"
+SLOT="0"
+
+DEPEND=""
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	cat << EOF > make/config.txt
+include make/unix.inc
+ALL_TARGETS := core core-examples core-headers
+PREFIX := /usr
+EOF
+
+	epatch "${FILESDIR}"/${PN}-0.9.2-PIC.patch
+	epatch "${FILESDIR}"/${P}_CVE-2006-3668.patch
+	sed -i '/= -s/d' Makefile || die "sed failed"
+	cp Makefile Makefile.rdy
+}
+
+src_compile() {
+	emake OFLAGS="${CFLAGS}" all || die "emake failed"
+}
+
+src_install() {
+	dobin examples/{dumbout,dumb2wav}
+	dolib.so lib/unix/libdumb.so
+
+	use debug && dolib.so lib/unix/libdumbd.so
+
+	insinto /usr/include
+	doins include/dumb.h
+
+	dodoc readme.txt release.txt docs/* || die "dodoc failed"
+}
+
+pkg_postinst() {
+	einfo
+	einfo "DUMB's core has been installed. This will enable you to convert module"
+	einfo "files to PCM data (ready for sending to /dev/dsp, writing to a .wav"
+	einfo "file, piping through oggenc, etc.)."
+	einfo
+	einfo "If you are using Allegro, you will also want to 'emerge aldumb'. This"
+	einfo "provides you with a convenient API for playing module files through"
+	einfo "Allegro's sound system, and also enables DUMB to integrate with"
+	einfo "Allegro's datafile system so you can add modules to datafiles."
+	einfo
+	einfo "As a developer, when you distribute your game and write your docs, be"
+	einfo "aware that 'dumb' and 'aldumb' actually come from the same download."
+	einfo "People who don't use Gentoo will only have to download and install one"
+	einfo "package. See /usr/share/doc/${PF}/readme.txt.gz for details on"
+	einfo "how DUMB would be compiled manually."
+	einfo
+}
diff --git a/media-libs/dumb/dumb-0.9.3.ebuild b/media-libs/dumb/dumb-0.9.3.ebuild
index d756d1df3d9a..ff0cb37e2681 100644
--- a/media-libs/dumb/dumb-0.9.3.ebuild
+++ b/media-libs/dumb/dumb-0.9.3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2006 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3.ebuild,v 1.9 2006/07/22 15:54:47 tcort Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/dumb/dumb-0.9.3.ebuild,v 1.10 2006/08/03 15:44:19 joker Exp $
 
 IUSE="debug"
 
@@ -10,7 +10,7 @@ DESCRIPTION="IT/XM/S3M/MOD player library with click removal and IT filters"
 HOMEPAGE="http://dumb.sourceforge.net/"
 SRC_URI="mirror://sourceforge/dumb/${P}.tar.gz"
 
-KEYWORDS="alpha amd64 ia64 ppc sparc x86"
+KEYWORDS="~alpha ~amd64 ~ia64 ~ppc ~sparc ~x86"
 LICENSE="DUMB-0.9.2"
 SLOT="0"
 
diff --git a/media-libs/dumb/files/digest-dumb-0.9.3-r1 b/media-libs/dumb/files/digest-dumb-0.9.3-r1
new file mode 100644
index 000000000000..803226265cb8
--- /dev/null
+++ b/media-libs/dumb/files/digest-dumb-0.9.3-r1
@@ -0,0 +1,3 @@
+MD5 f48da5b990aa8aa822d3b6a951baf5c2 dumb-0.9.3.tar.gz 167379
+RMD160 53c7931fec71dd4e67e19c4acf38c0f9202e5698 dumb-0.9.3.tar.gz 167379
+SHA256 8d44fbc9e57f3bac9f761c3b12ce102d47d717f0dd846657fb988e0bb5d1ea33 dumb-0.9.3.tar.gz 167379
diff --git a/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch b/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch
new file mode 100644
index 000000000000..09d2fb68f4cb
--- /dev/null
+++ b/media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch
@@ -0,0 +1,16 @@
+Index: libdumb-0.9.3/src/it/itread.c
+===================================================================
+--- libdumb-0.9.3.orig/src/it/itread.c	2006-07-21 11:05:48.000000000 +0200
++++ libdumb-0.9.3/src/it/itread.c	2006-07-21 11:07:22.000000000 +0200
+@@ -292,6 +292,11 @@
+ 
+ 	envelope->flags = dumbfile_getc(f);
+ 	envelope->n_nodes = dumbfile_getc(f);
++	if(envelope->n_nodes > 25) {
++		TRACE("IT error: wrong number of envelope nodes (%d)\n", envelope->n_nodes);
++		envelope->n_nodes = 0;
++		return -1;
++	}
+ 	envelope->loop_start = dumbfile_getc(f);
+ 	envelope->loop_end = dumbfile_getc(f);
+ 	envelope->sus_loop_start = dumbfile_getc(f);