gimp security fixes and libpng15 fix

Package-Manager: portage-2.1.9.40/cvs/Linux x86_64

5 files changed, 766 insertions, 2 deletions

diff --git a/media-gfx/gimp/ChangeLog b/media-gfx/gimp/ChangeLog
index 005630497e29..81b1af9e2188 100644
--- a/media-gfx/gimp/ChangeLog
+++ b/media-gfx/gimp/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for media-gfx/gimp
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-gfx/gimp/ChangeLog,v 1.318 2011/01/28 18:02:17 arfrever Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-gfx/gimp/ChangeLog,v 1.319 2011/02/16 11:17:23 hanno Exp $
+
+*gimp-2.6.11-r1 (16 Feb 2011)
+
+  16 Feb 2011; Hanno Boeck <hanno@gentoo.org> +gimp-2.6.11-r1.ebuild,
+  +files/gimp-libpng15.diff, +files/gimp-CVE-2010-4540-to-4543.diff:
+  Fix for CVE-2010-4540, CVE-2010-4541, CVE-2010-4542, CVE-2010-4543 and build
+  with libpng 1.5.
 
   28 Jan 2011; Arfrever Frehtes Taifersar Arahesis <arfrever@gentoo.org>
   gimp-2.6.8.ebuild, gimp-2.6.10.ebuild, gimp-2.6.11.ebuild, gimp-9999.ebuild:
diff --git a/media-gfx/gimp/Manifest b/media-gfx/gimp/Manifest
index 88fe36b8a78a..425f752f1a44 100644
--- a/media-gfx/gimp/Manifest
+++ b/media-gfx/gimp/Manifest
@@ -1,10 +1,23 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX gimp-2.6.8-libpng-1.4.patch 1346 RMD160 8e6272af4bb869daeb348600e296412a7a11149d SHA1 0f9271676429a6a868ca2d104328f12d3eacb863 SHA256 521bd1f7d0afb9d8e86d99cbcdbcabeb9a1ecfff6e91ab002012f01f501d2ee3
+AUX gimp-CVE-2010-4540-to-4543.diff 5678 RMD160 0947a979ae64b2520967a6e8c3493aa37e425c3d SHA1 9b9cae60c775d4312552434373618c6cb9188e3e SHA256 b1fb9d83959cfc8e7a1ebf5d8812454686d618463010bbc0e802a1476e58305f
+AUX gimp-libpng15.diff 17119 RMD160 c04595754b3b3bf2631ab834261d14d7debb08ca SHA1 a56e8dc7e7d9df47d582285effa94b25e552093f SHA256 d77b61592d4943b052200eb98305b6cd15c24259b538c9a56afa498328470086
 DIST gimp-2.6.10.tar.bz2 16445326 RMD160 b58fc4e5717508ad531827c82e48067df0d0a748 SHA1 5781fed3fbf45969eac5e6ee2c7a4bb0bb529ecc SHA256 ef7a3fe73b352d8afeda9a5358431ea64a1d4cf3ebab588167f6335cdb52e032
 DIST gimp-2.6.11.tar.bz2 16473561 RMD160 a116377499e58dc2bfe231ab3c057d0be94091ff SHA1 2f9d596e727bdbf304fa78257c1731d9faf3934c SHA256 9b6d08d0803b3912ea596d1b77b9c21ee13778c23388a225c004b8c1587cb0a1
 DIST gimp-2.6.8.tar.bz2 16342377 RMD160 da02fedcc00ebaac04bfd21c153a7130d3ff5e08 SHA1 a550943f086abc9bf6b96d576741337b7186a4f4 SHA256 d5d4218b742390157fca23a9d2cce436904546a2ea419ffeb44a5f43c99a3332
 EBUILD gimp-2.6.10.ebuild 2856 RMD160 7389386dcf8e09d07f62f5685f9d2cca2ad17bac SHA1 ff4abf3e478000a1b5cf9bf7a200c47a725b3a47 SHA256 604b0d9c35886e427f794ae7eeb7e8b0d810c4680a528bc6b5e6d46a5d445ae8
+EBUILD gimp-2.6.11-r1.ebuild 3138 RMD160 36c05625b353be8cfd5699ce1cee725e4bd508a5 SHA1 9590acfacb3179c63b441aa7a1e9e7cea6636aa7 SHA256 1af63be5c083804341a263afc28222e1ebb1ff7a57b8f51d14ef750bcb9bad04
 EBUILD gimp-2.6.11.ebuild 2856 RMD160 c1e11c00a3b771570d6651990f10e7c54d7dad44 SHA1 c689443f69136a5ec67339066cad5c5e1b0a7c71 SHA256 1cd39cd2f37b89e139d4bec1dc36457d5e06ab45168b2356556d4dfeb4ccbffa
 EBUILD gimp-2.6.8.ebuild 2875 RMD160 496aa97a37143a90d7c63fb3844c88718fa2880a SHA1 8abeb00056103fc3076a31be80f9defbd86e58ee SHA256 eed6aa18f0c04dcc875d64d6fb4628eda9b7422184012eb04c61463f1017fa45
 EBUILD gimp-9999.ebuild 2916 RMD160 f7f6f627eacc24d5657e50a75d53cb7ce2d41700 SHA1 871e2a29dee0d55c5a870cd7bd26224235e393b6 SHA256 794160bd1396710e57170585bc480e68d2c1cb5f268850c2bcc0833d3d30c7f8
-MISC ChangeLog 43379 RMD160 78d84dc6bfb30ea6d4aaa1edacd6d30811631479 SHA1 6e3037f2b818d510875f044e6143518bce3b4a85 SHA256 197f5b835a9b6bae783e1de6a8729021c2424a1a7f72d8581612d0f74d2d80ab
+MISC ChangeLog 43645 RMD160 968e961fe35ca85037babfb1cc104853635cdcfc SHA1 e9b5d75cceca8f342c2945b878aeaea816e46560 SHA256 4ba44e310910b2f730306772288da9d0cee016b9e8bc76ce9ae176855fa00724
 MISC metadata.xml 366 RMD160 5ae566a82314bb47784051f6ca13fc1a9ecd137e SHA1 dce399814102ba9802439497439e2e00ecc3b82e SHA256 380bccccb72b527f81e02fd37b41b584316fcd7c802b959b8eae27fcef0c0db5
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.17 (GNU/Linux)
+
+iEYEARECAAYFAk1bskkACgkQr2QksT29OyD8JgCfe5bqhnMcwJ5cYKQlyOZDKyw9
+VhkAn1omXAWWZYhD/SWjNonIzU4jZpG0
+=MNp7
+-----END PGP SIGNATURE-----
diff --git a/media-gfx/gimp/files/gimp-CVE-2010-4540-to-4543.diff b/media-gfx/gimp/files/gimp-CVE-2010-4540-to-4543.diff
new file mode 100644
index 000000000000..111b20dc05b5
--- /dev/null
+++ b/media-gfx/gimp/files/gimp-CVE-2010-4540-to-4543.diff
@@ -0,0 +1,132 @@
+diff -Naur gimp-2.6.11/plug-ins/common/file-psp.c gimp-2.6.11-sec//plug-ins/common/file-psp.c
+--- gimp-2.6.11/plug-ins/common/file-psp.c	2010-07-03 00:51:56.000000000 +0200
++++ gimp-2.6.11-sec//plug-ins/common/file-psp.c	2011-02-16 11:58:38.195883063 +0100
+@@ -1244,6 +1244,10 @@
+             }
+           else
+             fread (buf, runcount, 1, f);
++
++          /* prevent buffer overflow for bogus data */
++          runcount = MIN (runcount, endq - q);
++
+           if (bytespp == 1)
+             {
+               memmove (q, buf, runcount);
+diff -Naur gimp-2.6.11/plug-ins/common/sphere-designer.c gimp-2.6.11-sec//plug-ins/common/sphere-designer.c
+--- gimp-2.6.11/plug-ins/common/sphere-designer.c	2010-07-03 00:51:56.000000000 +0200
++++ gimp-2.6.11-sec//plug-ins/common/sphere-designer.c	2011-02-16 11:58:32.967912810 +0100
+@@ -1992,6 +1992,7 @@
+   gchar    endbuf[21 * (G_ASCII_DTOSTR_BUF_SIZE + 1)];
+   gchar   *end = endbuf;
+   gchar    line[1024];
++  gchar    fmt_str[16];
+   gint     i;
+   texture *t;
+   gint     majtype, type;
+@@ -2016,6 +2017,8 @@
+ 
+   s.com.numtexture = 0;
+ 
++  snprintf (fmt_str, sizeof (fmt_str), "%%d %%d %%%lds", sizeof (endbuf) - 1);
++
+   while (!feof (f))
+     {
+ 
+@@ -2026,7 +2029,7 @@
+       t = &s.com.texture[i];
+       setdefaults (t);
+ 
+-      if (sscanf (line, "%d %d %s", &t->majtype, &t->type, end) != 3)
++      if (sscanf (line, fmt_str, &t->majtype, &t->type, end) != 3)
+         t->color1.x = g_ascii_strtod (end, &end);
+       if (end && errno != ERANGE)
+         t->color1.y = g_ascii_strtod (end, &end);
+diff -Naur gimp-2.6.11/plug-ins/gfig/gfig-style.c gimp-2.6.11-sec//plug-ins/gfig/gfig-style.c
+--- gimp-2.6.11/plug-ins/gfig/gfig-style.c	2010-07-03 00:51:59.000000000 +0200
++++ gimp-2.6.11-sec//plug-ins/gfig/gfig-style.c	2011-02-16 11:58:32.967912810 +0100
+@@ -165,6 +165,7 @@
+   gchar *ptr;
+   gchar *tmpstr;
+   gchar *endptr;
++  gchar  fmt_str[32];
+   gchar  colorstr_r[G_ASCII_DTOSTR_BUF_SIZE];
+   gchar  colorstr_g[G_ASCII_DTOSTR_BUF_SIZE];
+   gchar  colorstr_b[G_ASCII_DTOSTR_BUF_SIZE];
+@@ -172,6 +173,10 @@
+ 
+   style_entry->r = style_entry->g = style_entry->b = style_entry->a = 0.;
+ 
++  snprintf (fmt_str, sizeof (fmt_str), "%%%lds %%%lds %%%lds %%%lds",
++            sizeof (colorstr_r) - 1, sizeof (colorstr_g) - 1,
++            sizeof (colorstr_b) - 1, sizeof (colorstr_a) - 1);
++
+   while (n < nitems)
+     {
+       ptr = strchr (text[n], ':');
+@@ -181,7 +186,8 @@
+           ptr++;
+           if (!strcmp (tmpstr, name))
+             {
+-              sscanf (ptr, "%s %s %s %s", colorstr_r, colorstr_g, colorstr_b, colorstr_a);
++              sscanf (ptr, fmt_str,
++                      colorstr_r, colorstr_g, colorstr_b, colorstr_a);
+               style_entry->r = g_ascii_strtod (colorstr_r, &endptr);
+               style_entry->g = g_ascii_strtod (colorstr_g, &endptr);
+               style_entry->b = g_ascii_strtod (colorstr_b, &endptr);
+diff -Naur gimp-2.6.11/plug-ins/lighting/lighting-ui.c gimp-2.6.11-sec//plug-ins/lighting/lighting-ui.c
+--- gimp-2.6.11/plug-ins/lighting/lighting-ui.c	2010-07-03 00:51:59.000000000 +0200
++++ gimp-2.6.11-sec//plug-ins/lighting/lighting-ui.c	2011-02-16 11:58:32.968912815 +0100
+@@ -1342,6 +1342,7 @@
+   gchar          buffer3[G_ASCII_DTOSTR_BUF_SIZE];
+   gchar          type_label[21];
+   gchar         *endptr;
++  gchar          fmt_str[32];
+ 
+   if (response_id == GTK_RESPONSE_OK)
+     {
+@@ -1381,23 +1382,41 @@
+                   return;
+                 }
+ 
+-              fscanf (fp, " Position: %s %s %s", buffer1, buffer2, buffer3);
++              snprintf (fmt_str, sizeof (fmt_str),
++                        " Position: %%%lds %%%lds %%%lds",
++                        sizeof (buffer1) - 1,
++                        sizeof (buffer2) - 1,
++                        sizeof (buffer3) - 1);
++              fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+               source->position.x = g_ascii_strtod (buffer1, &endptr);
+               source->position.y = g_ascii_strtod (buffer2, &endptr);
+               source->position.z = g_ascii_strtod (buffer3, &endptr);
+ 
+-              fscanf (fp, " Direction: %s %s %s", buffer1, buffer2, buffer3);
++              snprintf (fmt_str, sizeof (fmt_str),
++                        " Direction: %%%lds %%%lds %%%lds",
++                        sizeof (buffer1) - 1,
++                        sizeof (buffer2) - 1,
++                        sizeof (buffer3) - 1);
++              fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+               source->direction.x = g_ascii_strtod (buffer1, &endptr);
+               source->direction.y = g_ascii_strtod (buffer2, &endptr);
+               source->direction.z = g_ascii_strtod (buffer3, &endptr);
+ 
+-              fscanf (fp, " Color: %s %s %s", buffer1, buffer2, buffer3);
++              snprintf (fmt_str, sizeof (fmt_str),
++                        " Color: %%%lds %%%lds %%%lds",
++                        sizeof (buffer1) - 1,
++                        sizeof (buffer2) - 1,
++                        sizeof (buffer3) - 1);
++              fscanf (fp, fmt_str, buffer1, buffer2, buffer3);
+               source->color.r = g_ascii_strtod (buffer1, &endptr);
+               source->color.g = g_ascii_strtod (buffer2, &endptr);
+               source->color.b = g_ascii_strtod (buffer3, &endptr);
+               source->color.a = 1.0;
+ 
+-              fscanf (fp, " Intensity: %s", buffer1);
++              snprintf (fmt_str, sizeof (fmt_str),
++                        " Intensity: %%%lds",
++                        sizeof (buffer1) - 1);
++              fscanf (fp, fmt_str, buffer1);
+               source->intensity = g_ascii_strtod (buffer1, &endptr);
+ 
+             }
diff --git a/media-gfx/gimp/files/gimp-libpng15.diff b/media-gfx/gimp/files/gimp-libpng15.diff
new file mode 100644
index 000000000000..beead91b0398
--- /dev/null
+++ b/media-gfx/gimp/files/gimp-libpng15.diff
@@ -0,0 +1,489 @@
+diff -Naur gimp-2.6.11/plug-ins/common/file-mng.c gimp-2.6.11-libpng//plug-ins/common/file-mng.c
+--- gimp-2.6.11/plug-ins/common/file-mng.c	2010-07-03 00:51:56.000000000 +0200
++++ gimp-2.6.11-libpng//plug-ins/common/file-mng.c	2011-02-16 11:59:21.238641008 +0100
+@@ -799,6 +799,13 @@
+       png_infop       png_info_ptr;
+       FILE           *infile, *outfile;
+       int             num_passes;
++      int             color_type;
++      png_colorp      palette;
++      int             num_palette;
++      int             bit_depth;
++      png_bytep       trans_alpha;
++      int             num_trans;
++      png_color_16p   trans_color;
+       int             tile_height;
+       guchar        **layer_pixels, *layer_pixel;
+       int             pass, j, k, begin, end, num;
+@@ -969,7 +976,7 @@
+           goto err3;
+         }
+ 
+-      if (setjmp (png_ptr->jmpbuf) != 0)
++      if (setjmp (png_jmpbuf(png_ptr)) != 0)
+         {
+           g_warning ("HRM saving PNG in mng_save_image()");
+           png_destroy_write_struct (&png_ptr, &png_info_ptr);
+@@ -981,34 +988,27 @@
+       png_init_io (png_ptr, outfile);
+       png_set_compression_level (png_ptr, mng_data.compression_level);
+ 
+-      png_info_ptr->width = layer_cols;
+-      png_info_ptr->height = layer_rows;
+-      png_info_ptr->interlace_type = (mng_data.interlaced == 0 ? 0 : 1);
+-      png_info_ptr->bit_depth = 8;
+-
+       switch (layer_drawable_type)
+         {
+         case GIMP_RGB_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_RGB;
++          color_type = PNG_COLOR_TYPE_RGB;
+           break;
+         case GIMP_RGBA_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
++          color_type = PNG_COLOR_TYPE_RGB_ALPHA;
+           break;
+         case GIMP_GRAY_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_GRAY;
++          color_type = PNG_COLOR_TYPE_GRAY;
+           break;
+         case GIMP_GRAYA_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
++          color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
+           break;
+         case GIMP_INDEXED_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_PALETTE;
+-          png_info_ptr->valid |= PNG_INFO_PLTE;
+-          png_info_ptr->palette =
+-            (png_colorp) gimp_image_get_colormap (image_id, &num_colors);
+-          png_info_ptr->num_palette = num_colors;
++          color_type = PNG_COLOR_TYPE_PALETTE;
++
++          png_set_PLTE(png_ptr, png_info_ptr, (png_colorp) gimp_image_get_colormap (image_id, &num_colors), num_colors);
+           break;
+         case GIMP_INDEXEDA_IMAGE:
+-          png_info_ptr->color_type = PNG_COLOR_TYPE_PALETTE;
++          color_type = PNG_COLOR_TYPE_PALETTE;
+           layer_has_unique_palette =
+             respin_cmap (png_ptr, png_info_ptr, layer_remap,
+                          image_id, layer_drawable);
+@@ -1021,15 +1021,17 @@
+           goto err3;
+         }
+ 
+-      if ((png_info_ptr->valid & PNG_INFO_PLTE) == PNG_INFO_PLTE)
++      bit_depth = 8;
++      if (png_get_PLTE(png_ptr, png_info_ptr, &palette, &num_palette) != 0)
+         {
+-          if (png_info_ptr->num_palette <= 2)
+-            png_info_ptr->bit_depth = 1;
+-          else if (png_info_ptr->num_palette <= 4)
+-            png_info_ptr->bit_depth = 2;
+-          else if (png_info_ptr->num_palette <= 16)
+-            png_info_ptr->bit_depth = 4;
++          if (num_palette <= 2)
++            bit_depth = 1;
++          else if (num_palette <= 4)
++            bit_depth = 2;
++          else if (num_palette <= 16)
++            bit_depth = 4;
+         }
++      png_set_IHDR(png_ptr, png_info_ptr, layer_cols, layer_rows, bit_depth, color_type, (mng_data.interlaced == 0 ? PNG_INTERLACE_NONE : PNG_INTERLACE_ADAM7), PNG_COMPRESSION_TYPE_DEFAULT, PNG_FILTER_TYPE_DEFAULT);
+ 
+       png_write_info (png_ptr, png_info_ptr);
+ 
+@@ -1038,8 +1040,8 @@
+       else
+         num_passes = 1;
+ 
+-      if ((png_info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) &&
+-          (png_info_ptr->bit_depth < 8))
++      if ((png_get_color_type(png_ptr, png_info_ptr) == PNG_COLOR_TYPE_PALETTE) &&
++          (png_get_bit_depth(png_ptr, png_info_ptr) < 8))
+         png_set_packing (png_ptr);
+ 
+       tile_height = gimp_tile_height ();
+@@ -1065,7 +1067,7 @@
+               gimp_pixel_rgn_get_rect (&layer_pixel_rgn, layer_pixel, 0,
+                                        begin, layer_cols, num);
+ 
+-              if ((png_info_ptr->valid & PNG_INFO_tRNS) == PNG_INFO_tRNS)
++              if (png_get_tRNS(png_ptr, png_info_ptr, &trans_alpha, &num_trans, &trans_color) != 0)
+                 {
+                   for (j = 0; j < num; j++)
+                     {
+@@ -1077,7 +1079,7 @@
+                     }
+                 }
+               else
+-                if (((png_info_ptr->valid & PNG_INFO_PLTE) == PNG_INFO_PLTE)
++                if ((png_get_PLTE(png_ptr, png_info_ptr, &palette, &num_palette) != 0)
+                     && (layer_bpp == 2))
+                 {
+                   for (j = 0; j < num; j++)
+diff -Naur gimp-2.6.11/plug-ins/common/file-png.c gimp-2.6.11-libpng//plug-ins/common/file-png.c
+--- gimp-2.6.11/plug-ins/common/file-png.c	2010-07-13 22:22:27.000000000 +0200
++++ gimp-2.6.11-libpng//plug-ins/common/file-png.c	2011-02-16 11:59:13.465685257 +0100
+@@ -653,7 +653,11 @@
+                                 error_data->drawable->width, num);
+     }
+ 
++#if (PNG_LIBPNG_VER < 10500)
+   longjmp (png_ptr->jmpbuf, 1);
++#else
++  png_longjmp (png_ptr, 1);
++#endif
+ }
+ 
+ /*
+@@ -697,7 +701,7 @@
+   pp = png_create_read_struct (PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+   info = png_create_info_struct (pp);
+ 
+-  if (setjmp (pp->jmpbuf))
++  if (setjmp (png_jmpbuf(pp)))
+     {
+       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                    _("Error while reading '%s'. File corrupted?"),
+@@ -738,17 +742,19 @@
+    * Latest attempt, this should be my best yet :)
+    */
+ 
+-  if (info->bit_depth == 16)
++  if (png_get_bit_depth(pp, info) == 16)
+     {
+       png_set_strip_16 (pp);
+     }
+ 
+-  if (info->color_type == PNG_COLOR_TYPE_GRAY && info->bit_depth < 8)
++  if (png_get_color_type(pp, info) == PNG_COLOR_TYPE_GRAY &&
++      png_get_bit_depth(pp, info) < 8)
+     {
+       png_set_expand (pp);
+     }
+ 
+-  if (info->color_type == PNG_COLOR_TYPE_PALETTE && info->bit_depth < 8)
++  if (png_get_color_type(pp, info) == PNG_COLOR_TYPE_PALETTE &&
++      png_get_bit_depth(pp, info) < 8)
+     {
+       png_set_packing (pp);
+     }
+@@ -757,8 +763,8 @@
+    * Expand G+tRNS to GA, RGB+tRNS to RGBA
+    */
+ 
+-  if (info->color_type != PNG_COLOR_TYPE_PALETTE &&
+-      (info->valid & PNG_INFO_tRNS))
++  if (png_get_color_type(pp, info) != PNG_COLOR_TYPE_PALETTE &&
++      png_get_valid(pp, info, PNG_INFO_tRNS) != 0)
+     {
+       png_set_expand (pp);
+     }
+@@ -775,7 +781,7 @@
+    */
+ 
+   if (png_get_valid (pp, info, PNG_INFO_tRNS) &&
+-      info->color_type == PNG_COLOR_TYPE_PALETTE)
++      png_get_color_type(pp, info) == PNG_COLOR_TYPE_PALETTE)
+     {
+       png_get_tRNS (pp, info, &alpha_ptr, &num, NULL);
+       /* Copy the existing alpha values from the tRNS chunk */
+@@ -797,7 +803,7 @@
+ 
+   png_read_update_info (pp, info);
+ 
+-  switch (info->color_type)
++  switch (png_get_color_type(pp, info))
+     {
+     case PNG_COLOR_TYPE_RGB:           /* RGB */
+       bpp = 3;
+@@ -836,7 +842,9 @@
+       return -1;
+     }
+ 
+-  image = gimp_image_new (info->width, info->height, image_type);
++  image = gimp_image_new (png_get_image_width(pp, info),
++                          png_get_image_height(pp, info),
++                          image_type);
+   if (image == -1)
+     {
+       g_set_error (error, 0, 0,
+@@ -849,7 +857,9 @@
+    * Create the "background" layer to hold the image...
+    */
+ 
+-  layer = gimp_layer_new (image, _("Background"), info->width, info->height,
++  layer = gimp_layer_new (image, _("Background"),
++                          png_get_image_width(pp, info),
++                          png_get_image_height(pp, info),
+                           layer_type, 100, GIMP_NORMAL_MODE);
+   gimp_image_add_layer (image, layer, 0);
+ 
+@@ -883,7 +893,8 @@
+ 
+       gimp_layer_set_offsets (layer, offset_x, offset_y);
+ 
+-      if ((abs (offset_x) > info->width) || (abs (offset_y) > info->height))
++      if ((abs (offset_x) > png_get_image_width(pp, info)) ||
++          (abs (offset_y) > png_get_image_height(pp, info)))
+         {
+           if (interactive)
+             g_message (_("The PNG file specifies an offset that caused "
+@@ -938,23 +949,27 @@
+ 
+   empty = 0; /* by default assume no full transparent palette entries */
+ 
+-  if (info->color_type & PNG_COLOR_MASK_PALETTE)
++  if (png_get_color_type(pp, info) & PNG_COLOR_MASK_PALETTE)
+     {
++      png_colorp palette;
++      int num_palette;
++      png_get_PLTE(pp, info, &palette, &num_palette);
++
+       if (png_get_valid (pp, info, PNG_INFO_tRNS))
+         {
+           for (empty = 0; empty < 256 && alpha[empty] == 0; ++empty)
+             /* Calculates number of fully transparent "empty" entries */;
+ 
+           /*  keep at least one entry  */
+-          empty = MIN (empty, info->num_palette - 1);
++          empty = MIN (empty, num_palette - 1);
+ 
+-          gimp_image_set_colormap (image, (guchar *) (info->palette + empty),
+-                                   info->num_palette - empty);
++          gimp_image_set_colormap (image, (guchar *) (palette + empty),
++                                   num_palette - empty);
+         }
+       else
+         {
+-          gimp_image_set_colormap (image, (guchar *) info->palette,
+-                                   info->num_palette);
++          gimp_image_set_colormap (image, (guchar *) palette,
++                                   num_palette);
+         }
+     }
+ 
+@@ -972,18 +987,20 @@
+    */
+ 
+   tile_height = gimp_tile_height ();
+-  pixel = g_new0 (guchar, tile_height * info->width * bpp);
++  pixel = g_new0 (guchar, tile_height * png_get_image_width(pp, info) * bpp);
+   pixels = g_new (guchar *, tile_height);
+ 
+   for (i = 0; i < tile_height; i++)
+-    pixels[i] = pixel + info->width * info->channels * i;
++    pixels[i] = pixel + (png_get_image_width(pp, info) *
++                         png_get_channels(pp, info) *
++                         i);
+ 
+   /* Install our own error handler to handle incomplete PNG files better */
+   error_data.drawable    = drawable;
+   error_data.pixel       = pixel;
+   error_data.tile_height = tile_height;
+-  error_data.width       = info->width;
+-  error_data.height      = info->height;
++  error_data.width       = png_get_image_width(pp, info);
++  error_data.height      = png_get_image_height(pp, info);
+   error_data.bpp         = bpp;
+   error_data.pixel_rgn   = &pixel_rgn;
+ 
+@@ -996,10 +1013,11 @@
+        */
+ 
+       for (begin = 0, end = tile_height;
+-           begin < info->height; begin += tile_height, end += tile_height)
++           begin < png_get_image_height(pp, info);
++           begin += tile_height, end += tile_height)
+         {
+-          if (end > info->height)
+-            end = info->height;
++          if (end > png_get_image_height(pp, info))
++            end = png_get_image_height(pp, info);
+ 
+           num = end - begin;
+ 
+@@ -1016,10 +1034,11 @@
+           gimp_pixel_rgn_set_rect (&pixel_rgn, pixel, 0, begin,
+                                    drawable->width, num);
+ 
+-          memset (pixel, 0, tile_height * info->width * bpp);
++          memset (pixel, 0, tile_height * png_get_image_width(pp, info) * bpp);
+ 
+           gimp_progress_update (((gdouble) pass +
+-                                 (gdouble) end / (gdouble) info->height) /
++                                 (gdouble) end /
++                                 (gdouble) png_get_image_height(pp, info)) /
+                                 (gdouble) num_passes);
+         }
+     }
+@@ -1072,7 +1091,8 @@
+ 
+   {
+     png_uint_32 proflen;
+-    png_charp   profname, profile;
++    png_charp   profname;
++    png_bytep   profile;
+     int         profcomp;
+ 
+     if (png_get_iCCP (pp, info, &profname, &profcomp, &profile, &proflen))
+@@ -1200,6 +1220,8 @@
+   guchar red, green, blue;      /* Used for palette background */
+   time_t cutime;                /* Time since epoch */
+   struct tm *gmt;               /* GMT broken down */
++  int color_type;               /* type of colors in image */
++  int bit_depth;                /* width of colors in bit */
+ 
+   guchar remap[256];            /* Re-mapping for the palette */
+ 
+@@ -1208,7 +1230,9 @@
+   if (pngvals.comment)
+     {
+       GimpParasite *parasite;
++#ifndef PNG_iTXt_SUPPORTED
+       gsize text_length = 0;
++#endif
+ 
+       parasite = gimp_image_parasite_find (orig_image_ID, "gimp-comment");
+       if (parasite)
+@@ -1249,7 +1273,7 @@
+   pp = png_create_write_struct (PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+   info = png_create_info_struct (pp);
+ 
+-  if (setjmp (pp->jmpbuf))
++  if (setjmp (png_jmpbuf(pp)))
+     {
+       g_set_error (error, 0, 0,
+                    _("Error while saving '%s'. Could not save image."),
+@@ -1291,11 +1315,6 @@
+ 
+   png_set_compression_level (pp, pngvals.compression_level);
+ 
+-  info->width          = drawable->width;
+-  info->height         = drawable->height;
+-  info->bit_depth      = 8;
+-  info->interlace_type = pngvals.interlaced;
+-
+   /*
+    * Initialise remap[]
+    */
+@@ -1309,37 +1328,36 @@
+   switch (type)
+     {
+     case GIMP_RGB_IMAGE:
+-      info->color_type = PNG_COLOR_TYPE_RGB;
++      color_type = PNG_COLOR_TYPE_RGB;
+       bpp = 3;
+       break;
+ 
+     case GIMP_RGBA_IMAGE:
+-      info->color_type = PNG_COLOR_TYPE_RGB_ALPHA;
++      color_type = PNG_COLOR_TYPE_RGB_ALPHA;
+       bpp = 4;
+       break;
+ 
+     case GIMP_GRAY_IMAGE:
+-      info->color_type = PNG_COLOR_TYPE_GRAY;
++      color_type = PNG_COLOR_TYPE_GRAY;
+       bpp = 1;
+       break;
+ 
+     case GIMP_GRAYA_IMAGE:
+-      info->color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
++      color_type = PNG_COLOR_TYPE_GRAY_ALPHA;
+       bpp = 2;
+       break;
+ 
+     case GIMP_INDEXED_IMAGE:
+       bpp = 1;
+-      info->color_type = PNG_COLOR_TYPE_PALETTE;
+-      info->valid |= PNG_INFO_PLTE;
+-      info->palette =
+-        (png_colorp) gimp_image_get_colormap (image_ID, &num_colors);
+-      info->num_palette = num_colors;
++      color_type = PNG_COLOR_TYPE_PALETTE;
++      png_set_PLTE(pp, info,
++                   (png_colorp) gimp_image_get_colormap (image_ID, &num_colors),
++                   num_colors);
+       break;
+ 
+     case GIMP_INDEXEDA_IMAGE:
+       bpp = 2;
+-      info->color_type = PNG_COLOR_TYPE_PALETTE;
++      color_type = PNG_COLOR_TYPE_PALETTE;
+       /* fix up transparency */
+       respin_cmap (pp, info, remap, image_ID, drawable);
+       break;
+@@ -1353,17 +1371,28 @@
+    * Fix bit depths for (possibly) smaller colormap images
+    */
+ 
+-  if (info->valid & PNG_INFO_PLTE)
++  bit_depth = 8;
++
++  if (png_get_valid(pp, info, PNG_INFO_PLTE))
+     {
+-      if (info->num_palette <= 2)
+-        info->bit_depth = 1;
+-      else if (info->num_palette <= 4)
+-        info->bit_depth = 2;
+-      else if (info->num_palette <= 16)
+-        info->bit_depth = 4;
++      png_colorp palette;
++      int num_palette;
++      png_get_PLTE(pp, info, &palette, &num_palette);
++      
++      if (num_palette <= 2)
++        bit_depth = 1;
++      else if (num_palette <= 4)
++        bit_depth = 2;
++      else if (num_palette <= 16)
++        bit_depth = 4;
+       /* otherwise the default is fine */
+     }
+ 
++  png_set_IHDR(pp, info,
++               drawable->width, drawable->height, bit_depth, color_type,
++               pngvals.interlaced ? PNG_INTERLACE_ADAM7 : PNG_INTERLACE_NONE,
++               PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++
+   /* All this stuff is optional extras, if the user is aiming for smallest
+      possible file size she can turn them all off */
+ 
+@@ -1477,7 +1506,8 @@
+    * Convert unpacked pixels to packed if necessary
+    */
+ 
+-  if (info->color_type == PNG_COLOR_TYPE_PALETTE && info->bit_depth < 8)
++  if (png_get_color_type(pp, info) ==
++      PNG_COLOR_TYPE_PALETTE && png_get_bit_depth(pp, info) < 8)
+     png_set_packing (pp);
+ 
+   /*
+@@ -1529,7 +1559,7 @@
+ 
+           /* If we're dealing with a paletted image with
+            * transparency set, write out the remapped palette */
+-          if (info->valid & PNG_INFO_tRNS)
++          if (png_get_valid(pp, info, PNG_INFO_tRNS))
+             {
+               guchar inverse_remap[256];
+ 
+@@ -1549,7 +1579,7 @@
+             }
+           /* Otherwise if we have a paletted image and transparency
+            * couldn't be set, we ignore the alpha channel */
+-          else if (info->valid & PNG_INFO_PLTE && bpp == 2)
++          else if (png_get_valid(pp, info, PNG_INFO_PLTE) && bpp == 2)
+             {
+               for (i = 0; i < num; ++i)
+                 {
+@@ -1564,7 +1594,7 @@
+           png_write_rows (pp, pixels, num);
+ 
+           gimp_progress_update (((double) pass + (double) end /
+-                                 (double) info->height) /
++                                 (double) png_get_image_height(pp, info)) /
+                                 (double) num_passes);
+         }
+     }
diff --git a/media-gfx/gimp/gimp-2.6.11-r1.ebuild b/media-gfx/gimp/gimp-2.6.11-r1.ebuild
new file mode 100644
index 000000000000..cc289fb27056
--- /dev/null
+++ b/media-gfx/gimp/gimp-2.6.11-r1.ebuild
@@ -0,0 +1,123 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-gfx/gimp/gimp-2.6.11-r1.ebuild,v 1.1 2011/02/16 11:17:23 hanno Exp $
+
+EAPI="3"
+PYTHON_DEPEND="python? 2:2.5"
+
+inherit eutils gnome2 fdo-mime multilib python
+
+DESCRIPTION="GNU Image Manipulation Program"
+HOMEPAGE="http://www.gimp.org/"
+SRC_URI="mirror://gimp/v2.6/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="2"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+
+IUSE="alsa aalib altivec curl dbus debug doc exif gnome hal jpeg lcms mmx mng pdf png python smp sse svg tiff webkit wmf"
+
+RDEPEND=">=dev-libs/glib-2.18.1
+	>=x11-libs/gtk+-2.12.5
+	>=x11-libs/pango-1.18.0
+	x11-libs/libXpm
+	>=media-libs/freetype-2.1.7
+	>=media-libs/fontconfig-2.2.0
+	sys-libs/zlib
+	dev-libs/libxml2
+	dev-libs/libxslt
+	x11-misc/xdg-utils
+	x11-themes/hicolor-icon-theme
+	>=media-libs/gegl-0.0.22
+	aalib? ( media-libs/aalib )
+	alsa? ( media-libs/alsa-lib )
+	curl? ( net-misc/curl )
+	dbus? ( dev-libs/dbus-glib )
+	hal? ( sys-apps/hal )
+	gnome? ( gnome-base/gvfs )
+	webkit? ( net-libs/webkit-gtk )
+	jpeg? ( virtual/jpeg )
+	exif? ( >=media-libs/libexif-0.6.15 )
+	lcms? ( =media-libs/lcms-1* )
+	mng? ( media-libs/libmng )
+	pdf? ( >=app-text/poppler-0.12.3-r3[cairo] )
+	png? ( >=media-libs/libpng-1.2.2 )
+	python?	( >=dev-python/pygtk-2.10.4 )
+	tiff? ( >=media-libs/tiff-3.5.7 )
+	svg? ( >=gnome-base/librsvg-2.8.0 )
+	wmf? ( >=media-libs/libwmf-0.2.8 )"
+DEPEND="${RDEPEND}
+	>=dev-util/pkgconfig-0.12.0
+	>=dev-util/intltool-0.40
+	>=sys-devel/gettext-0.17
+	doc? ( >=dev-util/gtk-doc-1 )"
+
+DOCS="AUTHORS ChangeLog* HACKING NEWS README*"
+
+pkg_setup() {
+	G2CONF="--enable-default-binary \
+		--with-x \
+		$(use_with aalib aa) \
+		$(use_with alsa) \
+		$(use_enable altivec) \
+		$(use_with curl libcurl) \
+		$(use_with dbus) \
+		$(use_with hal) \
+		$(use_with gnome gvfs) \
+		--without-gnomevfs \
+		$(use_with webkit) \
+		$(use_with jpeg libjpeg) \
+		$(use_with exif libexif) \
+		$(use_with lcms) \
+		$(use_enable mmx) \
+		$(use_with mng libmng) \
+		$(use_with pdf poppler) \
+		$(use_with png libpng) \
+		$(use_enable python) \
+		$(use_enable smp mp) \
+		$(use_enable sse) \
+		$(use_with svg librsvg) \
+		$(use_with tiff libtiff) \
+		$(use_with wmf)"
+
+	if use python; then
+		python_set_active_version 2
+		python_pkg_setup
+	fi
+}
+
+src_prepare() {
+	# security fixes from upstream, see
+	# https://bugzilla.gnome.org/show_bug.cgi?id=639203
+	epatch "${FILESDIR}"/gimp-CVE-2010-4540-to-4543.diff
+
+	# fixes for libpng 1.5 (incomplete), see
+	# https://bugzilla.gnome.org/show_bug.cgi?id=640409
+	epatch "${FILESDIR}"/gimp-libpng15.diff
+
+	echo '#!/bin/sh' > py-compile
+	gnome2_src_prepare
+}
+
+src_install() {
+	gnome2_src_install
+
+	if use python; then
+		python_convert_shebangs -r $(python_get_version) "${ED}"
+		python_need_rebuild
+	fi
+}
+
+pkg_postinst() {
+	gnome2_pkg_postinst
+
+	use python && python_mod_optimize /usr/$(get_libdir)/gimp/2.0/python \
+		/usr/$(get_libdir)/gimp/2.0/plug-ins
+}
+
+pkg_postrm() {
+	gnome2_pkg_postrm
+
+	use python && python_mod_cleanup /usr/$(get_libdir)/gimp/2.0/python \
+		/usr/$(get_libdir)/gimp/2.0/plug-ins
+}