Fixed security issue.

Package-Manager: portage-2.1.8.3/cvs/Linux x86_64

4 files changed, 208 insertions, 2 deletions

diff --git a/www-client/w3m/ChangeLog b/www-client/w3m/ChangeLog
index 33cdddbb397a..af0517cc7729 100644
--- a/www-client/w3m/ChangeLog
+++ b/www-client/w3m/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for www-client/w3m
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-client/w3m/ChangeLog,v 1.53 2010/01/16 20:38:19 armin76 Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-client/w3m/ChangeLog,v 1.54 2010/06/19 17:43:51 matsuu Exp $
+
+*w3m-0.5.2-r4 (19 Jun 2010)
+
+  19 Jun 2010; MATSUU Takuto <matsuu@gentoo.org> +w3m-0.5.2-r4.ebuild,
+  +files/w3m-CVE-2010-2074.patch:
+  Fixed security issue.
 
   16 Jan 2010; Raúl Porcel <armin76@gentoo.org> w3m-0.5.2-r2.ebuild:
   ia64 stable wrt #296051
diff --git a/www-client/w3m/Manifest b/www-client/w3m/Manifest
index 064afbb689b8..9f0a701a36ce 100644
--- a/www-client/w3m/Manifest
+++ b/www-client/w3m/Manifest
@@ -1,11 +1,33 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX w3m-0.5.2-ambwidth.patch 13634 RMD160 21d967a5b6816e55aac12a161e575121065a336f SHA1 a9a040d2e9b17ed5ca454a0133e525a0ec542ba2 SHA256 9cad290d4c0122964ecb674e636fb7551b400b4f32a2697ca15d68e2fe8cf4ce
 AUX w3m-0.5.2-form.patch 309 RMD160 8f208c562fdce59ef97009e373925a33815a3dcd SHA1 e703286d1a67e67b2b052ef9806e202a5ef434ec SHA256 a0e6084c82db55c746cd00410c8781887fd52b61eca86a8a61269570622c41bf
 AUX w3m-0.5.2-gc72.patch 769 RMD160 475b22c156c6be49729e9a563d5d5493ba249c4d SHA1 d0332b8dcdf3fac1f91485d6858ad8c8b25ada69 SHA256 6a6a736db1edc3936a604d7b63512510158b4decfbdadaff85f7bf14d6377a86
+AUX w3m-CVE-2010-2074.patch 1597 RMD160 2a0f198a18ddec42ac070a9433d39177a41860f1 SHA1 e7e9502af2e749fff7e173c5eb6e27158591f5b8 SHA256 3ceb88f635f2b26509acf99c4817d746f4bd50f2cb6ff3152e919fdfb234d0e2
 AUX w3m.mailcap 44 RMD160 86f571fda5a25bc7ffe2a2094c2bc590c0395ce0 SHA1 dccd475e42a34e132adfc2aa13c3c789cd2e6fff SHA256 5f3c243df65c4d2e5ceeb1fae285e0f9f6660c7b0fc66bb7e46803c1de1890b5
 DIST w3m-0.5.2.tar.gz 1906812 RMD160 09ce72d8ef5e621a2e49496b63e22f2773edbe79 SHA1 484522547ae6dbb342d3858a2a53a65451e273f9 SHA256 5ff3e5a1f50a4a8e6ddbfdeefbe13d3a7f63538595a8e29f5da504ea46eda646
 EBUILD w3m-0.5.2-r1.ebuild 2970 RMD160 110c3f866b5595e9f07204b9ee59d93a4a0b3113 SHA1 8c3f3b0dfa6f4eeef0a33e523c34c168e08d0725 SHA256 a367f6f136713dc8664a4f6ec52e7a71d2e1d3855e207fc9d5267ed32245681e
 EBUILD w3m-0.5.2-r2.ebuild 3223 RMD160 74b0270a79c18633b95d62958bd3402caede0c47 SHA1 f3041b274768123f502e4b3f36e045d77781e2db SHA256 d153c1d3a9d1cbc393bbf3b00208aec16ba5127db1ca7b1c93ea936193e17dc8
 EBUILD w3m-0.5.2-r3.ebuild 3267 RMD160 07a9acb427d26a68107b0eb6ec555f6ca9094f7e SHA1 cb1493d14eb664cd67266021d169d42b7fccb9f6 SHA256 597a5834ec3db70a308140cfd5e5da70767a5cb84b9e45ee865205155418ed4a
+EBUILD w3m-0.5.2-r4.ebuild 3362 RMD160 f205cba292a8fcaf7aa5416f15e03ebe238f8e32 SHA1 f232e061d03c4e3688ef6d28840b320d62417adb SHA256 ba4ee0bae1fa3d6b0dac9aa5adf0dfd951f627411afbb10bdc4203471c2940d1
 EBUILD w3m-0.5.2.ebuild 2843 RMD160 80b57f81897b6ee8b6d0d729ec19777da31da5fc SHA1 9b622cf526742f10c3f6f083d1f6ac99bef70695 SHA256 2d03f839d7e08b12e24c75fa3383443bdbc9ccb4b30382fe197af6abffed6843
-MISC ChangeLog 17715 RMD160 ebd52b9902cf471feea088329f0f95402dd4a044 SHA1 784ad18d2eb3efeda6e26774952ea99892128d68 SHA256 84ef31c20be112f7ba275dfd8b3909eeb3af5ac0568068e2878a0e1c0ce60d50
+MISC ChangeLog 17873 RMD160 e5620f75e67fb4201d12ce0bad692e1b0decfcb3 SHA1 2573ed92f12776b1b392c4de6019911323fa3f64 SHA256 d6ed71d5690baaa1a8429c0100d032b93c071455be2e7e70fc5b2820a0a3712a
 MISC metadata.xml 237 RMD160 795d70d06b61c12bd15a97e596afed87747e7553 SHA1 a1a1f21305275c396fb2784bb261595fbf510a6f SHA256 58936b557c67f7e90052564817055decab28947a9934d0b889fa5d7e2901ba6d
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.15 (GNU/Linux)
+
+iQIcBAEBAgAGBQJMHQILAAoJECaGw+YFKA1pixIP/jgxCLKUY0K8+T0xG/ll26gP
+FMCg9321kgWzQwJkMuEaxujuwS+o55yqESGf9+CCfL9xZiv31hD7rrGHfTKa6WYU
+grer9MEzs/iFKYsGb0m/6NUUlzuM5nBS+NWSPYOLCrmO7OnTO6KDPtwgMblk5Clb
+kZNhhuAKaIwMdXoF+Jvz14w0HCxF4h4U4jjky+4E36hFd5nDEE2ybn7/HAU0scMf
+SmlERbg5Zpm78PSrqXeUB9IEGbG86jC1bU8npTPphrfiBuVQoRNoipB/+c9cQolJ
+fAf9jgsCNDrpgvVJu988ur4XJMBiFkOquF+AJeQPo0CJ1EOhB/rhmlbGQRELNW91
+1+Fp9XC0Cmc7bcoq/auEMGKNqSmIV0NghcHpQ7nfxc6mcltKuX12Kxou9bmg4zm1
+GFl1NvtVosmXNAlgLZTWsVVNtOYxmcs2zZqJ0YsmQoEJZsUQ9uCGg5YNR9NzoTS/
+mpYAJlOk/ybdirlvQRM9jg9F6BiyF5Oetnh+jDbHwGwkc7Xe+cZgkVzwS/Pvim+2
+/Kfaia7kDfOHqA4FsKdjlMcCmo5FOlgYPkaVIIPGgDxtEU6AveNYDZr2jipvOjDg
+QM+XERBBzav00daRlCZLvuwU8LJl/JGNEEcQXWAzBbdH4LOHXCC8k6hfF9I8tteE
+Quf7/UVxcCYEt4lRaXs4
+=Shoh
+-----END PGP SIGNATURE-----
diff --git a/www-client/w3m/files/w3m-CVE-2010-2074.patch b/www-client/w3m/files/w3m-CVE-2010-2074.patch
new file mode 100644
index 000000000000..2863932824c4
--- /dev/null
+++ b/www-client/w3m/files/w3m-CVE-2010-2074.patch
@@ -0,0 +1,55 @@
+Index: istream.c
+===================================================================
+--- istream.c
++++ istream.c
+@@ -447,8 +447,17 @@ ssl_check_cert_ident(X509 * x, char *hos
+ 
+ 		    if (!seen_dnsname)
+ 			seen_dnsname = Strnew();
++		    /* replace \0 to make full string visible to user */
++		    if (sl != strlen(sn)) {
++			int i;
++			for (i = 0; i < sl; ++i) {
++			    if (!sn[i])
++				sn[i] = '!';
++			}
++		    }
+ 		    Strcat_m_charp(seen_dnsname, sn, " ", NULL);
+-		    if (ssl_match_cert_ident(sn, sl, hostname))
++		    if (sl == strlen(sn) /* catch \0 in SAN */
++			&& ssl_match_cert_ident(sn, sl, hostname))
+ 			break;
+ 		}
+ 	    }
+@@ -466,16 +475,27 @@ ssl_check_cert_ident(X509 * x, char *hos
+     if (match_ident == FALSE && ret == NULL) {
+ 	X509_NAME *xn;
+ 	char buf[2048];
++	int slen;
+ 
+ 	xn = X509_get_subject_name(x);
+ 
+-	if (X509_NAME_get_text_by_NID(xn, NID_commonName,
+-				      buf, sizeof(buf)) == -1)
++	slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf));
++	if ( slen == -1)
+ 	    /* FIXME: gettextize? */
+ 	    ret = Strnew_charp("Unable to get common name from peer cert");
+-	else if (!ssl_match_cert_ident(buf, strlen(buf), hostname))
++	else if (slen != strlen(buf)
++		|| !ssl_match_cert_ident(buf, strlen(buf), hostname)) {
++	    /* replace \0 to make full string visible to user */
++	    if (slen != strlen(buf)) {
++		int i;
++		for (i = 0; i < slen; ++i) {
++		    if (!buf[i])
++			buf[i] = '!';
++		}
++	    }
+ 	    /* FIXME: gettextize? */
+ 	    ret = Sprintf("Bad cert ident %s from %s", buf, hostname);
++	}
+ 	else
+ 	    match_ident = TRUE;
+     }
+
diff --git a/www-client/w3m/w3m-0.5.2-r4.ebuild b/www-client/w3m/w3m-0.5.2-r4.ebuild
new file mode 100644
index 000000000000..e39e02090356
--- /dev/null
+++ b/www-client/w3m/w3m-0.5.2-r4.ebuild
@@ -0,0 +1,123 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-client/w3m/w3m-0.5.2-r4.ebuild,v 1.1 2010/06/19 17:43:51 matsuu Exp $
+
+EAPI="2"
+inherit eutils
+
+DESCRIPTION="Text based WWW browser, supports tables and frames"
+HOMEPAGE="http://w3m.sourceforge.net/"
+SRC_URI="mirror://sourceforge/w3m/${P}.tar.gz"
+
+LICENSE="w3m"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="X fbcon gpm gtk imlib lynxkeymap migemo nls nntp ssl unicode xface linguas_ja"
+
+# We cannot build w3m with gtk+2 w/o X because gtk+2 ebuild doesn't
+# allow us to build w/o X, so we have to give up framebuffer w3mimg....
+DEPEND=">=sys-libs/ncurses-5.2-r3
+	>=sys-libs/zlib-1.1.3-r2
+	>=dev-libs/boehm-gc-6.2
+	X? ( x11-libs/libXext x11-libs/libXdmcp )
+	gtk? ( >=x11-libs/gtk+-2 )
+	!gtk? ( imlib? ( >=media-libs/imlib2-1.1.0 ) )
+	xface? ( media-libs/compface )
+	gpm? ( >=sys-libs/gpm-1.19.3-r5 )
+	migemo? ( >=app-text/migemo-0.40 )
+	ssl? ( >=dev-libs/openssl-0.9.6b )"
+PROVIDE="virtual/w3m"
+
+src_prepare() {
+	epatch "${FILESDIR}/${P}-ambwidth.patch"
+	# http://www.sic.med.tohoku.ac.jp/~satodai/w3m-dev/200708.month/4286.html
+	epatch "${FILESDIR}/${P}-form.patch"
+	epatch "${FILESDIR}/${P}-gc72.patch"
+	# from w3m-0.5.2-149.1.src.rpm(openSUSE)
+	epatch "${FILESDIR}/${PN}-CVE-2010-2074.patch"
+}
+
+src_configure() {
+	local myconf migemo_command imagelibval imageval
+
+	if use gtk ; then
+		imagelibval="gtk2"
+	elif use imlib ; then
+		imagelibval="imlib2"
+	fi
+
+	if [ ! -z "${imagelibval}" ] ; then
+		use X && imageval="${imageval}${imageval:+,}x11"
+		use X && use fbcon && imageval="${imageval}${imageval:+,}fb"
+	fi
+
+	if use migemo ; then
+		migemo_command="migemo -t egrep /usr/share/migemo/migemo-dict"
+	else
+		migemo_command="no"
+	fi
+
+	# emacs-w3m doesn't like "--enable-m17n --disable-unicode,"
+	# so we better enable or disable both. Default to enable
+	# m17n and unicode, see bug #47046.
+	if use linguas_ja ; then
+		if use unicode ; then
+			myconf="${myconf} --enable-japanese=U"
+		else
+			myconf="${myconf} --enable-japanese=E"
+		fi
+	elif use unicode ; then
+		myconf="${myconf} --with-charset=UTF-8"
+	else
+		myconf="${myconf} --with-charset=US-ASCII"
+	fi
+
+	# lynxkeymap IUSE flag. bug #49397
+	if use lynxkeymap ; then
+		myconf="${myconf} --enable-keymap=lynx"
+	else
+		myconf="${myconf} --enable-keymap=w3m"
+	fi
+
+	econf \
+		--with-editor=/usr/bin/vi \
+		--with-mailer=/bin/mail \
+		--with-browser=/usr/bin/firefox \
+		--with-termlib=curses \
+		--enable-image=${imageval:-no} \
+		--with-imagelib="${imagelibval:-no}" \
+		--with-migemo="${migemo_command}" \
+		--enable-m17n \
+		--enable-unicode \
+		$(use_enable gpm mouse) \
+		$(use_enable nls) \
+		$(use_enable nntp) \
+		$(use_enable ssl digest-auth) \
+		$(use_with ssl) \
+		$(use_enable xface) \
+		${myconf} || die
+}
+
+src_compile() {
+	# parallel make borks, bug #215394.
+	emake -j1 || die "emake failed"
+}
+
+src_install() {
+
+	emake DESTDIR="${D}" install || die "emake install failed"
+
+	# http://www.sic.med.tohoku.ac.jp/~satodai/w3m-dev/200307.month/3944.html
+	insinto /etc/${PN}
+	newins "${FILESDIR}/${PN}.mailcap" mailcap
+
+	insinto /usr/share/${PN}/Bonus
+	doins Bonus/*
+	dodoc README NEWS TODO ChangeLog
+	docinto doc-en ; dodoc doc/*
+	if use linguas_ja ; then
+		docinto doc-jp ; dodoc doc-jp/*
+	else
+		rm -rf "${D}"/usr/share/man/ja
+	fi
+}