Fix security bug 189610.

(Portage version: 2.1.3.6)

4 files changed, 125 insertions, 1 deletions

diff --git a/media-libs/id3lib/ChangeLog b/media-libs/id3lib/ChangeLog
index f086f3205680..2b720de51241 100644
--- a/media-libs/id3lib/ChangeLog
+++ b/media-libs/id3lib/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for media-libs/id3lib
 # Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/id3lib/ChangeLog,v 1.58 2007/06/25 04:29:54 kumba Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/id3lib/ChangeLog,v 1.59 2007/08/20 16:54:41 drac Exp $
+
+  20 Aug 2007; Samuli Suominen <drac@gentoo.org>
+  +files/id3lib-3.8.3-security.patch, +id3lib-3.8.3-r6.ebuild:
+  Fix security bug 189610.
+
+*id3lib-3.8.3-r6 (20 Aug 2007)
+
+  20 Aug 2007; Samuli Suominen <drac@gentoo.org>
+  +files/id3lib-3.8.3-security.patch, +id3lib-3.8.3-r6.ebuild:
+  Fix security bug 189610.
 
   25 Jun 2007; Joshua Kinard <kumba@gentoo.org> id3lib-3.8.3-r5.ebuild:
   Stable on mips, per #130992.
diff --git a/media-libs/id3lib/files/digest-id3lib-3.8.3-r6 b/media-libs/id3lib/files/digest-id3lib-3.8.3-r6
new file mode 100644
index 000000000000..d1e91dd6738a
--- /dev/null
+++ b/media-libs/id3lib/files/digest-id3lib-3.8.3-r6
@@ -0,0 +1,3 @@
+MD5 19f27ddd2dda4b2d26a559a4f0f402a7 id3lib-3.8.3.tar.gz 950726
+RMD160 bfa2499ec649ed40815ad0a370c78eb1517952c4 id3lib-3.8.3.tar.gz 950726
+SHA256 2749cc3c0cd7280b299518b1ddf5a5bcfe2d1100614519b68702230e26c7d079 id3lib-3.8.3.tar.gz 950726
diff --git a/media-libs/id3lib/files/id3lib-3.8.3-security.patch b/media-libs/id3lib/files/id3lib-3.8.3-security.patch
new file mode 100644
index 000000000000..e56d32cfc0ac
--- /dev/null
+++ b/media-libs/id3lib/files/id3lib-3.8.3-security.patch
@@ -0,0 +1,50 @@
+diff -ur id3lib-3.8.3.orig/src/tag_file.cpp id3lib-3.8.3/src/tag_file.cpp
+--- id3lib-3.8.3.orig/src/tag_file.cpp	2003-03-02 02:23:00.000000000 +0200
++++ id3lib-3.8.3/src/tag_file.cpp	2007-08-20 19:40:16.000000000 +0300
+@@ -242,8 +242,8 @@
+     strcpy(sTempFile, filename.c_str());
+     strcat(sTempFile, sTmpSuffix.c_str());
+ 
+-#if ((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
+-    // This section is for Windows folk && gcc 3.x folk
++#if !defined(HAVE_MKSTEMP)
++    // This section is for Windows folk
+     fstream tmpOut;
+     createFile(sTempFile, tmpOut);
+ 
+@@ -257,7 +257,7 @@
+       tmpOut.write((char *)tmpBuffer, nBytes);
+     }
+ 
+-#else //((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
++#else //!defined(HAVE_MKSTEMP)
+ 
+     // else we gotta make a temp file, copy the tag into it, copy the
+     // rest of the old file after the tag, delete the old file, rename
+@@ -270,7 +270,7 @@
+       //ID3_THROW_DESC(ID3E_NoFile, "couldn't open temp file");
+     }
+ 
+-    ofstream tmpOut(fd);
++    ofstream tmpOut(sTempFile);
+     if (!tmpOut)
+     {
+       tmpOut.close();
+@@ -285,14 +285,14 @@
+     uchar tmpBuffer[BUFSIZ];
+     while (file)
+     {
+-      file.read(tmpBuffer, BUFSIZ);
++      file.read((char *)tmpBuffer, BUFSIZ);
+       size_t nBytes = file.gcount();
+-      tmpOut.write(tmpBuffer, nBytes);
++      tmpOut.write((char *)tmpBuffer, nBytes);
+     }
+ 
+     close(fd); //closes the file
+ 
+-#endif ////((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
++#endif ////!defined(HAVE_MKSTEMP)
+ 
+     tmpOut.close();
+     file.close();
diff --git a/media-libs/id3lib/id3lib-3.8.3-r6.ebuild b/media-libs/id3lib/id3lib-3.8.3-r6.ebuild
new file mode 100644
index 000000000000..7f5df97892b1
--- /dev/null
+++ b/media-libs/id3lib/id3lib-3.8.3-r6.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/id3lib/id3lib-3.8.3-r6.ebuild,v 1.1 2007/08/20 16:54:41 drac Exp $
+
+WANT_AUTOCONF="latest"
+WANT_AUTOMAKE="latest"
+
+inherit eutils autotools
+
+MY_P=${P/_/}
+S="${WORKDIR}"/${MY_P}
+
+DESCRIPTION="Id3 library for C/C++"
+HOMEPAGE="http://id3lib.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${MY_P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="doc"
+
+RESTRICT="test"
+
+RDEPEND="sys-libs/zlib"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	epatch "${FILESDIR}"/${P}-zlib.patch
+	epatch "${FILESDIR}"/${P}-test_io.patch
+	epatch "${FILESDIR}"/${P}-autoconf259.patch
+	epatch "${FILESDIR}"/${P}-doxyinput.patch
+	epatch "${FILESDIR}"/${P}-unicode16.patch
+
+	# Security fix for bug 189610.
+	epatch "${FILESDIR}"/${P}-security.patch
+
+	AT_M4DIR="${S}/m4" eautoreconf
+}
+
+src_compile() {
+	econf || die "econf failed."
+	emake || die "emake failed."
+
+	if use doc; then
+		cd doc/
+		doxygen Doxyfile || die "doxygen failed"
+	fi
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "Install failed"
+	dodoc AUTHORS ChangeLog HISTORY README THANKS TODO
+
+	if use doc; then
+		dohtml -r doc
+	fi
+}