add patches from upstream to address security bug #207933; force stabilize all

Package-Manager: portage-2.1.3.19

6 files changed, 41 insertions, 18 deletions

diff --git a/media-libs/sdl-image/files/digest-sdl-image-1.2.3-r1 b/media-libs/sdl-image/files/digest-sdl-image-1.2.3-r1
deleted file mode 100644
index c57a8516f5bb..000000000000
--- a/media-libs/sdl-image/files/digest-sdl-image-1.2.3-r1
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 d55826ffbd2bdc48b09cc64a9ed9e59e SDL_image-1.2.3.tar.gz 636747
-RMD160 ef488b0d731170336f6a3b5254e24c69726e0d92 SDL_image-1.2.3.tar.gz 636747
-SHA256 2f710b94f547ec7e39844f7872e1fe8d6fe2a434c896cc8a54b5540854bb5a69 SDL_image-1.2.3.tar.gz 636747
diff --git a/media-libs/sdl-image/files/digest-sdl-image-1.2.4 b/media-libs/sdl-image/files/digest-sdl-image-1.2.4
deleted file mode 100644
index 03f05bfc34da..000000000000
--- a/media-libs/sdl-image/files/digest-sdl-image-1.2.4
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 70bf617f99e51a2c94550fc79d542f0b SDL_image-1.2.4.tar.gz 841885
-RMD160 0c42fecde17e841a98ffc6d7b4f6473e30447df1 SDL_image-1.2.4.tar.gz 841885
-SHA256 c295b5fdb8c51fd363a351b9ca66b1d3c50f99d5610a0629d719757a35139032 SDL_image-1.2.4.tar.gz 841885
diff --git a/media-libs/sdl-image/files/digest-sdl-image-1.2.5 b/media-libs/sdl-image/files/digest-sdl-image-1.2.5
deleted file mode 100644
index a8686610e756..000000000000
--- a/media-libs/sdl-image/files/digest-sdl-image-1.2.5
+++ /dev/null
@@ -1,6 +0,0 @@
-MD5 cd006109a73bf7dcc93e1c3ed15ee782 SDL_image-1.2.5.tar.gz 1308637
-RMD160 3dabd3de4259519412e6fdc5c83d268dfa0b1ec0 SDL_image-1.2.5.tar.gz 1308637
-SHA256 8a665d136fb17cc9fedcd8e42d21fcab553bd7ab67b6cafea2c6c7efe1adb308 SDL_image-1.2.5.tar.gz 1308637
-MD5 6ba5a176c3f93a1d916e87005d049c28 sdl-image1.2_1.2.5-2.diff.gz 11430
-RMD160 4b34099e5805841ff8ed068155e20b0c91ea21db sdl-image1.2_1.2.5-2.diff.gz 11430
-SHA256 ab4b63f5b459cf0d7505a4f6210c1c5e05175193095ae6d6cd3810ecf71d6176 sdl-image1.2_1.2.5-2.diff.gz 11430
diff --git a/media-libs/sdl-image/files/digest-sdl-image-1.2.5-r1 b/media-libs/sdl-image/files/digest-sdl-image-1.2.5-r1
deleted file mode 100644
index a8686610e756..000000000000
--- a/media-libs/sdl-image/files/digest-sdl-image-1.2.5-r1
+++ /dev/null
@@ -1,6 +0,0 @@
-MD5 cd006109a73bf7dcc93e1c3ed15ee782 SDL_image-1.2.5.tar.gz 1308637
-RMD160 3dabd3de4259519412e6fdc5c83d268dfa0b1ec0 SDL_image-1.2.5.tar.gz 1308637
-SHA256 8a665d136fb17cc9fedcd8e42d21fcab553bd7ab67b6cafea2c6c7efe1adb308 SDL_image-1.2.5.tar.gz 1308637
-MD5 6ba5a176c3f93a1d916e87005d049c28 sdl-image1.2_1.2.5-2.diff.gz 11430
-RMD160 4b34099e5805841ff8ed068155e20b0c91ea21db sdl-image1.2_1.2.5-2.diff.gz 11430
-SHA256 ab4b63f5b459cf0d7505a4f6210c1c5e05175193095ae6d6cd3810ecf71d6176 sdl-image1.2_1.2.5-2.diff.gz 11430
diff --git a/media-libs/sdl-image/files/digest-sdl-image-1.2.6 b/media-libs/sdl-image/files/digest-sdl-image-1.2.6-r1
index c3c6a2b24ffd..c3c6a2b24ffd 100644
--- a/media-libs/sdl-image/files/digest-sdl-image-1.2.6
+++ b/media-libs/sdl-image/files/digest-sdl-image-1.2.6-r1
diff --git a/media-libs/sdl-image/files/sdl-image-1.2.6-DOS.patch b/media-libs/sdl-image/files/sdl-image-1.2.6-DOS.patch
new file mode 100644
index 000000000000..ec648a6ecfb3
--- /dev/null
+++ b/media-libs/sdl-image/files/sdl-image-1.2.6-DOS.patch
@@ -0,0 +1,41 @@
+--- trunk/SDL_image/IMG_gif.c	2007/02/13 10:09:17	2970
++++ trunk/SDL_image/IMG_gif.c	2007/12/28 16:43:56	3462
+@@ -418,6 +418,10 @@
+     static int stack[(1 << (MAX_LWZ_BITS)) * 2], *sp;
+     register int i;
+ 
++    /* Fixed buffer overflow found by Michael Skladnikiewicz */
++    if (input_code_size > MAX_LWZ_BITS)
++        return -1;
++
+     if (flag) {
+ 	set_code_size = input_code_size;
+ 	code_size = set_code_size + 1;
+--- trunk/SDL_image/IMG_lbm.c	2007/07/20 04:37:11	3341
++++ trunk/SDL_image/IMG_lbm.c	2008/01/03 20:05:34	3521
+@@ -28,6 +28,7 @@
+    EHB and HAM (specific Amiga graphic chip modes) support added by Marc Le Douarain
+    (http://www.multimania.com/mavati) in December 2003.
+    Stencil and colorkey fixes by David Raulo (david.raulo AT free DOT fr) in February 2004.
++   Buffer overflow fix in RLE decompression by David Raulo in January 2008.
+ */
+ 
+ #include <stdio.h>
+@@ -328,7 +329,7 @@
+ 						count ^= 0xFF;
+ 						count += 2; /* now it */
+ 
+-						if ( !SDL_RWread( src, &color, 1, 1 ) )
++						if ( ( count > remainingbytes ) || !SDL_RWread( src, &color, 1, 1 ) )
+ 						{
+ 						   error="error reading BODY chunk";
+ 							goto done;
+@@ -339,7 +340,7 @@
+ 					{
+ 						++count;
+ 
+-						if ( !SDL_RWread( src, ptr, count, 1 ) )
++						if ( ( count > remainingbytes ) || !SDL_RWread( src, ptr, count, 1 ) )
+ 						{
+ 						   error="error reading BODY chunk";
+ 							goto done;