fix heap overflow... bug #40631

7 files changed, 100 insertions, 12 deletions

diff --git a/media-sound/mpg123/ChangeLog b/media-sound/mpg123/ChangeLog
index 16f5a57c972f..2c051f29c5d4 100644
--- a/media-sound/mpg123/ChangeLog
+++ b/media-sound/mpg123/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for media-sound/mpg123
 # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/ChangeLog,v 1.29 2004/02/15 20:59:24 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/ChangeLog,v 1.30 2004/02/15 21:10:47 solar Exp $
+
+  15 Feb 2004; <solar@gentoo.org> mpg123-0.59r-r2.ebuild,
+  mpg123-0.59r-r3.ebuild, files/mpg123-0.59s-heapfix.diff:
+  fix heap overflow... bug #40631
 
   15 Feb 2004; Luca Barbato <lu_zero@gentoo.org> mpg123-0.59s-r1.ebuild:
   Marked stable on ppc to fix bug #40631
diff --git a/media-sound/mpg123/Manifest b/media-sound/mpg123/Manifest
index 0ffc3ee06a4d..5fe9b0b8ab93 100644
--- a/media-sound/mpg123/Manifest
+++ b/media-sound/mpg123/Manifest
@@ -1,11 +1,14 @@
-MD5 c376cdf5498323b16bc191ef81fe4bc0 mpg123-0.59r-r3.ebuild 1602
-MD5 9d0a0b2e8441e13d985b2d9ab96815c9 mpg123-0.59r-r2.ebuild 1666
-MD5 214d3fc2581734a9638e7db8ef4485a5 ChangeLog 5532
-MD5 31d795dc315198567875bc4a7a953d91 mpg123-0.59s-r1.ebuild 1647
+MD5 3b972daa6ca50fa8ea320c23769f17cd ChangeLog 5683
+MD5 bef55e460ee2c98c40f6bbb1797debf5 mpg123-0.59r-r2.ebuild 1664
+MD5 a2a2553bf106e5197a5e98ef413290a6 mpg123-0.59r-r3.ebuild 1599
+MD5 e4f7e0316a5a68daada13d0c38929c21 mpg123-0.59s-r1.ebuild 1648
+MD5 8a8718a84870e9560ffccc5ebf34fa3d mpg123-0.59s-r2.ebuild 1685
 MD5 527dcfe3ce0f0b53c6b6aa8b82eb930c metadata.xml 252
-MD5 a80297615f6515bb5631c177511c989a files/mpg123-0.59s-security.diff 1075
+MD5 78e5e78b54876dbecebb45acec8fb449 files/digest-mpg123-0.59s-r2 67
 MD5 8936a4142ebda9826bda6818a51e1524 files/digest-mpg123-0.59r-r2 64
-MD5 7c93b2634ad65c23562f86f6e0b051e2 files/0.59s-generic.patch 532
+MD5 a80297615f6515bb5631c177511c989a files/mpg123-0.59s-security.diff 1075
 MD5 7d563752464873b664d7d242e9d06bbd files/mpg123-0.59s-amd64.patch 2680
-MD5 78e5e78b54876dbecebb45acec8fb449 files/digest-mpg123-0.59s-r1 67
+MD5 7c93b2634ad65c23562f86f6e0b051e2 files/0.59s-generic.patch 532
 MD5 1d1f7b49b09cb2394ef7a7dd893b1fea files/digest-mpg123-0.59r-r3 134
+MD5 78e5e78b54876dbecebb45acec8fb449 files/digest-mpg123-0.59s-r1 67
+MD5 7130077c0324ee5b3cfd58e291976a0e files/mpg123-0.59s-heapfix.diff 337
diff --git a/media-sound/mpg123/files/digest-mpg123-0.59s-r2 b/media-sound/mpg123/files/digest-mpg123-0.59s-r2
new file mode 100644
index 000000000000..88b7f6bafc5b
--- /dev/null
+++ b/media-sound/mpg123/files/digest-mpg123-0.59s-r2
@@ -0,0 +1 @@
+MD5 a63675b0ea7990d4a7d7e7e14f23a3e4 mpg123-pre0.59s.tar.gz 244899
diff --git a/media-sound/mpg123/files/mpg123-0.59s-heapfix.diff b/media-sound/mpg123/files/mpg123-0.59s-heapfix.diff
new file mode 100644
index 000000000000..f5006f2fbc64
--- /dev/null
+++ b/media-sound/mpg123/files/mpg123-0.59s-heapfix.diff
@@ -0,0 +1,11 @@
+--- httpget.c   2000-10-30 18:45:12.000000000 +0100
++++ httpget.c.patch     2004-02-09 10:05:56.000000000 +0100
+@@ -55,7 +55,7 @@ void readstring (char *string, int maxle
+ #endif
+	int pos = 0;
+
+-	while(1) {
++	while(maxlen>pos) {
+		if( read(fileno(f),string+pos,1) == 1) {
+			pos++;                        
+			if(string[pos-1] == '\n') {
diff --git a/media-sound/mpg123/mpg123-0.59r-r2.ebuild b/media-sound/mpg123/mpg123-0.59r-r2.ebuild
index 64d8ec40bbe9..b5cea5ca04d3 100644
--- a/media-sound/mpg123/mpg123-0.59r-r2.ebuild
+++ b/media-sound/mpg123/mpg123-0.59r-r2.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/mpg123-0.59r-r2.ebuild,v 1.7 2003/09/07 00:06:06 msterret Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/mpg123-0.59r-r2.ebuild,v 1.8 2004/02/15 21:10:47 solar Exp $
 
 S=${WORKDIR}/${P}
 
diff --git a/media-sound/mpg123/mpg123-0.59r-r3.ebuild b/media-sound/mpg123/mpg123-0.59r-r3.ebuild
index 2c1de2cd4d92..9c640a8c925a 100644
--- a/media-sound/mpg123/mpg123-0.59r-r3.ebuild
+++ b/media-sound/mpg123/mpg123-0.59r-r3.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2003 Gentoo Technologies, Inc.
+# Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/mpg123-0.59r-r3.ebuild,v 1.3 2003/10/07 14:30:16 brad_mssw Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/mpg123-0.59r-r3.ebuild,v 1.4 2004/02/15 21:10:47 solar Exp $
 
 inherit eutils
 
diff --git a/media-sound/mpg123/mpg123-0.59s-r2.ebuild b/media-sound/mpg123/mpg123-0.59s-r2.ebuild
new file mode 100644
index 000000000000..142077621690
--- /dev/null
+++ b/media-sound/mpg123/mpg123-0.59s-r2.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-sound/mpg123/mpg123-0.59s-r2.ebuild,v 1.1 2004/02/15 21:10:47 solar Exp $
+
+inherit eutils
+
+S=${WORKDIR}/mpg123
+DESCRIPTION="Real Time mp3 player"
+HOMEPAGE="http://www.mpg123.de/"
+SRC_URI="http://www.mpg123.de/mpg123/${PN}-pre${PV}.tar.gz"
+
+SLOT="0"
+LICENSE="as-is"
+KEYWORDS="x86 ia64 ~amd64 ppc sparc alpha ~hppa ~mips"
+
+DEPEND="virtual/glibc
+	>=sys-apps/sed-4"
+
+src_unpack () {
+	unpack ${A} && cd ${S} || die "unpack failed"
+
+	# Apply security fixes
+	epatch ${FILESDIR}/${P}-security.diff
+	epatch ${FILESDIR}/${P}-heapfix.diff
+
+	# Add linux-generic target
+	epatch ${FILESDIR}/${PV}-generic.patch
+
+	# Always apply this patch, even though it's particularly for
+	# amd64.  It's good to understand the distinction between int and
+	# long: ANSI says that int should be 32-bits, long should be the
+	# native size of the CPU (usually the same as a pointer).
+	epatch ${FILESDIR}/mpg123-0.59s-amd64.patch
+
+	# Don't force gcc since icc/ccc might be possible
+	sed -i -e "s|CC=gcc||" Makefile
+
+	# Fix a glitch in the ppc-related section of the Makefile
+	sed -i -e "s:-mcpu=ppc::" Makefile
+}
+
+src_compile() {
+	local style=""
+
+	case $ARCH in
+		ppc)
+			style="-ppc";;
+		x86)
+			use mmx && style="-mmx" || style="-i486";;
+		sparc*)
+			style="-sparc";;
+		amd64|x86_64)
+			style="-x86_64";;
+		alpha)
+			style="-alpha";;
+		arm|hppa|ia64)
+			style="-generic";;
+	esac
+
+	make linux${style} RPM_OPT_FLAGS="${CFLAGS}" || die
+}
+
+src_install () {
+	into /usr
+	dobin mpg123
+	doman mpg123.1
+	dodoc BENCHMARKING BUGS CHANGES COPYING JUKEBOX README* TODO
+}
+