Add a patch to fix range-checking and array out-of-bounds access issues.

The patch comes from upstream's svn repository, so it can go away on the
next release.  Fixes bug #481802.

(Portage version: 2.1.12.2/cvs/Linux x86_64, signed Manifest commit with key 0x6521e06d)

1 files changed, 145 insertions, 0 deletions

diff --git a/app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch b/app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch
new file mode 100644
index 000000000000..df9319000c64
--- /dev/null
+++ b/app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch
@@ -0,0 +1,145 @@
+diff --git a/Programs/options.c b/Programs/options.c
+--- a/Programs/options.c	(revision 7568)
++++ b/Programs/options.c	(revision 7570)
+@@ -219,10 +219,10 @@
+ 
+         while (option->strings[index]) {
+           strings[index] = option->strings[index];
+-          ++index;
++          index += 1;
+         }
+ 
+-        while (index < count) strings[index++] = NULL;
++        while (index < count) strings[index++] = "";
+         snprintf(buffer, sizeof(buffer),
+                  description, strings[0], strings[1], strings[2], strings[3]);
+         description = buffer;
+@@ -233,19 +233,36 @@
+ 
+         while (1) {
+           unsigned int charCount = charsLeft;
++
+           if (charCount > descriptionWidth) {
+             charCount = descriptionWidth;
+-            while (description[charCount] != ' ') --charCount;
+-            while (description[charCount] == ' ') --charCount;
+-            ++charCount;
++
++            while (charCount > 0) {
++              if (description[charCount] == ' ') break;
++              charCount -= 1;
++            }
++
++            while (charCount > 0) {
++              if (description[--charCount] != ' ') {
++                charCount += 1;
++                break;
++              }
++            }
+           }
+-          memcpy(line+lineLength, description, charCount);
+-          lineLength += charCount;
+ 
+-          line[lineLength] = 0;
+-          fprintf(outputStream, "%s\n", line);
++          if (charCount > 0) {
++            memcpy(line+lineLength, description, charCount);
++            lineLength += charCount;
+ 
+-          while (description[charCount] == ' ') ++charCount;
++            line[lineLength] = 0;
++            fprintf(outputStream, "%s\n", line);
++          }
++
++          while (charCount < charsLeft) {
++            if (description[charCount] != ' ') break;
++            charCount += 1;
++          }
++
+           if (!(charsLeft -= charCount)) break;
+           description += charCount;
+ 
+diff --git a/Drivers/Speech/Alva/speech.c b/Drivers/Speech/Alva/speech.c
+--- a/Drivers/Speech/Alva/speech.c	(revision 7568)
++++ b/Drivers/Speech/Alva/speech.c	(revision 7570)
+@@ -33,7 +33,7 @@
+ /* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
+  * for chars >=128. 
+  */
+-static unsigned char latin2cp437[128] =
++static unsigned char latin2cp437[0X80] =
+   {199, 252, 233, 226, 228, 224, 229, 231,
+    234, 235, 232, 239, 238, 236, 196, 197,
+    201, 181, 198, 244, 247, 242, 251, 249,
+@@ -75,7 +75,7 @@
+   for (i = 0; i < len; i++)
+     {
+       c = buffer[i];
+-      if (c >= 128) c = latin2cp437[c];
++      if (c >= 0X80) c = latin2cp437[c-0X80];
+       if (c < 33)	/* space or control character */
+ 	{
+ 	  buf[0] = ' ';
+diff --git a/Drivers/Speech/CombiBraille/speech.c b/Drivers/Speech/CombiBraille/speech.c
+--- a/Drivers/Speech/CombiBraille/speech.c	(revision 7568)
++++ b/Drivers/Speech/CombiBraille/speech.c	(revision 7570)
+@@ -43,7 +43,7 @@
+ /* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
+  * for chars >=128. 
+  */
+-static unsigned char latin2cp437[128] =
++static unsigned char latin2cp437[0X80] =
+   {199, 252, 233, 226, 228, 224, 229, 231,
+    234, 235, 232, 239, 238, 236, 196, 197,
+    201, 181, 198, 244, 247, 242, 251, 249,
+@@ -99,7 +99,7 @@
+     unsigned char byte = buffer[i];
+     unsigned char *byte_address = &byte;
+     unsigned int byte_count = 1;
+-    if (byte >= 0X80) byte = latin2cp437[byte];
++    if (byte >= 0X80) byte = latin2cp437[byte-0X80];
+     if (byte < 33) {	/* space or control character */
+       byte = ' ';
+     } else if (byte <= MAX_TRANS) {
+diff --git a/Drivers/Speech/MultiBraille/speech.c b/Drivers/Speech/MultiBraille/speech.c
+--- a/Drivers/Speech/MultiBraille/speech.c	(revision 7568)
++++ b/Drivers/Speech/MultiBraille/speech.c	(revision 7570)
+@@ -35,7 +35,7 @@
+ /* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
+  * for chars >=128. 
+  */
+-static unsigned char latin2cp437[128] =
++static unsigned char latin2cp437[0X80] =
+   {199, 252, 233, 226, 228, 224, 229, 231,
+    234, 235, 232, 239, 238, 236, 196, 197,
+    201, 181, 198, 244, 247, 242, 251, 249,
+@@ -75,7 +75,7 @@
+   for (i = 0; i < len; i++)
+     {
+       c = buffer[i];
+-      if (c >= 128) c = latin2cp437[c];
++      if (c >= 0X80) c = latin2cp437[c-0X80];
+       if (c < 33)	/* space or control character */
+ 	{
+ 	  static const char blank = ' ';
+diff --git a/Drivers/Speech/BrailleLite/speech.c b/Drivers/Speech/BrailleLite/speech.c
+--- a/Drivers/Speech/BrailleLite/speech.c	(revision 7568)
++++ b/Drivers/Speech/BrailleLite/speech.c	(revision 7570)
+@@ -36,7 +36,7 @@
+ /* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
+  * for chars >=128. 
+  */
+-static unsigned char latin2cp437[128] =
++static unsigned char latin2cp437[0X80] =
+   {199, 252, 233, 226, 228, 224, 229, 231,
+    234, 235, 232, 239, 238, 236, 196, 197,
+    201, 181, 198, 244, 247, 242, 251, 249,
+@@ -87,7 +87,7 @@
+   for (i = 0; i < len; i++)
+     {
+       c = buffer[i];
+-      if (c >= 128) c = latin2cp437[c];
++      if (c >= 0X80) c = latin2cp437[c-0X80];
+       if (c < 33)	/* space or control character */
+ 	{
+ 	  rawdata[0] = ' ';