added patch against integer overflow (see bug #202351).

Package-Manager: portage-2.1.4_rc9

3 files changed, 95 insertions, 0 deletions

diff --git a/media-gfx/exiv2/files/CVE-2007-6353.diff b/media-gfx/exiv2/files/CVE-2007-6353.diff
new file mode 100644
index 000000000000..13b7fe9ac312
--- /dev/null
+++ b/media-gfx/exiv2/files/CVE-2007-6353.diff
@@ -0,0 +1,89 @@
+Index: exiv2-0.13/src/exif.cpp
+===================================================================
+--- exiv2-0.13.orig/src/exif.cpp
++++ exiv2-0.13/src/exif.cpp
+@@ -215,10 +215,12 @@ namespace Exiv2 {
+         ExifData::const_iterator sizes;
+         ExifKey key("Exif.Thumbnail.StripByteCounts");
+         sizes = exifData.findKey(key);
+-        if (sizes == exifData.end()) return 2;
++        if (sizes == exifData.end()) return 1;
+ 
+-        long totalSize = 0;
++        uint32_t totalSize = 0;
+         for (long i = 0; i < sizes->count(); ++i) {
++            uint32_t size = sizes->toLong(i);
++            if (size > 0xffffffff - totalSize) return 1;
+             totalSize += sizes->toLong(i);
+         }
+         DataBuf stripsBuf(totalSize);
+@@ -228,21 +230,23 @@ namespace Exiv2 {
+         ExifData::iterator stripOffsets;
+         key = ExifKey("Exif.Thumbnail.StripOffsets");
+         stripOffsets = exifData.findKey(key);
+-        if (stripOffsets == exifData.end()) return 2;
+-        if (stripOffsets->count() != sizes->count()) return 2;
++        if (stripOffsets == exifData.end()) return 1;
++        if (stripOffsets->count() != sizes->count()) return 1;
+ 
+         std::ostringstream os; // for the strip offsets
+-        long currentOffset = 0;
+-        long firstOffset = stripOffsets->toLong(0);
+-        long lastOffset = 0;
+-        long lastSize = 0;
++        uint32_t currentOffset = 0;
++        uint32_t firstOffset = stripOffsets->toLong(0);
++        uint32_t lastOffset = 0;
++        uint32_t lastSize = 0;
+         for (long i = 0; i < stripOffsets->count(); ++i) {
+-            long offset = stripOffsets->toLong(i);
++            uint32_t offset = stripOffsets->toLong(i);
+             lastOffset = offset;
+-            long size = sizes->toLong(i);
++            uint32_t size = sizes->toLong(i);
+             lastSize = size;
+-            if (len < offset + size) return 1;
+-
++            if (   size > 0xffffffff - offset
++                || static_cast<uint32_t>(len) < offset + size) {
++                return 2;
++            }
+             memcpy(stripsBuf.pData_ + currentOffset, buf + offset, size);
+             os << currentOffset << " ";
+             currentOffset += size;
+@@ -303,12 +307,15 @@ namespace Exiv2 {
+         ExifKey key("Exif.Thumbnail.JPEGInterchangeFormat");
+         ExifData::iterator format = exifData.findKey(key);
+         if (format == exifData.end()) return 1;
+-        long offset = format->toLong();
++        uint32_t offset = format->toLong();
+         key = ExifKey("Exif.Thumbnail.JPEGInterchangeFormatLength");
+         ExifData::const_iterator length = exifData.findKey(key);
+         if (length == exifData.end()) return 1;
+-        long size = length->toLong();
+-        if (len < offset + size) return 2;
++        uint32_t size = length->toLong();
++        if (   size > 0xffffffff - offset
++            || static_cast<uint32_t>(len) < offset + size) {
++            return 2;
++        }
+         format->setDataArea(buf + offset, size);
+         format->setValue("0");
+         if (pIfd1) {
+@@ -595,8 +602,14 @@ namespace Exiv2 {
+         if (pIopIfd_) add(pIopIfd_->begin(), pIopIfd_->end(), byteOrder());
+         if (pGpsIfd_) add(pGpsIfd_->begin(), pGpsIfd_->end(), byteOrder());
+         if (pIfd1_)   add(pIfd1_->begin(),   pIfd1_->end(),   byteOrder());
+-        // Read the thumbnail (but don't worry whether it was successful or not)
+-        readThumbnail();
++        // Finally, read the thumbnail
++        rc = readThumbnail();
++        if (0 < rc) {
++#ifndef SUPPRESS_WARNINGS
++            std::cerr << "Warning: Failed to read thumbnail, rc = "
++                      << rc << "\n";
++#endif
++        }
+ 
+         return 0;
+     } // ExifData::load
diff --git a/media-gfx/exiv2/files/digest-exiv2-0.13-r1 b/media-gfx/exiv2/files/digest-exiv2-0.13-r1
new file mode 100644
index 000000000000..d722949efd95
--- /dev/null
+++ b/media-gfx/exiv2/files/digest-exiv2-0.13-r1
@@ -0,0 +1,3 @@
+MD5 492d476e3130ac27983d93e5595d81e8 exiv2-0.13.tar.gz 2841724
+RMD160 e06de2dfeb6941b1fd501bff258763f2f13f98b9 exiv2-0.13.tar.gz 2841724
+SHA256 f1d38ed31bdb54f6c5c80f7cd6765025cac535883b24e630f5bbe5c63e5cff75 exiv2-0.13.tar.gz 2841724
diff --git a/media-gfx/exiv2/files/digest-exiv2-0.15-r1 b/media-gfx/exiv2/files/digest-exiv2-0.15-r1
new file mode 100644
index 000000000000..fbd92cb1983e
--- /dev/null
+++ b/media-gfx/exiv2/files/digest-exiv2-0.15-r1
@@ -0,0 +1,3 @@
+MD5 bb18d19e1d6fb255dadda456cadec00e exiv2-0.15.tar.gz 1133249
+RMD160 b879bcbe8255ae83af7d1cfadb84b01dbc5e97f2 exiv2-0.15.tar.gz 1133249
+SHA256 b72d82e9117308063471993f3832e58064c0599dec3df2bf2a7ce54450984a3e exiv2-0.15.tar.gz 1133249