Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=ce8b8e64358612216d00cff71e8508af415a58c1
commit ce8b8e64358612216d00cff71e8508af415a58c1 Author: kikadf <[email protected]> Date: Tue Aug 26 08:28:30 2014 +0200 imaging-1.1.7-5arcturus2-x86_64 * Fix CVE-2014-3589 diff --git a/source/devel-extra/imaging/CVE-2014-3589.patch b/source/devel-extra/imaging/CVE-2014-3589.patch new file mode 100644 index 0000000..51a70de --- /dev/null +++ b/source/devel-extra/imaging/CVE-2014-3589.patch @@ -0,0 +1,92 @@ +diff -Naur Imaging-1.1.7/libImaging/Imaging.h Imaging-1.1.7.new/libImaging/Imaging.h +--- Imaging-1.1.7/libImaging/Imaging.h 2009-11-01 01:44:12.000000000 +0100 ++++ Imaging-1.1.7.new/libImaging/Imaging.h 2014-08-26 08:21:21.800293098 +0200 +@@ -75,7 +75,7 @@ + struct ImagingMemoryInstance { + + /* Format */ +- char mode[4+1]; /* Band names ("1", "L", "P", "RGB", "RGBA", "CMYK") */ ++ char mode[6+1]; /* Band names ("1", "L", "P", "RGB", "RGBA", "CMYK", "YCbCr", "BGR;xy") */ + int type; /* Data type (IMAGING_TYPE_*) */ + int depth; /* Depth (ignored in this version) */ + int bands; /* Number of bands (1, 2, 3, or 4) */ +diff -Naur Imaging-1.1.7/PIL/IcnsImagePlugin.py Imaging-1.1.7.new/PIL/IcnsImagePlugin.py +--- Imaging-1.1.7/PIL/IcnsImagePlugin.py 2009-11-01 01:44:11.000000000 +0100 ++++ Imaging-1.1.7.new/PIL/IcnsImagePlugin.py 2014-08-26 08:21:21.801293127 +0200 +@@ -115,6 +115,8 @@ + i = HEADERSIZE + while i < filesize: + sig, blocksize = nextheader(fobj) ++ if blocksize <= 0: ++ raise SyntaxError('invalid block header') + i = i + HEADERSIZE + blocksize = blocksize - HEADERSIZE + dct[sig] = (i, blocksize) +diff -Naur Imaging-1.1.7/PIL/Image.py Imaging-1.1.7.new/PIL/Image.py +--- Imaging-1.1.7/PIL/Image.py 2009-11-15 16:51:25.000000000 +0100 ++++ Imaging-1.1.7.new/PIL/Image.py 2014-08-26 08:21:21.800293098 +0200 +@@ -1494,11 +1494,11 @@ + def split(self): + "Split image into bands" + ++ self.load() + if self.im.bands == 1: + ims = [self.copy()] + else: + ims = [] +- self.load() + for i in range(self.im.bands): + ims.append(self._new(self.im.getband(i))) + return tuple(ims) +diff -Naur Imaging-1.1.7/Scripts/pilfont.py Imaging-1.1.7.new/Scripts/pilfont.py +--- Imaging-1.1.7/Scripts/pilfont.py 2009-11-01 01:44:12.000000000 +0100 ++++ Imaging-1.1.7.new/Scripts/pilfont.py 2014-08-26 08:21:21.800293098 +0200 +@@ -1,3 +1,5 @@ ++#! /usr/bin/python ++ + # + # The Python Imaging Library + # $Id$ +diff -Naur Imaging-1.1.7/setup.py Imaging-1.1.7.new/setup.py +--- Imaging-1.1.7/setup.py 2009-11-15 17:06:10.000000000 +0100 ++++ Imaging-1.1.7.new/setup.py 2014-08-26 08:21:21.800293098 +0200 +@@ -6,6 +6,8 @@ + # + + import glob, os, re, struct, string, sys ++import subprocess ++from distutils.spawn import find_executable + + # make it possible to run the setup script from another directory + try: +@@ -147,6 +149,16 @@ + add_directory(library_dirs, "/opt/local/lib") + add_directory(include_dirs, "/opt/local/include") + ++ elif find_executable('dpkg-architecture'): ++ # Debian/Ubuntu multiarch support. ++ proc = subprocess.Popen( ++ 'dpkg-architecture -qDEB_HOST_MULTIARCH'.split(), ++ stdout=subprocess.PIPE, stderr=subprocess.STDOUT) ++ stdout, stderr = proc.communicate() ++ multiarch_path = stdout.strip() ++ add_directory(include_dirs, '/usr/include/' + multiarch_path) ++ add_directory(library_dirs, '/usr/lib/' + multiarch_path) ++ + add_directory(library_dirs, "/usr/local/lib") + # FIXME: check /opt/stuff directories here? + +diff -Naur Imaging-1.1.7/Tests/check_icns_dos.py Imaging-1.1.7.new/Tests/check_icns_dos.py +--- Imaging-1.1.7/Tests/check_icns_dos.py 1970-01-01 01:00:00.000000000 +0100 ++++ Imaging-1.1.7.new/Tests/check_icns_dos.py 2014-08-26 08:21:21.800293098 +0200 +@@ -0,0 +1,10 @@ ++# Tests potential DOS of IcnsImagePlugin with 0 length block. ++# Run from anywhere that PIL is importable. ++ ++from PIL import Image ++from io import BytesIO ++ ++if bytes is str: ++ Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00'))) ++else: ++ Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00', 'latin-1'))) diff --git a/source/devel-extra/imaging/FrugalBuild b/source/devel-extra/imaging/FrugalBuild index 3ed73cb..03d15bb 100644 --- a/source/devel-extra/imaging/FrugalBuild +++ b/source/devel-extra/imaging/FrugalBuild @@ -7,7 +7,7 @@ options+=('asneeded') pkgname=imaging realname=${pkgname/imaging/Imaging} pkgver=1.1.7 -pkgrel=5arcturus1 +pkgrel=5arcturus2 pkgdesc="Python Imaging Library" url="http://www.pythonware.com/products/pil/index.htm"; depends=('python' 'libjpeg>=8a' 'zlib' 'freetype2' 'sane-backends' 'libgphoto2>=2.5.0') @@ -22,8 +22,9 @@ _F_cd_path="$realname-$pkgver" sha1sums=('76c37504251171fda8da8e63ecb8bc42a69a5c81') # FSA fix *** -source=(${source[@]} CVE-2014-193x.patch) -sha1sums=(${sha1sums[@]} '3dec2eb288a197f9665c805122c9f7e12313601b') +source=(${source[@]} CVE-2014-193x.patch CVE-2014-3589.patch) +sha1sums=(${sha1sums[@]} '3dec2eb288a197f9665c805122c9f7e12313601b' \ + '8c0c27409831c098ce0efa489135a22b14b39f31') # *********** build() { _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
