commit: 4e89ec853a42dd375ccc12057c9376e6786d44ba Author: John Helmert III <jchelmert3 <AT> posteo <DOT> net> AuthorDate: Fri Jun 19 03:50:19 2020 +0000 Commit: Aaron Bauman <bman <AT> gentoo <DOT> org> CommitDate: Sun Jun 28 22:16:56 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e89ec85
app-text/hunspell: Patch CVE-2019-16707 Bug: https://bugs.gentoo.org/717968 Package-Manager: Portage-2.3.101, Repoman-2.3.22 Signed-off-by: John Helmert III <jchelmert3 <AT> posteo.net> Closes: https://github.com/gentoo/gentoo/pull/16320 Signed-off-by: Aaron Bauman <bman <AT> gentoo.org> .../files/hunspell-1.7.0-CVE-2019-16707.patch | 22 ++++++ app-text/hunspell/hunspell-1.7.0-r2.ebuild | 89 ++++++++++++++++++++++ 2 files changed, 111 insertions(+) diff --git a/app-text/hunspell/files/hunspell-1.7.0-CVE-2019-16707.patch b/app-text/hunspell/files/hunspell-1.7.0-CVE-2019-16707.patch new file mode 100644 index 00000000000..649eef5b293 --- /dev/null +++ b/app-text/hunspell/files/hunspell-1.7.0-CVE-2019-16707.patch @@ -0,0 +1,22 @@ +From ac938e2ecb48ab4dd21298126c7921689d60571b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caol...@redhat.com> +Date: Tue, 12 Nov 2019 20:03:15 +0000 +Subject: [PATCH] invalid read memory access #624 + +--- + src/hunspell/suggestmgr.cxx | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/hunspell/suggestmgr.cxx b/src/hunspell/suggestmgr.cxx +index dba084e9..c23f165a 100644 +--- a/src/hunspell/suggestmgr.cxx ++++ b/src/hunspell/suggestmgr.cxx +@@ -2040,7 +2040,7 @@ int SuggestMgr::leftcommonsubstring( + int l2 = su2.size(); + // decapitalize dictionary word + if (complexprefixes) { +- if (su1[l1 - 1] == su2[l2 - 1]) ++ if (l1 && l2 && su1[l1 - 1] == su2[l2 - 1]) + return 1; + } else { + unsigned short idx = su2.empty() ? 0 : (su2[0].h << 8) + su2[0].l; diff --git a/app-text/hunspell/hunspell-1.7.0-r2.ebuild b/app-text/hunspell/hunspell-1.7.0-r2.ebuild new file mode 100644 index 00000000000..209dab4e6da --- /dev/null +++ b/app-text/hunspell/hunspell-1.7.0-r2.ebuild @@ -0,0 +1,89 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +inherit autotools flag-o-matic + +MY_P="${PN}-${PV/_beta/b}" + +DESCRIPTION="Hunspell spell checker - an improved replacement for myspell in OOo" +SRC_URI="https://github.com/hunspell/hunspell/archive/v${PV}.tar.gz -> ${P}.tar.gz" +HOMEPAGE="https://github.com/hunspell"; + +SLOT="0/$(ver_cut 1-2)" +LICENSE="MPL-1.1 GPL-2 LGPL-2.1" +IUSE="ncurses nls readline static-libs" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris" + +RDEPEND=" + ncurses? ( sys-libs/ncurses:0= ) + readline? ( sys-libs/readline:= ) +" +DEPEND="${RDEPEND} + sys-devel/gettext +" + +LANGS="af bg ca cs cy da de de-1901 el en eo es et fo fr ga gl he hr hu ia id +is it kk km ku lt lv mi mk ms nb nl nn pl pt pt-BR ro ru sk sl sq sv sw tn uk +zu" + +PDEPEND="" +for lang in ${LANGS}; do + IUSE+=" l10n_${lang}" + case ${lang} in + de-1901) dict="de_1901" ;; + pt-BR) dict="pt-br" ;; + *) dict="${lang}" ;; + esac + PDEPEND+=" l10n_${lang}? ( app-dicts/myspell-${dict} )" +done +unset dict lang LANGS + +S="${WORKDIR}/${MY_P}" + +DOCS=( + AUTHORS ChangeLog NEWS THANKS license.hunspell + license.myspell README.md +) + +PATCHES=( + # Upstream package creates some executables which names are too generic + # to be placed in /usr/bin - this patch prefixes them with 'hunspell-'. + # It modifies a Makefile.am file, hence eautoreconf. + "${FILESDIR}/${PN}-1.7.0-renameexes.patch" + + "${FILESDIR}/${PN}-1.7.0-tinfo.patch" #692614 + "${FILESDIR}/${PN}-1.7.0-CVE-2019-16707.patch" +) + +src_prepare() { + default + eautoreconf +} + +src_configure() { + # missing somehow, and I am too lazy to fix it properly + [[ ${CHOST} == *-darwin* ]] && append-libs -liconv + + # I wanted to put the include files in /usr/include/hunspell. + # You can do that, libreoffice can find them anywhere, just + # ping me when you do so ; -- scarabeus + local myeconfargs=( + $(use_enable nls) + $(use_with ncurses ui) + $(use_with readline readline) + $(use_enable static-libs static) + ) + econf "${myeconfargs[@]}" +} + +src_install() { + default + einstalldocs + find "${ED}" -type f -name '*.la' -delete || die + + #342449 + pushd "${ED}"/usr/$(get_libdir)/ >/dev/null + ln -s lib${PN}{-$(ver_cut 1).$(ver_cut 2).so.0.0.1,.so} + popd >/dev/null +}
