"A vulnerability in libwmf can be potentially exploited by malicious
people to compromise an application using the vulnerable library.
The vulnerability is caused due to an integer overflow error when
allocating memory based on a value taken directly from a WMF file
without performing any checks. This can be exploited to cause a
heap-based buffer overflow when a specially crafted WMF file is
processed.
Successful exploitation may allow execution of arbitrary code."
http://secunia.com/advisories/20921/http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376
Patch from Red Hat. Bump PKGREVISION.
and add a new helper target and script, "show-buildlink3", that outputs
a listing of the buildlink3.mk files included as well as the depth at
which they are included.
For example, "make show-buildlink3" in fonts/Xft2 displays:
zlib
fontconfig
iconv
zlib
freetype2
expat
freetype2
Xrender
renderproto
RECOMMENDED is removed. It becomes ABI_DEPENDS.
BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo.
BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo.
BUILDLINK_DEPENDS does not change.
IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS
which defaults to "yes".
Added to obsolete.mk checking for IGNORE_RECOMMENDED.
I did not manually go through and fix any aesthetic tab/spacing issues.
I have tested the above patch on DragonFly building and packaging
subversion and pkglint and their many dependencies.
I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I
have used IGNORE_RECOMMENDED for a long time). I have been an active user
of IGNORE_RECOMMENDED since it was available.
As suggested, I removed the documentation sentences suggesting bumping for
"security" issues.
As discussed on tech-pkg.
I will commit to revbump, pkglint, pkg_install, createbuildlink separately.
Note that if you use wip, it will fail! I will commit to pkgsrc-wip
later (within day).
* 3 patches from Caolan at RedHat: remove unnecessary extra linked
libs; remove some warnings; rh154813 which (same redhat issuzilla
bug id) I theorize fixes some upsidedown wmfs.
Several changes are involved since they are all interrelated. These
changes affect about 1000 files.
The first major change is rewriting bsd.builtin.mk as well as all of
the builtin.mk files to follow the new example in bsd.builtin.mk.
The loop to include all of the builtin.mk files needed by the package
is moved from bsd.builtin.mk and into bsd.buildlink3.mk. bsd.builtin.mk
is now included by each of the individual builtin.mk files and provides
some common logic for all of the builtin.mk files. Currently, this
includes the computation for whether the native or pkgsrc version of
the package is preferred. This causes USE_BUILTIN.* to be correctly
set when one builtin.mk file includes another.
The second major change is teach the builtin.mk files to consider
files under ${LOCALBASE} to be from pkgsrc-controlled packages. Most
of the builtin.mk files test for the presence of built-in software by
checking for the existence of certain files, e.g. <pthread.h>, and we
now assume that if that file is under ${LOCALBASE}, then it must be
from pkgsrc. This modification is a nod toward LOCALBASE=/usr. The
exceptions to this new check are the X11 distribution packages, which
are handled specially as noted below.
The third major change is providing builtin.mk and version.mk files
for each of the X11 distribution packages in pkgsrc. The builtin.mk
file can detect whether the native X11 distribution is the same as
the one provided by pkgsrc, and the version.mk file computes the
version of the X11 distribution package, whether it's built-in or not.
The fourth major change is that the buildlink3.mk files for X11 packages
that install parts which are part of X11 distribution packages, e.g.
Xpm, Xcursor, etc., now use imake to query the X11 distribution for
whether the software is already provided by the X11 distribution.
This is more accurate than grepping for a symbol name in the imake
config files. Using imake required sprinkling various builtin-imake.mk
helper files into pkgsrc directories. These files are used as input
to imake since imake can't use stdin for that purpose.
The fifth major change is in how packages note that they use X11.
Instead of setting USE_X11, package Makefiles should now include
x11.buildlink3.mk instead. This causes the X11 package buildlink3
and builtin logic to be executed at the correct place for buildlink3.mk
and builtin.mk files that previously set USE_X11, and fixes packages
that relied on buildlink3.mk files to implicitly note that X11 is
needed. Package buildlink3.mk should also include x11.buildlink3.mk
when linking against the package libraries requires also linking
against the X11 libraries. Where it was obvious, redundant inclusions
of x11.buildlink3.mk have been removed.
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
CygWin changes mostly (all thanks to Tor Lillqvist), though build-tools
updates may make it build better on various systems. Has been tested by
various people since February; thought it was well-past time to release
this properly...
ChangeLog says:
* configure.ac: Don't use -lm on Windows. mingw has an (empty)
dummy libm, but it confuses libtool.) [Tor Lillqvist <tml@iki.fi>]
* libwm-config.in: Make installation-location-independent when run
in a Cygwin shell. [Tor Lillqvist <tml@iki.fi>]
* src/Makefile.am: Don't use -lm on Windows. Add libwmflite.la to
io_wmf_la_LIBADD. [Tor Lillqvist <tml@iki.fi>]
* src/wmf.c: Don't use hardcoded path for WMF_FONTDIR on Windows.
Instead, assume being built as a DLL, and look up the DLL
location in a DllMain routine, and use that to build the font
directory path at run-time. [Tor Lillqvist <tml@iki.fi>]
* src/font.c: Don't use hardcoded path for WMF_XTRA_FONTMAP either.
(remap_font_file_name): On Windows, if a font file name starts
with the build-time prefix, replace that with the run-time
installation prefix. [Tor Lillqvist <tml@iki.fi>]
I have been using this in my pkgsrc one a few systems for maybe two
months.
and wmf2x is part of libwmf2 (which we have now).
So change the reference.
This will close my PR #pkg/22937.
The other wording in this DESCRiption is still unclear to me.
by moving the inclusion of buildlink3.mk files outside of the protected
region. This bug would be seen by users that have set PREFER_PKGSRC
or PREFER_NATIVE to non-default values.
BUILDLINK_PACKAGES should be ordered so that for any package in the
list, that package doesn't depend on any packages to the left of it
in the list. This ordering property is used to check for builtin
packages in the correct order. The problem was that including a
buildlink3.mk file for <pkg> correctly ensured that <pkg> was removed
from BUILDLINK_PACKAGES and appended to the end. However, since the
inclusion of any other buildlink3.mk files within that buildlink3.mk
was in a region that was protected against multiple inclusion, those
dependencies weren't also moved to the end of BUILDLINK_PACKAGES.
Some pkgsrc things
- Fix PLISTs for packages that use -release
- Include canonicalisation of a couple of paths for the benefit
of qt3-*
- the normal version=sunos patching
- fix all library_names_spec for the standard set of symlinks
The libtool things some of which had already made it into pkgsrc libtool.
New in 1.5.2: 2004-01-25; CVS version 1.5.0a, Libtool team:
* lt_dlrealloc is an official part of the libltdl API.
* --tag, --silent and --debug options are preserved and reused when libtool
calls itself for relinking etc.
* `-pthread' and similar options are honoured when linking shared libraries.
* -no-suppress in compile mode shows compiler output for both PIC and non-PIC
object compilation.
* New link mode option `-precious-files-regex' to prevent accidental removal
of files you want to keep, such as test coverage data, from the temporary
output directory.
* Directories specified in /etc/ld.so.conf are no longer hardcoded on Linux.
* Recognises the 'R' symbol type on Solaris so read-only symbols can be
exported.
* Bug fixes.
New in 1.5: 2003-04-14; CVS version 1.4e, Libtool team:
* First stable release of multi-language architecture.
* libtool and libltdl support for Mac OS/X.
* libltdl will now use cygwins dlopen API instead of always forcing
LoadLibrary.
* Support auto-import patch to binutils on cygwin for much improved dll
support.
* Bug fixes.
New in 1.4.3: 2002-10-13; CVS version 1.4.2a, Robert Boehne:
* The libltdl subdirectory now bootstraps correctly with Automake 1.5.
* srcdir != builddir builds with Automake 1.5 work correctly.
* Support for mips-compaq-nonstopux.
* New command line argument, --preserve-dup-deps prevents removal of
duplicate dependent libraries.
New in 1.4d: 2002-01-07; CVS version 1.4c, Libtool team:
* Help strings display correctly again.
* Better error messages when library linking fails.
* Better error messages from libltdl when loading fails.
* Better search path management in libltdl with `lt_dlinsertsearchdir' call.
* Support /lib/w32api in recent cygwin releases.
* Support cross compilation to mingw.
* Support for .rc files (Windows resource compiler).
* Improved handling of mingw gcc.
* Improved handling of $PATH with entries containing spaces.
* Improved support for linking with gcc on aix4* and aix5*.
* Improved support for GCC 3.0.
* Initial support for QNX RTOS, UnixWare 7 and OpenUNIX 8.
* Bug fixes to the OpenBSD port.
* Bug fixes.
New in 1.4.2: 2001-09-11; CVS version 1.4.1a, Gary V. Vaughan:
* libltdl now builds on solaris again
* diagnose and warn about not-quite-working combinations of gcc and
ld on solaris.
* Improved OpenBSD support.
* Improved cygwin support.
* Bugfixes.
New in 1.4.1: 2001-09-03; CVS version 1.4.0a, Libtool team:
* Better error messages from libltdl when loading fails.
* Don't leave here-doc files behind.
* Improved support for OpenBSD.
* Libtool will build with autoconf-2.50 and higher.
* Plug memory management bugs in libltdl.
* Prefer shl_load to dlopen for better operation on HP-UX.
New in 1.4b: 2001-07-09; CVS version 1.4a, Libtool team:
* Now bootstraps with autoconf-2.50 and automake-1.4-p4.
* Always try to build at least a static lib, even if both static and
shared libs were disabled.
* Full support for C++ compiler.
* Support for GNU gcj compiler.
* libltdl can now load all modules in a given path according to user
supplied criteria with `lt_dlforeachfile' call.
* Improved support for AIX ia64, djgpp, HPUX, hurd, OpenBSD, sco3.2*.
* Internal mutex handling no longer has namespace clashes on NCR MP-RAS.
* New pdemo and tagdemo tests.
* Bug fixes.
changes:
* update wmf2x & wmf2gd to use wmf_display_size() (fjf)
* ditch wmf_gd_image_free(); api_destroy takes care of the image (fjf)
* add new wmf_display_size() function which returns integer
size of image for display; io-wmf loader update (dom)
* add two convenience functions to xgd device layer for
manipulating GD image post-conversion (fjf)
* give libwmflite its own interface/binary numbers (fjf)
* change gd.c (add _tpixels member to gdImageStruct)
- now allocates contiguous array for truecolor pixels (fjf)
* gdk-pixbuf plugin added (dom); config update (fjf)
(needed for gimageview)
