From 7f3fecbb5b871825fe9632f46659869cab6a3769 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sat, 4 May 2024 00:00:19 +0100 Subject: gentoo auto-resync : 04:05:2024 - 00:00:19 --- media-gfx/Manifest.gz | Bin 37992 -> 37999 bytes media-gfx/fontforge/Manifest | 4 +- ...01-fix-splinefont-shell-command-injection.patch | 174 +++++++++++++++++++++ media-gfx/fontforge/fontforge-20230101-r1.ebuild | 111 +++++++++++++ media-gfx/fontforge/fontforge-20230101.ebuild | 4 +- 5 files changed, 290 insertions(+), 3 deletions(-) create mode 100644 media-gfx/fontforge/files/fontforge-20230101-fix-splinefont-shell-command-injection.patch create mode 100644 media-gfx/fontforge/fontforge-20230101-r1.ebuild (limited to 'media-gfx') diff --git a/media-gfx/Manifest.gz b/media-gfx/Manifest.gz index b53ba1c668f8..6e740033f731 100644 Binary files a/media-gfx/Manifest.gz and b/media-gfx/Manifest.gz differ diff --git a/media-gfx/fontforge/Manifest b/media-gfx/fontforge/Manifest index fc0194fb8520..509d2108be13 100644 --- a/media-gfx/fontforge/Manifest +++ b/media-gfx/fontforge/Manifest @@ -1,5 +1,7 @@ +AUX fontforge-20230101-fix-splinefont-shell-command-injection.patch 5688 BLAKE2B 9940dd5fd04cc61b87e2498064e9b5e70a9806b9a70a2d93a155d932f888e7bd7e7a11a5f44972feec41c6359e39fa4be982850db7fbceba095a6b35968d4d1a SHA512 1f90a8596c831008fd0a4accbd496455a7951c4ca706aebcfff8091148569680538897e02833bd6d5f92dc885921a92cee6b91f89c70543e0e4856767775ef45 AUX fontforge-20230101-workaround-broken-translations.patch 5219 BLAKE2B 17ead2e7c178911b48de35c6c86ce60b486a000c05ea5d11e79094851b9e4e68e32335a33ef2b49aeaf0fb161b3823e35f1b281feae426b9b69baabb35c5e02c SHA512 250850a8345511b222faeb7cf6209d412611491a5c9d83f7ad14408b1936059c4fe52cbe834b5d26579281539156b93e692bd8873aea445f23b5d78a0e1684f8 AUX fontforge-doc-no-warn-error.patch 834 BLAKE2B c8bd1cfcf320b7831cc64d67d8de52b37e2f37bbac91d5df709d23e144ae33ec02907606348185eac7030f5151719e0023c0d9fda5395334a15c56f7174151c4 SHA512 6055f1696f1910e81ab1b84b48d336c1a097b53618a3a960e8ce2aeb57e05ad364848d48082b792cd4d5cc85fc95947cddd2e04e7a98c5ceb6f9ced14bd4e674 DIST fontforge-20230101.tar.xz 13761728 BLAKE2B 69e79e7c5d8b551a847ba8706157b0f559ae2a85f61711f50e4855eb6a177bbfb25de2650caf9bc8a7dd1d6af074ca5063519b2f3c151d8c784c4750c6ddc1d8 SHA512 7684a2824d5199e230d2e0a654c2119cef422a57b64e6dd75afde6ba623abed6581f596fd5b7509e03f3b3ad3cf69629aafd4c85aeda64fa91a9e1ab88c9b418 -EBUILD fontforge-20230101.ebuild 2876 BLAKE2B 558dd465be9929cc2a9c6b728f46e9f3035f58f991e6c57be8726db73c1950302532fa06c3a7c52cb3a21a6c38c802458aa07d37ed589ab7750166fae2419404 SHA512 954952689766a1b65ccd97ff93fac89ef58c3ad79d6e42b6538378a5a95560749cdc20f8b25be31607280b785c12abd6f5b204b152b75fdb148fac1d587ba7d2 +EBUILD fontforge-20230101-r1.ebuild 2960 BLAKE2B 5988bbdb0fa1bdd86808ddda887a707d9501581da7c5fa7e88f8b80bdd51217624194411ca2aa1a9b575a85a5a5ad2db116a283423257274319fc9b5097809f4 SHA512 afc00739a406af802cc5a813ff89fdd937b470f1dd1651bb203a5c5feda2d408d8e1cb3c821d3ab000984bb93a3da08e40c5cf15a7cfb9be731837188515459d +EBUILD fontforge-20230101.ebuild 2877 BLAKE2B 838d3272eaca260bd5728ecdb6a5f69c3ce5fdbb18432529ff2f536951265d646f7c7ca39bad7c5bb7ec57aaeb312492d7537013d466f263efcd2eedb235bdb3 SHA512 f75fd950ed8e356d09467a6b46980dfba2351239b111a8bf89d17d59167172c5ae3eb0f0254ec86831a4b90dbb9157dd4ef30a154f4b1158bb53e8ed7de2c0c9 MISC metadata.xml 863 BLAKE2B 6a87762712128bf3d57122277839008c4ef057491ae1c1680a166194037ed00e66816f2c0c09be8a17909843ad49b807c06405b95332684dbee3b8d60d30d7ae SHA512 8f33c7d38f031fbf85c82b9743db80c2a3c85ddddeb4deb631fbb911a8e6c2e97b43560b82539ac93df0c577abe74ef743fd4ca1a3e2e2f978b7edfd94cba280 diff --git a/media-gfx/fontforge/files/fontforge-20230101-fix-splinefont-shell-command-injection.patch b/media-gfx/fontforge/files/fontforge-20230101-fix-splinefont-shell-command-injection.patch new file mode 100644 index 000000000000..e61f2b8d3633 --- /dev/null +++ b/media-gfx/fontforge/files/fontforge-20230101-fix-splinefont-shell-command-injection.patch @@ -0,0 +1,174 @@ +https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429 + +From 216eb14b558df344b206bf82e2bdaf03a1f2f429 Mon Sep 17 00:00:00 2001 +From: Peter Kydas +Date: Tue, 6 Feb 2024 20:03:04 +1100 +Subject: [PATCH] fix splinefont shell command injection (#5367) + +--- a/fontforge/splinefont.c ++++ b/fontforge/splinefont.c +@@ -788,11 +788,14 @@ return( name ); + + char *Unarchive(char *name, char **_archivedir) { + char *dir = getenv("TMPDIR"); +- char *pt, *archivedir, *listfile, *listcommand, *unarchivecmd, *desiredfile; ++ char *pt, *archivedir, *listfile, *desiredfile; + char *finalfile; + int i; + int doall=false; + static int cnt=0; ++ gchar *command[5]; ++ gchar *stdoutresponse = NULL; ++ gchar *stderrresponse = NULL; + + *_archivedir = NULL; + +@@ -827,18 +830,30 @@ return( NULL ); + listfile = malloc(strlen(archivedir)+strlen("/" TOC_NAME)+1); + sprintf( listfile, "%s/" TOC_NAME, archivedir ); + +- listcommand = malloc( strlen(archivers[i].unarchive) + 1 + +- strlen( archivers[i].listargs) + 1 + +- strlen( name ) + 3 + +- strlen( listfile ) +4 ); +- sprintf( listcommand, "%s %s %s > %s", archivers[i].unarchive, +- archivers[i].listargs, name, listfile ); +- if ( system(listcommand)!=0 ) { +- free(listcommand); free(listfile); +- ArchiveCleanup(archivedir); +-return( NULL ); +- } +- free(listcommand); ++ command[0] = archivers[i].unarchive; ++ command[1] = archivers[i].listargs; ++ command[2] = name; ++ command[3] = NULL; // command args need to be NULL-terminated ++ ++ if ( g_spawn_sync( ++ NULL, ++ command, ++ NULL, ++ G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ &stdoutresponse, ++ &stderrresponse, ++ NULL, ++ NULL ++ ) == FALSE) { // did not successfully execute ++ ArchiveCleanup(archivedir); ++ return( NULL ); ++ } ++ // Write out the listfile to be read in later ++ FILE *fp = fopen(listfile, "wb"); ++ fwrite(stdoutresponse, strlen(stdoutresponse), 1, fp); ++ fclose(fp); + + desiredfile = ArchiveParseTOC(listfile, archivers[i].ars, &doall); + free(listfile); +@@ -847,22 +862,28 @@ return( NULL ); + return( NULL ); + } + +- /* I tried sending everything to stdout, but that doesn't work if the */ +- /* output is a directory file (ufo, sfdir) */ +- unarchivecmd = malloc( strlen(archivers[i].unarchive) + 1 + +- strlen( archivers[i].listargs) + 1 + +- strlen( name ) + 1 + +- strlen( desiredfile ) + 3 + +- strlen( archivedir ) + 30 ); +- sprintf( unarchivecmd, "( cd %s ; %s %s %s %s ) > /dev/null", archivedir, +- archivers[i].unarchive, +- archivers[i].extractargs, name, doall ? "" : desiredfile ); +- if ( system(unarchivecmd)!=0 ) { +- free(unarchivecmd); free(desiredfile); +- ArchiveCleanup(archivedir); +-return( NULL ); ++ command[0] = archivers[i].unarchive; ++ command[1] = archivers[i].extractargs; ++ command[2] = name; ++ command[3] = doall ? "" : desiredfile; ++ command[4] = NULL; ++ ++ if ( g_spawn_sync( ++ (gchar*)archivedir, ++ command, ++ NULL, ++ G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ &stdoutresponse, ++ &stderrresponse, ++ NULL, ++ NULL ++ ) == FALSE) { // did not successfully execute ++ free(desiredfile); ++ ArchiveCleanup(archivedir); ++ return( NULL ); + } +- free(unarchivecmd); + + finalfile = malloc( strlen(archivedir) + 1 + strlen(desiredfile) + 1); + sprintf( finalfile, "%s/%s", archivedir, desiredfile ); +@@ -885,20 +906,54 @@ struct compressors compressors[] = { + + char *Decompress(char *name, int compression) { + char *dir = getenv("TMPDIR"); +- char buf[1500]; + char *tmpfn; +- ++ gchar *command[4]; ++ gint stdout_pipe; ++ gchar buffer[4096]; ++ gssize bytes_read; ++ GByteArray *binary_data = g_byte_array_new(); ++ + if ( dir==NULL ) dir = P_tmpdir; + tmpfn = malloc(strlen(dir)+strlen(GFileNameTail(name))+2); + strcpy(tmpfn,dir); + strcat(tmpfn,"/"); + strcat(tmpfn,GFileNameTail(name)); + *strrchr(tmpfn,'.') = '\0'; +- snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfn ); +- if ( system(buf)==0 ) +-return( tmpfn ); +- free(tmpfn); +-return( NULL ); ++ ++ command[0] = compressors[compression].decomp; ++ command[1] = "-c"; ++ command[2] = name; ++ command[3] = NULL; ++ ++ // Have to use async because g_spawn_sync doesn't handle nul-bytes in the output (which happens with binary data) ++ if (g_spawn_async_with_pipes( ++ NULL, ++ command, ++ NULL, ++ G_SPAWN_DO_NOT_REAP_CHILD | G_SPAWN_SEARCH_PATH, ++ NULL, ++ NULL, ++ NULL, ++ NULL, ++ &stdout_pipe, ++ NULL, ++ NULL) == FALSE) { ++ //command has failed ++ return( NULL ); ++ } ++ ++ // Read binary data from pipe and output to file ++ while ((bytes_read = read(stdout_pipe, buffer, sizeof(buffer))) > 0) { ++ g_byte_array_append(binary_data, (guint8 *)buffer, bytes_read); ++ } ++ close(stdout_pipe); ++ ++ FILE *fp = fopen(tmpfn, "wb"); ++ fwrite(binary_data->data, sizeof(gchar), binary_data->len, fp); ++ fclose(fp); ++ g_byte_array_free(binary_data, TRUE); ++ ++ return(tmpfn); + } + + static char *ForceFileToHaveName(FILE *file, char *exten) { diff --git a/media-gfx/fontforge/fontforge-20230101-r1.ebuild b/media-gfx/fontforge/fontforge-20230101-r1.ebuild new file mode 100644 index 000000000000..261c8f986c79 --- /dev/null +++ b/media-gfx/fontforge/fontforge-20230101-r1.ebuild @@ -0,0 +1,111 @@ +# Copyright 2004-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{10..12} ) +inherit python-single-r1 xdg cmake + +DESCRIPTION="postscript font editor and converter" +HOMEPAGE="https://fontforge.org/" +SRC_URI="https://github.com/fontforge/fontforge/releases/download/${PV}/${P}.tar.xz" + +LICENSE="BSD GPL-3+" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos" +IUSE="doc truetype-debugger gif gtk jpeg png +python readline test tiff svg woff2 X" +RESTRICT="!test? ( test )" +REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )" + +RDEPEND=" + >=dev-libs/glib-2.67:2 + dev-libs/libltdl:0 + dev-libs/libxml2:2= + >=media-libs/freetype-2.3.7:2= + gif? ( media-libs/giflib:= ) + jpeg? ( media-libs/libjpeg-turbo:= ) + png? ( media-libs/libpng:= ) + tiff? ( media-libs/tiff:= ) + truetype-debugger? ( >=media-libs/freetype-2.3.8:2[fontforge,-bindist(-)] ) + gtk? ( >=x11-libs/gtk+-3.10:3 ) + !gtk? ( + X? ( + >=x11-libs/cairo-1.6:0= + >=x11-libs/pango-1.10:0=[X] + x11-libs/libX11:= + x11-libs/libXi:= + ) + ) + python? ( ${PYTHON_DEPS} ) + readline? ( sys-libs/readline:0= ) + woff2? ( media-libs/woff2:0= ) +" +DEPEND="${RDEPEND} + !gtk? ( X? ( x11-base/xorg-proto ) ) +" +BDEPEND=" + sys-devel/gettext + doc? ( >=dev-python/sphinx-2 ) + python? ( ${PYTHON_DEPS} ) + test? ( ${RDEPEND} ) +" + +PATCHES=( + "${FILESDIR}"/fontforge-doc-no-warn-error.patch + "${FILESDIR}"/${PN}-20230101-workaround-broken-translations.patch + "${FILESDIR}"/${PN}-20230101-fix-splinefont-shell-command-injection.patch +) + +pkg_setup() { + use python && python-single-r1_pkg_setup +} + +src_configure() { + local mycmakeargs=( + -DENABLE_DOCS=$(usex doc ON OFF) + -DENABLE_LIBGIF=$(usex gif ON OFF) + -DENABLE_LIBJPEG=$(usex jpeg ON OFF) + -DENABLE_LIBPNG=$(usex png ON OFF) + -DENABLE_LIBREADLINE=$(usex readline ON OFF) + -DENABLE_LIBSPIRO=OFF # No package in Gentoo + -DENABLE_LIBTIFF=$(usex tiff ON OFF) + -DENABLE_MAINTAINER_TOOLS=OFF + -DENABLE_PYTHON_EXTENSION=$(usex python ON OFF) + -DENABLE_PYTHON_SCRIPTING=$(usex python ON OFF) + -DENABLE_TILE_PATH=ON + -DENABLE_WOFF2=$(usex woff2 ON OFF) + ) + + if use gtk || use X; then + mycmakeargs+=( + -DENABLE_GUI=ON + # Prefer GTK over X11 if both USE flage are enabled + -DENABLE_X11=$(usex gtk OFF ON) + ) + else + mycmakeargs+=( -DENABLE_GUI=OFF ) + fi + + if use python; then + python_setup + mycmakeargs+=( -DPython3_EXECUTABLE="${PYTHON}" ) + fi + + if use truetype-debugger ; then + local ft2="${ESYSROOT}/usr/include/freetype2" + local ft2i="${ft2}/internal4fontforge" + mycmakeargs+=( + -DENABLE_FREETYPE_DEBUGGER="${ft2}" + -DFreeTypeSource_INCLUDE_DIRS="${ft2};${ft2i}/include;${ft2i}/include/freetype;${ft2i}/src/truetype" + ) + fi + + cmake_src_configure +} + +src_install() { + cmake_src_install + docompress -x /usr/share/doc/${PF}/html + einstalldocs + find "${ED}" -name '*.la' -type f -delete || die +} diff --git a/media-gfx/fontforge/fontforge-20230101.ebuild b/media-gfx/fontforge/fontforge-20230101.ebuild index 001bb06fc921..f9af4d4aad6b 100644 --- a/media-gfx/fontforge/fontforge-20230101.ebuild +++ b/media-gfx/fontforge/fontforge-20230101.ebuild @@ -1,9 +1,9 @@ -# Copyright 2004-2023 Gentoo Authors +# Copyright 2004-2024 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 -PYTHON_COMPAT=( python3_{9..11} ) +PYTHON_COMPAT=( python3_{10..12} ) inherit python-single-r1 xdg cmake DESCRIPTION="postscript font editor and converter" -- cgit v1.2.3