CVS commit: pkgsrc/www/firefox

["Martin Husemann" <martin%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   martin
Date:           Fri Dec  9 11:51:09 UTC 2016

Modified Files:
        pkgsrc/www/firefox: Makefile distinfo
Added Files:
        pkgsrc/www/firefox/patches: patch-modules_woff2_src_store_bytes.h
            patch-modules_woff2_src_woff2_common.cc

Log Message:
Avoid crashes when decoding woff2 fonts on alignment critical architectures


To generate a diff of this commit:
cvs rdiff -u -r1.273 -r1.274 pkgsrc/www/firefox/Makefile
cvs rdiff -u -r1.263 -r1.264 pkgsrc/www/firefox/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/www/firefox/patches/patch-modules_woff2_src_store_bytes.h \
    pkgsrc/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox/Makefile
diff -u pkgsrc/www/firefox/Makefile:1.273 pkgsrc/www/firefox/Makefile:1.274
--- pkgsrc/www/firefox/Makefile:1.273   Sun Dec  4 05:17:43 2016
+++ pkgsrc/www/firefox/Makefile Fri Dec  9 11:51:09 2016
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.273 2016/12/04 05:17:43 ryoon Exp $
+# $NetBSD: Makefile,v 1.274 2016/12/09 11:51:09 martin Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
 MOZ_BRANCH=            50.0
@@ -6,7 +6,7 @@ MOZ_BRANCH_MINOR=       .2
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       firefox-${MOZ_BRANCH}${MOZ_BRANCH_MINOR:S/b/beta/:S/esr//}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}

Index: pkgsrc/www/firefox/distinfo
diff -u pkgsrc/www/firefox/distinfo:1.263 pkgsrc/www/firefox/distinfo:1.264
--- pkgsrc/www/firefox/distinfo:1.263   Mon Dec  5 11:54:45 2016
+++ pkgsrc/www/firefox/distinfo Fri Dec  9 11:51:09 2016
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.263 2016/12/05 11:54:45 martin Exp $
+$NetBSD: distinfo,v 1.264 2016/12/09 11:51:09 martin Exp $
 
 SHA1 (firefox-50.0.2.source.tar.xz) = 083b9a803b25064b2d7d43e289797a9f2a2e9e5d
 RMD160 (firefox-50.0.2.source.tar.xz) = 67395703c955b3285237b66317df13229aeec479
@@ -105,6 +105,8 @@ SHA1 (patch-mobile_android_installer_Mak
 SHA1 (patch-mobile_android_installer_package-manifest.in) = e978af41ff0c4b5e477bd3387594e238dc2ec224
 SHA1 (patch-modules_libjar_nsZipArchive.cpp) = 133b1658839d9b0f932a601670862c1f4cd70881
 SHA1 (patch-modules_libpref_init_all.js) = 3bc5962fdabb5aecb72ffc7e73bb56392d1ea717
+SHA1 (patch-modules_woff2_src_store_bytes.h) = f7081a6ffadc79e19f30137ca805b962e60821e8
+SHA1 (patch-modules_woff2_src_woff2_common.cc) = 77dec15dad41d47a3f85e578587c3a137a8dc7f3
 SHA1 (patch-moz.configure) = cd4d3851e9dc2c1adb6a92b6f3cd1966adcd5beb
 SHA1 (patch-mozglue_build_arm.cpp) = f41ace63b3f1d2a8ccaffc98c3c64d1e22af5249
 SHA1 (patch-mozglue_build_arm.h) = 5e272f4e19b9681d43a63c45d78b0e44a392c7dc

Added files:

Index: pkgsrc/www/firefox/patches/patch-modules_woff2_src_store_bytes.h
diff -u /dev/null pkgsrc/www/firefox/patches/patch-modules_woff2_src_store_bytes.h:1.1
--- /dev/null   Fri Dec  9 11:51:09 2016
+++ pkgsrc/www/firefox/patches/patch-modules_woff2_src_store_bytes.h    Fri Dec  9 11:51:09 2016
@@ -0,0 +1,41 @@
+$NetBSD: patch-modules_woff2_src_store_bytes.h,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Avoid unaligned access, use memcpy instead of dereferencing
+a casted pointer.
+
+Firefox bug report:
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/store_bytes.h.orig       2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/store_bytes.h    2016-12-09 12:09:13.632981168 +0100
+@@ -34,10 +34,11 @@
+ 
+ inline size_t Store16(uint8_t* dst, size_t offset, int x) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) =
+-      ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  uint16_t v = ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  memcpy(dst + offset, &v, 2);
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) = static_cast<uint16_t>(x);
++  uint16_t v = static_cast<uint16_t>(x);
++  memcpy(dst + offset, &v, 2);
+ #else
+   dst[offset] = x >> 8;
+   dst[offset + 1] = x;
+@@ -54,11 +55,13 @@
+ 
+ inline void Store16(int val, size_t* offset, uint8_t* dst) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) =
++  uint16_t v = ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
++  memcpy(dst + *offset, &v, 2);
+       ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
+   *offset += 2;
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) = static_cast<uint16_t>(val);
++  uint16_t v = static_cast<uint16_t>(val);
++  memcpy(dst + *offset, &v, 2);
+   *offset += 2;
+ #else
+   dst[(*offset)++] = val >> 8;
Index: pkgsrc/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc
diff -u /dev/null pkgsrc/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc:1.1
--- /dev/null   Fri Dec  9 11:51:09 2016
+++ pkgsrc/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc  Fri Dec  9 11:51:09 2016
@@ -0,0 +1,26 @@
+$NetBSD: patch-modules_woff2_src_woff2_common.cc,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Use memcpy instead of dereferencing a pointer after casting it
+to a type needing greater alignement on some architectures.
+
+Firefox bug report:
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/woff2_common.cc.orig     2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/woff2_common.cc  2016-12-09 09:33:50.193846136 +0100
+@@ -25,12 +25,13 @@
+   uint32_t checksum = 0;
+   size_t aligned_size = size & ~3;
+   for (size_t i = 0; i < aligned_size; i += 4) {
++    uint32_t v;
++    memcpy(&v, buf + i, 4);
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-    uint32_t v = *reinterpret_cast<const uint32_t*>(buf + i);
+     checksum += (((v & 0xFF) << 24) | ((v & 0xFF00) << 8) |
+       ((v & 0xFF0000) >> 8) | ((v & 0xFF000000) >> 24));
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-    checksum += *reinterpret_cast<const uint32_t*>(buf + i);
++    checksum += v;
+ #else
+     checksum += (buf[i] << 24) | (buf[i + 1] << 16) |
+       (buf[i + 2] << 8) | buf[i + 3];