CVS commit: pkgsrc/www

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Apr  8 06:01:21 UTC 2024

Modified Files:
        pkgsrc/www/w3m: Makefile distinfo
        pkgsrc/www/w3m-img: Makefile
Added Files:
        pkgsrc/www/w3m/patches: patch-etc.c

Log Message:
w3m*: fix CVEs 2023-38252 and 38253 using upstream patch

Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.98 -r1.99 pkgsrc/www/w3m/Makefile
cvs rdiff -u -r1.38 -r1.39 pkgsrc/www/w3m/distinfo
cvs rdiff -u -r1.33 -r1.34 pkgsrc/www/w3m-img/Makefile
cvs rdiff -u -r0 -r1.1 pkgsrc/www/w3m/patches/patch-etc.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/w3m/Makefile
diff -u pkgsrc/www/w3m/Makefile:1.98 pkgsrc/www/w3m/Makefile:1.99
--- pkgsrc/www/w3m/Makefile:1.98        Sat Feb 10 14:42:40 2024
+++ pkgsrc/www/w3m/Makefile     Mon Apr  8 06:01:21 2024
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.98 2024/02/10 14:42:40 taca Exp $
+# $NetBSD: Makefile,v 1.99 2024/04/08 06:01:21 wiz Exp $
 
 PKGNAME=       w3m-${W3M_PKGVERS}
-PKGREVISION=   3
+PKGREVISION=   4
 COMMENT=       Multilingualized version of a pager/text-based browser w3m
 
 CONFLICTS+=    w3m-img-[0-9]*

Index: pkgsrc/www/w3m/distinfo
diff -u pkgsrc/www/w3m/distinfo:1.38 pkgsrc/www/w3m/distinfo:1.39
--- pkgsrc/www/w3m/distinfo:1.38        Thu Apr 27 13:26:19 2023
+++ pkgsrc/www/w3m/distinfo     Mon Apr  8 06:01:21 2024
@@ -1,5 +1,6 @@
-$NetBSD: distinfo,v 1.38 2023/04/27 13:26:19 wiz Exp $
+$NetBSD: distinfo,v 1.39 2024/04/08 06:01:21 wiz Exp $
 
 BLAKE2s (w3m-0.5.3+git20230121.tar.gz) = 8dd724d95a676c9831ea20599767c6fec0a27e02b6487af970f749768b41967f
 SHA512 (w3m-0.5.3+git20230121.tar.gz) = f220aabf69cf11ca7560c1519a971bdb1cc0baa443b1b46cd8fca2a4defb614653dd9ba637afbf9315f3b63a349f972436348c2f93d06665573057e4232eab1c
 Size (w3m-0.5.3+git20230121.tar.gz) = 2322709 bytes
+SHA1 (patch-etc.c) = af69b43ceba1e2ffd8c602dacd9272a3fb2ec5b0

Index: pkgsrc/www/w3m-img/Makefile
diff -u pkgsrc/www/w3m-img/Makefile:1.33 pkgsrc/www/w3m-img/Makefile:1.34
--- pkgsrc/www/w3m-img/Makefile:1.33    Tue Oct 24 22:11:35 2023
+++ pkgsrc/www/w3m-img/Makefile Mon Apr  8 06:01:21 2024
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.33 2023/10/24 22:11:35 wiz Exp $
+# $NetBSD: Makefile,v 1.34 2024/04/08 06:01:21 wiz Exp $
 
 PKGNAME=       w3m-img-${W3M_PKGVERS}
-PKGREVISION=   1
+PKGREVISION=   2
 COMMENT=       Multilingualized version of w3m with inline image support
 
 CONFLICTS+=    w3m-[0-9]*

Added files:

Index: pkgsrc/www/w3m/patches/patch-etc.c
diff -u /dev/null pkgsrc/www/w3m/patches/patch-etc.c:1.1
--- /dev/null   Mon Apr  8 06:01:21 2024
+++ pkgsrc/www/w3m/patches/patch-etc.c  Mon Apr  8 06:01:21 2024
@@ -0,0 +1,30 @@
+$NetBSD: patch-etc.c,v 1.1 2024/04/08 06:01:21 wiz Exp $
+
+https://github.com/tats/w3m/pull/273
+
+--- etc.c.orig 2023-01-21 02:01:52.000000000 +0000
++++ etc.c
+@@ -393,7 +393,10 @@ checkType(Str s, Lineprop **oprop, Linec
+                           if (color)
+                               color -= plen;
+ #endif
+-                          plen = *(--plens);
++                          if (plens == plens_buffer)
++                              plen = 0;
++                          else
++                              plen = *(--plens);
+                           str += 2;
+                       }
+                   }
+@@ -419,7 +422,10 @@ checkType(Str s, Lineprop **oprop, Linec
+                           if (color)
+                               color -= plen;
+ #endif
+-                          plen = *(--plens);
++                          if (plens == plens_buffer)
++                              plen = 0;
++                          else
++                              plen = *(--plens);
+                           str++;
+                       }
+ #else