[pkgsrc/trunk]: pkgsrc/www/firefox Avoid crashes when decoding woff2 fonts on...

[martin <martin%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/256912f1a8aa
branches:  trunk
changeset: 355668:256912f1a8aa
user:      martin <martin%pkgsrc.org@localhost>
date:      Fri Dec 09 11:51:09 2016 +0000

description:
Avoid crashes when decoding woff2 fonts on alignment critical architectures

diffstat:

 www/firefox/Makefile                                        |   4 +-
 www/firefox/distinfo                                        |   4 +-
 www/firefox/patches/patch-modules_woff2_src_store_bytes.h   |  41 +++++++++++++
 www/firefox/patches/patch-modules_woff2_src_woff2_common.cc |  26 ++++++++
 4 files changed, 72 insertions(+), 3 deletions(-)

diffs (111 lines):

diff -r 09565fa582b0 -r 256912f1a8aa www/firefox/Makefile
--- a/www/firefox/Makefile      Fri Dec 09 10:06:07 2016 +0000
+++ b/www/firefox/Makefile      Fri Dec 09 11:51:09 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.273 2016/12/04 05:17:43 ryoon Exp $
+# $NetBSD: Makefile,v 1.274 2016/12/09 11:51:09 martin Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
 MOZ_BRANCH=            50.0
@@ -6,7 +6,7 @@
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       firefox-${MOZ_BRANCH}${MOZ_BRANCH_MINOR:S/b/beta/:S/esr//}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
diff -r 09565fa582b0 -r 256912f1a8aa www/firefox/distinfo
--- a/www/firefox/distinfo      Fri Dec 09 10:06:07 2016 +0000
+++ b/www/firefox/distinfo      Fri Dec 09 11:51:09 2016 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.263 2016/12/05 11:54:45 martin Exp $
+$NetBSD: distinfo,v 1.264 2016/12/09 11:51:09 martin Exp $
 
 SHA1 (firefox-50.0.2.source.tar.xz) = 083b9a803b25064b2d7d43e289797a9f2a2e9e5d
 RMD160 (firefox-50.0.2.source.tar.xz) = 67395703c955b3285237b66317df13229aeec479
@@ -105,6 +105,8 @@
 SHA1 (patch-mobile_android_installer_package-manifest.in) = e978af41ff0c4b5e477bd3387594e238dc2ec224
 SHA1 (patch-modules_libjar_nsZipArchive.cpp) = 133b1658839d9b0f932a601670862c1f4cd70881
 SHA1 (patch-modules_libpref_init_all.js) = 3bc5962fdabb5aecb72ffc7e73bb56392d1ea717
+SHA1 (patch-modules_woff2_src_store_bytes.h) = f7081a6ffadc79e19f30137ca805b962e60821e8
+SHA1 (patch-modules_woff2_src_woff2_common.cc) = 77dec15dad41d47a3f85e578587c3a137a8dc7f3
 SHA1 (patch-moz.configure) = cd4d3851e9dc2c1adb6a92b6f3cd1966adcd5beb
 SHA1 (patch-mozglue_build_arm.cpp) = f41ace63b3f1d2a8ccaffc98c3c64d1e22af5249
 SHA1 (patch-mozglue_build_arm.h) = 5e272f4e19b9681d43a63c45d78b0e44a392c7dc
diff -r 09565fa582b0 -r 256912f1a8aa www/firefox/patches/patch-modules_woff2_src_store_bytes.h
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/firefox/patches/patch-modules_woff2_src_store_bytes.h Fri Dec 09 11:51:09 2016 +0000
@@ -0,0 +1,41 @@
+$NetBSD: patch-modules_woff2_src_store_bytes.h,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Avoid unaligned access, use memcpy instead of dereferencing
+a casted pointer.
+
+Firefox bug report:
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/store_bytes.h.orig       2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/store_bytes.h    2016-12-09 12:09:13.632981168 +0100
+@@ -34,10 +34,11 @@
+ 
+ inline size_t Store16(uint8_t* dst, size_t offset, int x) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) =
+-      ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  uint16_t v = ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
++  memcpy(dst + offset, &v, 2);
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + offset) = static_cast<uint16_t>(x);
++  uint16_t v = static_cast<uint16_t>(x);
++  memcpy(dst + offset, &v, 2);
+ #else
+   dst[offset] = x >> 8;
+   dst[offset + 1] = x;
+@@ -54,11 +55,13 @@
+ 
+ inline void Store16(int val, size_t* offset, uint8_t* dst) {
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) =
++  uint16_t v = ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
++  memcpy(dst + *offset, &v, 2);
+       ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
+   *offset += 2;
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-  *reinterpret_cast<uint16_t*>(dst + *offset) = static_cast<uint16_t>(val);
++  uint16_t v = static_cast<uint16_t>(val);
++  memcpy(dst + *offset, &v, 2);
+   *offset += 2;
+ #else
+   dst[(*offset)++] = val >> 8;
diff -r 09565fa582b0 -r 256912f1a8aa www/firefox/patches/patch-modules_woff2_src_woff2_common.cc
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/firefox/patches/patch-modules_woff2_src_woff2_common.cc       Fri Dec 09 11:51:09 2016 +0000
@@ -0,0 +1,26 @@
+$NetBSD: patch-modules_woff2_src_woff2_common.cc,v 1.1 2016/12/09 11:51:09 martin Exp $
+
+Use memcpy instead of dereferencing a pointer after casting it
+to a type needing greater alignement on some architectures.
+
+Firefox bug report:
+       https://bugzilla.mozilla.org/show_bug.cgi?id=1322660
+
+--- modules/woff2/src/woff2_common.cc.orig     2016-07-25 22:22:05.000000000 +0200
++++ modules/woff2/src/woff2_common.cc  2016-12-09 09:33:50.193846136 +0100
+@@ -25,12 +25,13 @@
+   uint32_t checksum = 0;
+   size_t aligned_size = size & ~3;
+   for (size_t i = 0; i < aligned_size; i += 4) {
++    uint32_t v;
++    memcpy(&v, buf + i, 4);
+ #if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+-    uint32_t v = *reinterpret_cast<const uint32_t*>(buf + i);
+     checksum += (((v & 0xFF) << 24) | ((v & 0xFF00) << 8) |
+       ((v & 0xFF0000) >> 8) | ((v & 0xFF000000) >> 24));
+ #elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+-    checksum += *reinterpret_cast<const uint32_t*>(buf + i);
++    checksum += v;
+ #else
+     checksum += (buf[i] << 24) | (buf[i + 1] << 16) |
+       (buf[i + 2] << 8) | buf[i + 3];