CVS commit: pkgsrc/graphics/cairo

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Jan 24 10:10:23 UTC 2023

Modified Files:
        pkgsrc/graphics/cairo: Makefile distinfo
Added Files:
        pkgsrc/graphics/cairo/patches: patch-src_cairo-arc.c

Log Message:
cairo: add upstream fix for CVE-2019-6461.

Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.152 -r1.153 pkgsrc/graphics/cairo/Makefile
cvs rdiff -u -r1.95 -r1.96 pkgsrc/graphics/cairo/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/graphics/cairo/patches/patch-src_cairo-arc.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/cairo/Makefile
diff -u pkgsrc/graphics/cairo/Makefile:1.152 pkgsrc/graphics/cairo/Makefile:1.153
--- pkgsrc/graphics/cairo/Makefile:1.152        Wed Sep 28 19:56:54 2022
+++ pkgsrc/graphics/cairo/Makefile      Tue Jan 24 10:10:22 2023
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.152 2022/09/28 19:56:54 wiz Exp $
+# $NetBSD: Makefile,v 1.153 2023/01/24 10:10:22 wiz Exp $
 
 .include "../../graphics/cairo/Makefile.common"
 
-PKGREVISION=   7
+PKGREVISION=   8
 
 TEST_TARGET=                   check
 

Index: pkgsrc/graphics/cairo/distinfo
diff -u pkgsrc/graphics/cairo/distinfo:1.95 pkgsrc/graphics/cairo/distinfo:1.96
--- pkgsrc/graphics/cairo/distinfo:1.95 Thu May 12 17:13:55 2022
+++ pkgsrc/graphics/cairo/distinfo      Tue Jan 24 10:10:22 2023
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.95 2022/05/12 17:13:55 tnn Exp $
+$NetBSD: distinfo,v 1.96 2023/01/24 10:10:22 wiz Exp $
 
 BLAKE2s (cairo-1.16.0.tar.xz) = fba95926f57ad97d9c0c197c355ef646fd3cf9d17d1eb3270d343eef5d7bfa40
 SHA512 (cairo-1.16.0.tar.xz) = 9eb27c4cf01c0b8b56f2e15e651f6d4e52c99d0005875546405b64f1132aed12fbf84727273f493d84056a13105e065009d89e94a8bfaf2be2649e232b82377f
@@ -11,6 +11,7 @@ SHA1 (patch-boilerplate_cairo-boilerplat
 SHA1 (patch-perf_cairo-analyse-trace.c) = 38e76dd4dbeb3d8e2eb8fe7219ba7bf98c724c31
 SHA1 (patch-perf_cairo-perf-report.c) = 34579b44238ead31aaf97dbb63347c883d23b5a3
 SHA1 (patch-perf_cairo-perf-trace.c) = 0f8cb89493a202b58b22e6244fe1c1bcc0a34b88
+SHA1 (patch-src_cairo-arc.c) = 4b53d2f1bcecf270b9c949f1d9a5d0d12fca3433
 SHA1 (patch-src_cairo-ft-font.c) = 97288d79380473869f1049c1d8955a2f6fa3d178
 SHA1 (patch-src_cairo-image-compositor.c) = 83337d8211083d77b061c43b69da2b61080776d9
 SHA1 (patch-src_cairo-quartz-image-surface.c) = f3963afb665d70189c18de02b943313b7f7b6dcd

Added files:

Index: pkgsrc/graphics/cairo/patches/patch-src_cairo-arc.c
diff -u /dev/null pkgsrc/graphics/cairo/patches/patch-src_cairo-arc.c:1.1
--- /dev/null   Tue Jan 24 10:10:23 2023
+++ pkgsrc/graphics/cairo/patches/patch-src_cairo-arc.c Tue Jan 24 10:10:23 2023
@@ -0,0 +1,29 @@
+$NetBSD: patch-src_cairo-arc.c,v 1.1 2023/01/24 10:10:23 wiz Exp $
+
+https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/155
+fixing
+https://gitlab.freedesktop.org/cairo/cairo/-/issues/353
+which is for CVE-2019-6461.
+
+--- src/cairo-arc.c.orig       2018-08-17 01:10:53.000000000 +0000
++++ src/cairo-arc.c
+@@ -90,16 +90,18 @@ _arc_max_angle_for_tolerance_normalized 
+       { M_PI / 11.0,  9.81410988043554039085e-09 },
+     };
+     int table_size = ARRAY_LENGTH (table);
++    const int max_segments = 1000; /* this value is chosen arbitrarily. this gives an error of about 1.74909e-20 */
+ 
+     for (i = 0; i < table_size; i++)
+       if (table[i].error < tolerance)
+           return table[i].angle;
+ 
+     ++i;
++
+     do {
+       angle = M_PI / i++;
+       error = _arc_error_normalized (angle);
+-    } while (error > tolerance);
++    } while (error > tolerance && i < max_segments);
+ 
+     return angle;
+ }