CVS commit: pkgsrc/misc/gkrellsun

["Masatake Daimon" <pho%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   pho
Date:           Sat Aug 30 08:48:46 UTC 2025

Modified Files:
        pkgsrc/misc/gkrellsun: Makefile distinfo
        pkgsrc/misc/gkrellsun/patches: patch-src20_gkrellsun.c

Log Message:
misc/gkrellsun: Fix a use-after-free bug


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 pkgsrc/misc/gkrellsun/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/misc/gkrellsun/distinfo
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/misc/gkrellsun/Makefile
diff -u pkgsrc/misc/gkrellsun/Makefile:1.23 pkgsrc/misc/gkrellsun/Makefile:1.24
--- pkgsrc/misc/gkrellsun/Makefile:1.23 Thu Apr 24 14:15:05 2025
+++ pkgsrc/misc/gkrellsun/Makefile      Sat Aug 30 08:48:46 2025
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2025/04/24 14:15:05 wiz Exp $
+# $NetBSD: Makefile,v 1.24 2025/08/30 08:48:46 pho Exp $
 DISTNAME=      gkrellsun-1.0.0
-PKGREVISION=   21
+PKGREVISION=   22
 CATEGORIES=    misc
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE:=gkrellsun/}
 

Index: pkgsrc/misc/gkrellsun/distinfo
diff -u pkgsrc/misc/gkrellsun/distinfo:1.3 pkgsrc/misc/gkrellsun/distinfo:1.4
--- pkgsrc/misc/gkrellsun/distinfo:1.3  Wed Aug 23 06:29:53 2023
+++ pkgsrc/misc/gkrellsun/distinfo      Sat Aug 30 08:48:46 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.3 2023/08/23 06:29:53 pho Exp $
+$NetBSD: distinfo,v 1.4 2025/08/30 08:48:46 pho Exp $
 
 BLAKE2s (gkrellsun-1.0.0.tar.gz) = 29aebc2c39df47ce9b06a27882f2ba2b0853fa5c1504c01d3e735ba267a33e03
 SHA512 (gkrellsun-1.0.0.tar.gz) = 1a34812e94f16d19311c23d44a0353dade50b802dd3ab115738959b9322c3bc6a28daa2bcea889700e6cc2ff8eb9400b989bf02c6f138bb878b94118ffd6e27a
 Size (gkrellsun-1.0.0.tar.gz) = 96970 bytes
 SHA1 (patch-Makefile) = 91f8ff32ca4084a7c78ce72800f3effd88415aee
 SHA1 (patch-src20_Makefile) = aa82b3842f704ced762830bf65de5b69e368c78d
-SHA1 (patch-src20_gkrellsun.c) = d8b64f27b04c616c707d3683cc66265736136e96
+SHA1 (patch-src20_gkrellsun.c) = 911f205d1f30a6cf9317ff3bee703dfe83babcaa

Index: pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c
diff -u pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c:1.2 pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c:1.3
--- pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c:1.2   Wed Aug 23 06:29:53 2023
+++ pkgsrc/misc/gkrellsun/patches/patch-src20_gkrellsun.c       Sat Aug 30 08:48:46 2025
@@ -1,10 +1,15 @@
-$NetBSD: patch-src20_gkrellsun.c,v 1.2 2023/08/23 06:29:53 pho Exp $
+$NetBSD: patch-src20_gkrellsun.c,v 1.3 2025/08/30 08:48:46 pho Exp $
 
 * Avoid "sun" conflict.
 
 * Fix a build breakage with glib2-2.76. No idea why it has a declaration
   here. It conflicts with a macro in <glib-2.0/glib/gstring.h>.
 
+* Uncomment a mysteriously commented line setting textOptions.fontDesc to
+  NULL in cb_plugin_disabled(). NULL-ifying it is very important, otherwise
+  gkrellsun will crash for use-after-free of PangoFontDescription* when the
+  plugin is enabled, disabled, then enabled again.
+
 --- src20/gkrellsun.c.orig     2006-03-17 13:29:51.000000000 +0000
 +++ src20/gkrellsun.c
 @@ -16,8 +16,11 @@ time_t* CurrentTime;
@@ -20,3 +25,12 @@ $NetBSD: patch-src20_gkrellsun.c,v 1.2 2
  extern void pango_font_description_free (/*@owned@*/PangoFontDescription *);
  
  #define PLUGIN_HEIGHT 54
+@@ -1160,7 +1163,7 @@ cb_plugin_disabled()
+    }
+    colorsCreated = FALSE;
+    colormap = NULL;
+-/*   textOptions.fontDesc = NULL;*/
++   textOptions.fontDesc = NULL;
+ }
+ 
+ /* Calculate height and width of text given a Pango Font */