From dbd5ae256a9673a886f984576adeb8435c5c7ad5 Mon Sep 17 00:00:00 2001
From: Aldas Nabazas <aldas@opensde.net>
Date: Mon, 18 Feb 2008 12:43:06 +0100
Subject: [PATCH] Updated imagemagick (6.2.9-8 -> 6.3.8-9) : SECURITY -
 CRITICAL

re-diffed multilib-fix.patch for new version

CVE-2007-1797 (High) :
Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote attackers to execute
arbitrary code via (1) a crafted DCM image, which results in a heap-based overflow in the
ReadDCMImage function, or (2) the (a) colors or (b) comments field in a crafted XWD image,
which results in a heap-based overflow in the ReadXWDImage function, different issues than
CVE-2007-1667.

CVE-2007-4985 (Medium) :
ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via
a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to
ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to
ReadBlobMSBLong function calls.

CVE-2007-4986 (High) :
Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to
execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file,
which triggers a heap-based buffer overflow.

CVE-2007-4987 (High) :
Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows
context-dependent attackers to execute arbitrary code via a crafted image file, which triggers
the writing of a '\0' character to an out-of-bounds address.

CVE-2007-4988 (Medium) :
Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows
context-dependent attackers to execute arbitrary code via a crafted width value in an image file,
which triggers an integer overflow and a heap-based buffer overflow.
---
 graphic/imagemagick/imagemagick.conf   |  2 +-
 graphic/imagemagick/imagemagick.desc   |  6 +++---
 graphic/imagemagick/multilib-fix.patch | 25 +++++++++++++------------
 3 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/graphic/imagemagick/imagemagick.conf b/graphic/imagemagick/imagemagick.conf
index c417d7f3d..db89d9c98 100644
--- a/graphic/imagemagick/imagemagick.conf
+++ b/graphic/imagemagick/imagemagick.conf
@@ -2,6 +2,7 @@
 # This copyright note is auto-generated by ./scripts/Create-CopyPatch.
 #
 # Filename: package/.../imagemagick/imagemagick.conf
+# Copyright (C) 2008 The OpenSDE Project
 # Copyright (C) 2004 - 2006 The T2 SDE Project
 # Copyright (C) 1998 - 2003 Clifford Wolf
 #
@@ -14,7 +15,6 @@
 # --- SDE-COPYRIGHT-NOTE-END ---
 
 # wrong libltdl usage....
-hook_add preconf 3 "libtoolize -c -f; aclocal ; autoheader ; automake -a --foreign ; autoconf"
 var_append confopt ' ' "--disable-ltdl-install"
 
 var_append configprefix " " 'CPPFLAGS="-I/usr/include/libxml2"'
diff --git a/graphic/imagemagick/imagemagick.desc b/graphic/imagemagick/imagemagick.desc
index 78e5a7c05..0a5ce970c 100644
--- a/graphic/imagemagick/imagemagick.desc
+++ b/graphic/imagemagick/imagemagick.desc
@@ -3,7 +3,7 @@
 [COPY] This copyright note is auto-generated by ./scripts/Create-CopyPatch.
 [COPY]
 [COPY] Filename: package/.../imagemagick/imagemagick.desc
-[COPY] Copyright (C) 2006 - 2007 The OpenSDE Project
+[COPY] Copyright (C) 2006 - 2008 The OpenSDE Project
 [COPY] Copyright (C) 2004 - 2006 The T2 SDE Project
 [COPY] Copyright (C) 1998 - 2003 Clifford Wolf
 [COPY]
@@ -34,7 +34,7 @@
 
 [L] OpenSource
 [S] Stable
-[V] 6.2.9-8
+[V] 6.3.8-9
 [P] X -----5-7-9 133.900
 
-[D] 2984897475 ImageMagick-6.2.9-8.tar.bz2 ftp://ftp.imagemagick.org/pub/ImageMagick/
+[D] 2910240651 ImageMagick-6.3.8-9.tar.bz2 ftp://ftp.imagemagick.org/pub/ImageMagick/
diff --git a/graphic/imagemagick/multilib-fix.patch b/graphic/imagemagick/multilib-fix.patch
index 130a2332a..e37b5837b 100644
--- a/graphic/imagemagick/multilib-fix.patch
+++ b/graphic/imagemagick/multilib-fix.patch
@@ -2,6 +2,7 @@
 # This copyright note is auto-generated by ./scripts/Create-CopyPatch.
 #
 # Filename: package/.../imagemagick/multilib-fix.patch
+# Copyright (C) 2008 The OpenSDE Project
 # Copyright (C) 2006 The T2 SDE Project
 #
 # More information can be found in the files COPYING and README.
@@ -17,17 +18,17 @@
 
 On 64bit multilib-systems this had caused linking to 32bit libs.
 	-- jsaw
-re-diffed for 6.2.8 version - Aldas (Baldzius)
+re-diffed for 6.2.8 and then for 6.3 version - Aldas (Baldzius)
 
-diff -Nur ImageMagick-6.2.8-orig/configure.ac ImageMagick-6.2.8/configure.ac
---- ImageMagick-6.2.8-orig/configure.ac	2006-07-03 15:29:56.000000000 +0000
-+++ ImageMagick-6.2.8/configure.ac	2006-07-23 23:35:24.000000000 +0000
-@@ -1926,7 +1926,7 @@
-     then
-       CPPFLAGS="$CPPFLAGS -I${xml2_prefix}/include/libxml2"
+diff -Nur ImageMagick-6.3.8-orig/configure.ac ImageMagick-6.3.8/configure.ac
+--- ImageMagick-6.3.8-orig/configure.ac	2008-02-18 11:50:29.000000000 +0100
++++ ImageMagick-6.3.8/configure.ac	2008-02-18 11:52:24.000000000 +0100
+@@ -2170,7 +2170,7 @@
+             CPPFLAGS="$CPPFLAGS -I${xml2_prefix}/include/libxml2"
+         fi
+         if test "${xml2_prefix}" != '/usr'; then
+-            LDFLAGS="$LDFLAGS -L${xml2_prefix}/lib"
++            LDFLAGS="$LDFLAGS"
+         fi
      fi
--    LDFLAGS="$LDFLAGS -L${xml2_prefix}/lib"
-+    LDFLAGS="$LDFLAGS"
-    fi
-   failed=0;
-   passed=0;
+     failed=0;