libXfont-1.4.8

[Fernando de Oliveira]

​http://xorg.freedesktop.org/releases/individual/lib/libXfont-1.4.8.tar.bz2

[Fernando de Oliveira]

I'm sorry.

I am having problems with my system. Will build a new one. Don't know when will be with a system to update packages, so, I am giving back to the book all that I had to do.

[Fernando de Oliveira]

Security and problematic changes:

    CVE-2014-0210: unvalidated length fields in fs_read_list_info()

    CVE-2014-0210: unvalidated length fields in fs_read_glyphs()

    CVE-2014-0210: unvalidated length fields in fs_read_extent_info()

    CVE-2014-0211: integer overflow in fs_alloc_glyphs()

    CVE-2014-0211: integer overflow in fs_read_extent_info()

    CVE-2014-0210: unvalidated length fields in fs_read_query_info()

    CVE-2014-0211: Integer overflow in fs_get_reply/_fs_start_read

    CVE-2014-0210: unvalidated lengths when reading replies from font server

    CVE-2014-0210: unvalidated length in _fs_recv_conn_setup()

    CVE-2014-0209: integer overflow of realloc() size in lexAlias()

    CVE-2014-0209: integer overflow of realloc() size in FontFileAddEntry()

Problematic:

commit 9b41f3d0c7c430a2909c9455eff347e714f0c4b4
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Sun Apr 20 18:10:07 2014 -0700

    Require fontsproto < 2.1.3 for matching function prototypes
    
    Building libXfont-1.4.x against fontsproto 2.1.3 causes clang
    complaints of:
    
    patcache.c:130:1: error: conflicting types for 'CacheFontPattern'
    CacheFontPattern (FontPatternCachePtr cache,
    ^
    patcache.c:176:1: error: conflicting types for 'FindCachedFontPattern'
    FindCachedFontPattern (FontPatternCachePtr cache,
    ^
    
    due to the constification of arguments not matching.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Thomas Klausner <wiz@NetBSD.org>

This makes impossible for us to update, without further modifications, either downgrading fontsproto 2.1.3 or modifying libXfont.

As we do not (at least usually) compile using clang, I decided just to remove from config the restriction for fontsproto < 2.1.3:

sed -i 's/fontsproto < 2.1.3/fontsproto/' configure

Any reason for downgrading fontsproto instead of using the sed?

[Fernando de Oliveira]

Fixed at r13114.