Applying fix for CVE-2008-2149, again bug #211491, thank you Robert Buchholz.

Package-Manager: portage-2.2_rc8/cvs/Linux 2.6.25-gentoo-r7 i686

5 files changed, 28 insertions, 755 deletions

diff --git a/app-dicts/wordnet/ChangeLog b/app-dicts/wordnet/ChangeLog
index 6c7a6fb173f0..62f506b32484 100644
--- a/app-dicts/wordnet/ChangeLog
+++ b/app-dicts/wordnet/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for app-dicts/wordnet
 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/ChangeLog,v 1.15 2008/09/10 06:57:39 pva Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/ChangeLog,v 1.16 2008/09/12 19:36:30 pva Exp $
+
+*wordnet-3.0-r2 (12 Sep 2008)
+
+  12 Sep 2008; Peter Volkov <pva@gentoo.org>
+  -files/wordnet-3.0-CVE-2008-3908.patch, wordnet-3.0.ebuild,
+  -wordnet-3.0-r1.ebuild, +wordnet-3.0-r2.ebuild:
+  Applying fix for CVE-2008-2149, again bug #211491, thank you Robert
+  Buchholz.
 
 *wordnet-3.0-r1 (10 Sep 2008)
 
diff --git a/app-dicts/wordnet/Manifest b/app-dicts/wordnet/Manifest
index 8215eb27c757..58b6cb67a4c4 100644
--- a/app-dicts/wordnet/Manifest
+++ b/app-dicts/wordnet/Manifest
@@ -1,9 +1,9 @@
-AUX wordnet-3.0-CVE-2008-3908.patch 23878 RMD160 00579e71eeaf85f78667febfcbd8e32cae742a24 SHA1 c5003fa2fbc81bbc3a15ba6ec03b0117bdfe232f SHA256 a0e9e8511e6360a76fa249e495513e50ec6b870f53f8cb88abea95b91d532c23
 AUX wordnet-3.0-dict-location.patch 1542 RMD160 77ffb69ae4c11aa14c15cdedaa7c7a545ef0e2c8 SHA1 e73ba30129d54621ca1c45a6df975b57e693b7f7 SHA256 8eaae12a77610e10003d26ac6e10b394bbaab2aefc56ceb843e4f65d65b125c2
 AUX wordnet-3.0-docs-path.patch 2832 RMD160 491b73b758f44e75e5677bbeb4941d22fea9e939 SHA1 c919b4be1b003b1acbe5bb40f88713d792bb4e8c SHA256 26130edeadc7c6993faa8a1471c5cac87c533d3e1c927eb5d59716f5b47a808d
 AUX wordnet-3.0-shared-lib.patch 921 RMD160 983a16ff89636b5127a88538ebc1d12f5557bd1f SHA1 c52955cfb94a72648885aabe30616cd7762135b1 SHA256 bcca076ec3581a88f7a221dd419e0e69e88d896018776cde5d56019a020d9cc1
 DIST WordNet-3.0.tar.gz 11537227 RMD160 7dc7a7417753004170e6fd4a503b232c028f35ee SHA1 16986e6bf695fc752c201c080333dadd919fe3ed SHA256 b4d8b1feeb22defe686cf1c5062d723bd854997614da9547fa135e5137843531
-EBUILD wordnet-3.0-r1.ebuild 1873 RMD160 f6a2fae84a0234a37050c4f420af2d3688ed74dc SHA1 c98b8b1003abbb7930b84bd313bb517666a64617 SHA256 61551b2a19141d4507371f41f0203b0f197b76e3f0d8ff7f2d2d26fd7563aa87
-EBUILD wordnet-3.0.ebuild 1814 RMD160 75bda2668ec733a6bfc63ac81f1f4b412181eebf SHA1 31a5c4c633938087a607a6b806782001b93e8cb9 SHA256 2664b53b38ec18d43e8e8391fd4e728eb4421d24e85f710c89e6828ce9fd0839
-MISC ChangeLog 2914 RMD160 26657e634ba8f11dbf92c673da886168902f954d SHA1 3eae977266fee36341ab11de01f596940e4ef4e0 SHA256 8e7a980091cf838e54622ab73a8b11a2fe088bd1a8823d9abeda5589054ada82
+DIST wordnet-3.0-patchset-1.tar.bz2 8076 RMD160 09e59e73d3032f747b1e0d80dc3cc5911efcdcc8 SHA1 d692931bc4d51c27dae9adc452bf7b5f10c3368f SHA256 d8333b107f53e188981e9ec0e1e53890c8bd7155924ae140c777c3f443d8aba7
+EBUILD wordnet-3.0-r2.ebuild 1872 RMD160 10f66b0c3d616f41b4109664e298faf0361f829d SHA1 5ccc95a8739ec312d907f3506461551c45eb6a66 SHA256 cb9ad2617d42a856ba4176c3fd98d95ca60b6183162eb70a3af39f65e705f350
+EBUILD wordnet-3.0.ebuild 1721 RMD160 707b99ac3e7519ee4847f8ab814d4a1e0885b2f6 SHA1 b9a9383792e785b641928f3e635dfaf78f18784a SHA256 33ee4f72c69e2f6cecf251a3c7d898f15c7be9731329f8f5705223497d1e6df9
+MISC ChangeLog 3185 RMD160 37df85cb5524905c17cbf10daa62ccfb8ae2dbb0 SHA1 bbdc247ad342c181cd569e3b81527f5a7b60b78c SHA256 de029a8fb5740ef1f80b3f0a27cf668496619bc9dd5abbc0de366f92e3f31a90
 MISC metadata.xml 162 RMD160 853d3c463af1132de9d434e4bdca16fd81a21eb0 SHA1 0d9e341c4b61e23adc1f3806989a0236b83257a0 SHA256 9629e7723cb4708c1910c25510cd14da2729d34eed4ebfc1563df4a1ed5e1b22
diff --git a/app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch b/app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch
deleted file mode 100644
index de430c3ea302..000000000000
--- a/app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch
+++ /dev/null
@@ -1,732 +0,0 @@
-diff --git a/lib/binsrch.c b/lib/binsrch.c
-index 85436f3..8b71216 100644
---- a/lib/binsrch.c
-+++ b/lib/binsrch.c
-@@ -28,7 +28,7 @@ char *read_index(long offset, FILE *fp) {
-     char *linep;
- 
-     linep = line;
--    line[0] = '0';
-+    line[0] = '\0';
- 
-     fseek( fp, offset, SEEK_SET );
-     fgets(linep, LINE_LEN, fp);
-@@ -58,6 +58,8 @@ char *bin_search(char *searchkey, FILE *fp)
-         last_bin_search_offset = ftell( fp );
- 	fgets(linep, LINE_LEN, fp);
- 	length = (int)(strchr(linep, ' ') - linep);
-+	if (length > (sizeof(key) - 1))
-+            return(NULL);
- 	strncpy(key, linep, length);
- 	key[length] = '\0';
- 	if(strcmp(key, searchkey) < 0) {
-@@ -110,6 +112,8 @@ static int bin_search_key(char *searchkey, FILE *fp)
- 	line[length++] =  c;
-     if (getc(fp) == EOF) {	/* only 1 line in file */
- 	length = (int)(strchr(linep, ' ') - linep);
-+	if (length > (sizeof(key) - 1))
-+            return(0);
- 	strncpy(key, linep, length);
- 	key[length] = '\0';
- 	if(strcmp(key, searchkey) > 0) {
-@@ -132,6 +136,8 @@ static int bin_search_key(char *searchkey, FILE *fp)
- 	if (fgets(linep, LINE_LEN, fp) != NULL) {
-   	    offset2 = ftell(fp); /* offset at start of next line */
- 	    length = (int)(strchr(linep, ' ') - linep);
-+	    if (length > (sizeof(key) - 1))
-+                return(0);
- 	    strncpy(key, linep, length);
- 	    key[length] = '\0';
- 	    if(strcmp(key, searchkey) < 0) {	/* further in file */
-diff --git a/lib/morph.c b/lib/morph.c
-index 0cff594..ea4b4f8 100644
---- a/lib/morph.c
-+++ b/lib/morph.c
-@@ -51,24 +51,24 @@ static struct {
-     char *str;
-     int strlen;
- } prepositions[NUMPREPS] = {
--    "to", 2,
--    "at", 2,
--    "of", 2,
--    "on", 2,
--    "off", 3,
--    "in", 2,
--    "out", 3,
--    "up", 2,
--    "down", 4,
--    "from", 4,
--    "with", 4,
--    "into", 4,
--    "for", 3,
--    "about", 5,
--    "between", 7,
-+    { "to", 2 },
-+    { "at", 2 },
-+    { "of", 2 },
-+    { "on", 2 },
-+    { "off", 3 },
-+    { "in", 2 },
-+    { "out", 3 },
-+    { "up", 2 },
-+    { "down", 4 },
-+    { "from", 4 },
-+    { "with", 4 },
-+    { "into", 4 },
-+    { "for", 3 },
-+    { "about", 5 },
-+    { "between", 7 }
- };
- 
--static FILE *exc_fps[NUMPARTS + 1];
-+static FILE *exc_fps[NUMPARTS];
- 
- static int do_init();
- static int strend(char *, char *);
-@@ -100,7 +100,7 @@ int re_morphinit(void)
- {
-     int i;
- 
--    for (i = 1; i <= NUMPARTS; i++) {
-+    for (i = 0; i < NUMPARTS; i++) {
- 	if (exc_fps[i] != NULL) {
- 	    fclose(exc_fps[i]); exc_fps[i] = NULL;
- 	}
-@@ -144,18 +144,19 @@ static int do_init(void)
-     } else
- 	sprintf(searchdir, DEFAULTPATH);
- #else
--    if ((env = getenv("WNSEARCHDIR")) != NULL)
--	strcpy(searchdir, env);
--    else if ((env = getenv("WNHOME")) != NULL)
--	sprintf(searchdir, "%s%s", env, DICTDIR);
--    else
-+    if ((env = getenv("WNSEARCHDIR")) != NULL) {
-+	snprintf(searchdir, sizeof(searchdir), "%s", env);
-+    } else if ((env = getenv("WNHOME")) != NULL) {
-+	snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR);
-+    } else {
- 	strcpy(searchdir, DEFAULTPATH);
-+    }
- #endif
- 
--    for (i = 1; i <= NUMPARTS; i++) {
--	sprintf(fname, EXCFILE, searchdir, partnames[i]);
-+    for (i = 0; i < NUMPARTS; i++) {
-+	snprintf(fname, sizeof(fname), EXCFILE, searchdir, partnames[i+1]);
- 	if ((exc_fps[i] = fopen(fname, "r")) == NULL) {
--	    sprintf(msgbuf,
-+	    snprintf(msgbuf, sizeof(msgbuf),
- 		    "WordNet library error: Can't open exception file(%s)\n\n",
- 		    fname);
- 	    display_message(msgbuf);
-@@ -178,13 +179,16 @@ char *morphstr(char *origstr, int pos)
-     int prep;
-     char *end_idx1, *end_idx2;
-     char *append;
--    
-+
-     if (pos == SATELLITE)
- 	pos = ADJ;
- 
-     /* First time through for this string */
- 
-     if (origstr != NULL) {
-+        if (strlen(origstr) > WORDBUF - 1)
-+            return(NULL);
-+
- 	/* Assume string hasn't had spaces substitued with '_' */
- 	strtolower(strsubst(strcpy(str, origstr), ' ', '_'));
- 	searchstr[0] = '\0';
-@@ -232,7 +236,7 @@ char *morphstr(char *origstr, int pos)
- 		if (end_idx < 0) return(NULL);		/* shouldn't do this */
- 		strncpy(word, str + st_idx, end_idx - st_idx);
- 		word[end_idx - st_idx] = '\0';
--		if(tmp = morphword(word, pos))
-+		if ((tmp = morphword(word, pos)) != NULL)
- 		    strcat(searchstr,tmp);
- 		else
- 		    strcat(searchstr,word);
-@@ -240,7 +244,7 @@ char *morphstr(char *origstr, int pos)
- 		st_idx = end_idx + 1;
- 	    }
- 	    
--	    if(tmp = morphword(strcpy(word, str + st_idx), pos)) 
-+	    if ((tmp = morphword(strcpy(word, str + st_idx), pos)) != NULL)
- 		strcat(searchstr,tmp);
- 	    else
- 		strcat(searchstr,word);
-@@ -270,16 +274,15 @@ char *morphword(char *word, int pos)
- {
-     int offset, cnt;
-     int i;
--    static char retval[WORDBUF];
--    char *tmp, tmpbuf[WORDBUF], *end;
--    
--    sprintf(retval,"");
--    sprintf(tmpbuf, "");
--    end = "";
--    
-+    static char retval[WORDBUF] = "";
-+    char *tmp, tmpbuf[WORDBUF] = "", *end = "";
-+
-     if(word == NULL) 
- 	return(NULL);
- 
-+    if (strlen(word) > WORDBUF - 1)
-+        return(NULL);
-+
-     /* first look for word on exception list */
-     
-     if((tmp = exc_lookup(word, pos)) != NULL)
-@@ -335,7 +338,10 @@ static char *wordbase(char *word, int ender)
- {
-     char *pt1;
-     static char copy[WORDBUF];
--    
-+
-+    if (strlen(word) > WORDBUF - 1)
-+        return(NULL);
-+
-     strcpy(copy, word);
-     if(strend(copy,sufx[ender])) {
- 	pt1=strchr(copy,'\0');
-@@ -368,13 +374,14 @@ static char *exc_lookup(char *word, int pos)
- {
-     static char line[WORDBUF], *beglp, *endlp;
-     char *excline;
--    int found = 0;
- 
-     if (exc_fps[pos] == NULL)
- 	return(NULL);
- 
-     /* first time through load line from exception file */
-     if(word != NULL){
-+        if (strlen(word) > WORDBUF - 1)
-+           return(NULL);
- 	if ((excline = bin_search(word, exc_fps[pos])) != NULL) {
- 	    strcpy(line, excline);
- 	    endlp = strchr(line,' ');
-@@ -403,6 +410,9 @@ static char *morphprep(char *s)
-     char word[WORDBUF], end[WORDBUF];
-     static char retval[WORDBUF];
- 
-+    if (strlen(s) > WORDBUF - 1)
-+        return (NULL);
-+
-     /* Assume that the verb is the first word in the phrase.  Strip it
-        off, check for validity, then try various morphs with the
-        rest of the phrase tacked on, trying to find a match. */
-@@ -410,7 +420,7 @@ static char *morphprep(char *s)
-     rest = strchr(s, '_');
-     last = strrchr(s, '_');
-     if (rest != last) {		/* more than 2 words */
--	if (lastwd = morphword(last + 1, NOUN)) {
-+	if ((lastwd = morphword(last + 1, NOUN)) != NULL) {
- 	    strncpy(end, rest, last - rest + 1);
- 	    end[last-rest+1] = '\0';
- 	    strcat(end, lastwd);
-diff --git a/lib/search.c b/lib/search.c
-index 1cdedc3..bc781cd 100644
---- a/lib/search.c
-+++ b/lib/search.c
-@@ -13,6 +13,7 @@
- #include <stdlib.h>
- #include <string.h>
- #include <assert.h>
-+#include <limits.h>
- 
- #include "wn.h"
- 
-@@ -119,33 +120,22 @@ IndexPtr parse_index(long offset, int dbase, char *line) {
-     if ( !line )
-       line = read_index( offset, indexfps[dbase] );
-     
--    idx = (IndexPtr)malloc(sizeof(Index));
-+    idx = (IndexPtr)calloc(1, sizeof(Index));
-     assert(idx);
- 
-     /* set offset of entry in index file */
-     idx->idxoffset = offset;
-     
--    idx->wd='\0';
--    idx->pos='\0';
--    idx->off_cnt=0;
--    idx->tagged_cnt = 0;
--    idx->sense_cnt=0;
--    idx->offset='\0';
--    idx->ptruse_cnt=0;
--    idx->ptruse='\0';
--    
-     /* get the word */
-     ptrtok=strtok(line," \n");
-     
--    idx->wd = malloc(strlen(ptrtok) + 1);
-+    idx->wd = strdup(ptrtok);
-     assert(idx->wd);
--    strcpy(idx->wd, ptrtok);
-     
-     /* get the part of speech */
-     ptrtok=strtok(NULL," \n");
--    idx->pos = malloc(strlen(ptrtok) + 1);
-+    idx->pos = strdup(ptrtok);
-     assert(idx->pos);
--    strcpy(idx->pos, ptrtok);
-     
-     /* get the collins count */
-     ptrtok=strtok(NULL," \n");
-@@ -154,7 +144,12 @@ IndexPtr parse_index(long offset, int dbase, char *line) {
-     /* get the number of pointers types */
-     ptrtok=strtok(NULL," \n");
-     idx->ptruse_cnt = atoi(ptrtok);
--    
-+
-+    if (idx->ptruse_cnt < 0 || (unsigned int)idx->ptruse_cnt > UINT_MAX/sizeof(int)) {
-+        free_index(idx);
-+        return(NULL);
-+    }
-+
-     if (idx->ptruse_cnt) {
- 	idx->ptruse = (int *) malloc(idx->ptruse_cnt * (sizeof(int)));
- 	assert(idx->ptruse);
-@@ -173,9 +168,14 @@ IndexPtr parse_index(long offset, int dbase, char *line) {
-     /* get the number of senses that are tagged */
-     ptrtok=strtok(NULL," \n");
-     idx->tagged_cnt = atoi(ptrtok);
--        
-+
-+    if (idx->off_cnt < 0 || (unsigned long)idx->off_cnt > ULONG_MAX/sizeof(long)) {
-+        free_index(idx);
-+        return(NULL);
-+    }
-+
-     /* make space for the offsets */
--    idx->offset = (long *) malloc(idx->off_cnt * (sizeof(long)));
-+    idx->offset = (unsigned long *) malloc(idx->off_cnt * sizeof(long));
-     assert(idx->offset);
-     
-     /* get the offsets */
-@@ -197,15 +197,21 @@ IndexPtr getindex(char *searchstr, int dbase)
-     char strings[MAX_FORMS][WORDBUF]; /* vector of search strings */
-     static IndexPtr offsets[MAX_FORMS];
-     static int offset;
--    
-+
-     /* This works like strrok(): if passed with a non-null string,
-        prepare vector of search strings and offsets.  If string
-        is null, look at current list of offsets and return next
-        one, or NULL if no more alternatives for this word. */
- 
-     if (searchstr != NULL) {
--
--	offset = 0;
-+        /* Bail out if the input is too long for us to handle */
-+        if (strlen(searchstr) > (WORDBUF - 1)) {
-+            strcpy(msgbuf, "WordNet library error: search term is too long\n");
-+                   display_message(msgbuf);
-+            return(NULL);
-+        }
-+
-+    	offset = 0;
- 	strtolower(searchstr);
- 	for (i = 0; i < MAX_FORMS; i++) {
- 	    strcpy(strings[i], searchstr);
-@@ -229,11 +235,11 @@ IndexPtr getindex(char *searchstr, int dbase)
- 	/* Get offset of first entry.  Then eliminate duplicates
- 	   and get offsets of unique strings. */
- 
--	if (strings[0][0] != NULL)
-+	if (strings[0] != NULL)
- 	    offsets[0] = index_lookup(strings[0], dbase);
- 
- 	for (i = 1; i < MAX_FORMS; i++)
--	    if ((strings[i][0]) != NULL && (strcmp(strings[0], strings[i])))
-+	    if (strings[i] != NULL && (strcmp(strings[0], strings[i])))
- 		offsets[i] = index_lookup(strings[i], dbase);
-     }
- 
-@@ -272,7 +278,7 @@ SynsetPtr read_synset(int dbase, long boffset, char *word)
- SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
- {
-     static char line[LINEBUF];
--    char tbuf[SMLINEBUF];
-+    char tbuf[SMLINEBUF] = "";
-     char *ptrtok;
-     char *tmpptr;
-     int foundpert = 0;
-@@ -286,33 +292,11 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
-     if ((tmpptr = fgets(line, LINEBUF, fp)) == NULL)
- 	return(NULL);
-     
--    synptr = (SynsetPtr)malloc(sizeof(Synset));
-+    synptr = (SynsetPtr)calloc(1, sizeof(Synset));
-     assert(synptr);
--    
--    synptr->hereiam = 0;
-+
-     synptr->sstype = DONT_KNOW;
--    synptr->fnum = 0;
--    synptr->pos = '\0';
--    synptr->wcount = 0;
--    synptr->words = '\0';
--    synptr->whichword = 0;
--    synptr->ptrcount = 0;
--    synptr->ptrtyp = '\0';
--    synptr->ptroff = '\0';
--    synptr->ppos = '\0';
--    synptr->pto = '\0';
--    synptr->pfrm = '\0';
--    synptr->fcount = 0;
--    synptr->frmid = '\0';
--    synptr->frmto = '\0';
--    synptr->defn = '\0';
--    synptr->key = 0;
--    synptr->nextss = NULL;
--    synptr->nextform = NULL;
-     synptr->searchtype = -1;
--    synptr->ptrlist = NULL;
--    synptr->headword = NULL;
--    synptr->headsense = 0;
- 
-     ptrtok = line;
-     
-@@ -322,7 +306,7 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
- 
-     /* sanity check - make sure starting file offset matches first field */
-     if (synptr->hereiam != loc) {
--	sprintf(msgbuf, "WordNet library error: no synset at location %d\n",
-+	sprintf(msgbuf, "WordNet library error: no synset at location %ld\n",
- 		loc);
- 	display_message(msgbuf);
- 	free(synptr);
-@@ -335,16 +319,20 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
-     
-     /* looking at POS */
-     ptrtok = strtok(NULL, " \n");
--    synptr->pos = malloc(strlen(ptrtok) + 1);
-+    synptr->pos = strdup(ptrtok);
-     assert(synptr->pos);
--    strcpy(synptr->pos, ptrtok);
-     if (getsstype(synptr->pos) == SATELLITE)
- 	synptr->sstype = INDIRECT_ANT;
-     
-     /* looking at numwords */
-     ptrtok = strtok(NULL, " \n");
-     synptr->wcount = strtol(ptrtok, NULL, 16);
--    
-+
-+    if (synptr->wcount < 0 || (unsigned int)synptr->wcount > UINT_MAX/sizeof(char *)) {
-+        free_syns(synptr);
-+        return(NULL);
-+    }
-+
-     synptr->words = (char **)malloc(synptr->wcount  * sizeof(char *));
-     assert(synptr->words);
-     synptr->wnsns = (int *)malloc(synptr->wcount * sizeof(int));
-@@ -354,9 +342,8 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
-     
-     for (i = 0; i < synptr->wcount; i++) {
- 	ptrtok = strtok(NULL, " \n");
--	synptr->words[i] = malloc(strlen(ptrtok) + 1);
-+	synptr->words[i] = strdup(ptrtok);
- 	assert(synptr->words[i]);
--	strcpy(synptr->words[i], ptrtok);
- 	
- 	/* is this the word we're looking for? */
- 	
-@@ -371,6 +358,12 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
-     ptrtok = strtok(NULL," \n");
-     synptr->ptrcount = atoi(ptrtok);
- 
-+    /* Should we check for long here as well? */
-+    if (synptr->ptrcount < 0 || (unsigned int)synptr->ptrcount > UINT_MAX/sizeof(int)) {
-+        free_syns(synptr);
-+        return(NULL);
-+    }
-+
-     if (synptr->ptrcount) {
- 
- 	/* alloc storage for the pointers */
-@@ -455,21 +448,23 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word)
-     ptrtok = strtok(NULL," \n");
-     if (ptrtok) {
- 	ptrtok = strtok(NULL," \n");
--	sprintf(tbuf, "");
- 	while (ptrtok != NULL) {
-+	    if (strlen(ptrtok) + strlen(tbuf) + 1 + 1 > sizeof(tbuf)) {
-+                free_syns(synptr);
-+                return(NULL);
-+	    }
- 	    strcat(tbuf,ptrtok);
- 	    ptrtok = strtok(NULL, " \n");
- 	    if(ptrtok)
- 		strcat(tbuf," ");
- 	}
--	assert((1 + strlen(tbuf)) < sizeof(tbuf));
--	synptr->defn = malloc(strlen(tbuf) + 4);
-+	synptr->defn = malloc(strlen(tbuf) + 3);
- 	assert(synptr->defn);
- 	sprintf(synptr->defn,"(%s)",tbuf);
-     }
- 
-     if (keyindexfp) { 		/* we have unique keys */
--	sprintf(tmpbuf, "%c:%8.8d", partchars[dbase], synptr->hereiam);
-+	sprintf(tmpbuf, "%c:%8.8ld", partchars[dbase], synptr->hereiam);
- 	synptr->key = GetKeyForOffset(tmpbuf);
-     }
- 
-@@ -635,7 +630,7 @@ static void traceptrs(SynsetPtr synptr, int ptrtyp, int dbase, int depth)
- 
- 	    if ((ptrtyp == PERTPTR || ptrtyp == PPLPTR) &&
- 		synptr->pto[i] != 0) {
--		sprintf(tbuf, " (Sense %d)\n",
-+		snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n",
- 			cursyn->wnsns[synptr->pto[i] - 1]);
- 		printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
- 			    SKIP_ANTS, PRINT_MARKER);
-@@ -656,7 +651,7 @@ static void traceptrs(SynsetPtr synptr, int ptrtyp, int dbase, int depth)
- 		    traceptrs(cursyn, HYPERPTR, getpos(cursyn->pos), 0);
- 		}
- 	    } else if (ptrtyp == ANTPTR && dbase != ADJ && synptr->pto[i] != 0) {
--		sprintf(tbuf, " (Sense %d)\n",
-+		snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n",
- 			cursyn->wnsns[synptr->pto[i] - 1]);
- 		printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
- 			    SKIP_ANTS, PRINT_MARKER);
-@@ -817,7 +812,7 @@ static void tracenomins(SynsetPtr synptr, int dbase)
- 	    	    
- 	    cursyn = read_synset(synptr->ppos[i], synptr->ptroff[i], "");
- 
--	    sprintf(tbuf, "#%d\n",
-+	    snprintf(tbuf, sizeof(tbuf), "#%d\n",
- 		    cursyn->wnsns[synptr->pto[i] - 1]);
- 	    printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i],
- 			SKIP_ANTS, SKIP_MARKER);
-@@ -989,12 +984,12 @@ void getexample(char *offset, char *wd)
-     char sentbuf[512];
-     
-     if (vsentfilefp != NULL) {
--	if (line = bin_search(offset, vsentfilefp)) {
-+	if ((line = bin_search(offset, vsentfilefp)) != NULL) {
- 	    while(*line != ' ') 
- 		line++;
- 
- 	    printbuffer("          EX: ");
--	    sprintf(sentbuf, line, wd);
-+	    snprintf(sentbuf, sizeof(sentbuf), line, wd);
- 	    printbuffer(sentbuf);
- 	}
-     }
-@@ -1011,7 +1006,7 @@ int findexample(SynsetPtr synptr)
-     if (vidxfilefp != NULL) {
- 	wdnum = synptr->whichword - 1;
- 
--	sprintf(tbuf,"%s%%%-1.1d:%-2.2d:%-2.2d::",
-+	snprintf(tbuf, sizeof(tbuf), "%s%%%-1.1d:%-2.2d:%-2.2d::",
- 		synptr->words[wdnum],
- 		getpos(synptr->pos),
- 		synptr->fnum,
-@@ -1124,7 +1119,7 @@ static void freq_word(IndexPtr index)
- 	if (cnt >= 17 && cnt <= 32) familiar = 6;
- 	if (cnt > 32 ) familiar = 7;
- 	
--	sprintf(tmpbuf,
-+	snprintf(tmpbuf, sizeof(tmpbuf),
- 		"\n%s used as %s is %s (polysemy count = %d)\n",
- 		index->wd, a_an[getpos(index->pos)], freqcats[familiar], cnt);
- 	printbuffer(tmpbuf);
-@@ -1147,6 +1142,9 @@ void wngrep (char *word_passed, int pos) {
-    }
-    rewind(inputfile);
- 
-+   if (strlen(word_passed) + 1 > sizeof(word))
-+       return;
-+
-    strcpy (word, word_passed);
-    ToLowerCase(word);		/* map to lower case for index file search */
-    strsubst (word, ' ', '_');	/* replace spaces with underscores */
-@@ -1169,7 +1167,7 @@ void wngrep (char *word_passed, int pos) {
-             ((line[loc + wordlen] == '-') || (line[loc + wordlen] == '_')))
-          ) {
-             strsubst (line, '_', ' ');
--            sprintf (tmpbuf, "%s\n", line);
-+            snprintf (tmpbuf, sizeof(tmpbuf), "%s\n", line);
-             printbuffer (tmpbuf);
-             break;
-          }
-@@ -1570,7 +1568,8 @@ char *findtheinfo(char *searchstr, int dbase, int ptrtyp, int whichsense)
- 			bufstart[0] = '\n';
- 			bufstart++;
- 		    }
--		    strncpy(bufstart, tmpbuf, strlen(tmpbuf));
-+		    /* Don't include the \0 */
-+		    memcpy(bufstart, tmpbuf, strlen(tmpbuf));
- 		    bufstart = searchbuffer + strlen(searchbuffer);
- 		}
- 	    }
-@@ -1683,9 +1682,8 @@ SynsetPtr traceptrs_ds(SynsetPtr synptr, int ptrtyp, int dbase, int depth)
- 		cursyn = read_synset(synptr->ppos[i],
- 				      synptr->ptroff[i],
- 				      "");
--		synptr->headword = malloc(strlen(cursyn->words[0]) + 1);
-+		synptr->headword = strdup(cursyn->words[0]);
- 		assert(synptr->headword);
--		strcpy(synptr->headword, cursyn->words[0]);
- 		synptr->headsense = cursyn->lexid[0];
- 		free_synset(cursyn);
- 		break;
-@@ -2013,7 +2011,7 @@ static int getsearchsense(SynsetPtr synptr, int whichword)
-     strsubst(strcpy(wdbuf, synptr->words[whichword - 1]), ' ', '_');
-     strtolower(wdbuf);
- 		       
--    if (idx = index_lookup(wdbuf, getpos(synptr->pos))) {
-+    if ((idx = index_lookup(wdbuf, getpos(synptr->pos))) != NULL) {
- 	for (i = 0; i < idx->off_cnt; i++)
- 	    if (idx->offset[i] == synptr->hereiam) {
- 		free_index(idx);
-@@ -2037,7 +2035,7 @@ static void printsynset(char *head, SynsetPtr synptr, char *tail, int definition
-        by flags */
- 
-     if (offsetflag)		/* print synset offset */
--	sprintf(tbuf + strlen(tbuf),"{%8.8d} ", synptr->hereiam);
-+	sprintf(tbuf + strlen(tbuf),"{%8.8ld} ", synptr->hereiam);
-     if (fileinfoflag) {		/* print lexicographer file information */
- 	sprintf(tbuf + strlen(tbuf), "<%s> ", lexfiles[synptr->fnum]);
- 	prlexid = 1;		/* print lexicographer id after word */
-@@ -2072,7 +2070,7 @@ static void printantsynset(SynsetPtr synptr, char *tail, int anttype, int defini
-     tbuf[0] = '\0';
- 
-     if (offsetflag)
--	sprintf(tbuf,"{%8.8d} ", synptr->hereiam);
-+	sprintf(tbuf,"{%8.8ld} ", synptr->hereiam);
-     if (fileinfoflag) {
- 	sprintf(tbuf + strlen(tbuf),"<%s> ", lexfiles[synptr->fnum]);
- 	prlexid = 1;
-diff --git a/lib/wnutil.c b/lib/wnutil.c
-index 5ee5d76..7b7948a 100644
---- a/lib/wnutil.c
-+++ b/lib/wnutil.c
-@@ -48,7 +48,7 @@ int wninit(void)
-     char *env;
- 
-     if (!done) {
--	if (env = getenv("WNDBVERSION")) {
-+	if ((env = getenv("WNDBVERSION")) != NULL) {
- 	    wnrelease = strdup(env);	/* set release */
- 	    assert(wnrelease);
- 	}
-@@ -70,7 +70,7 @@ int re_wninit(void)
- 
-     closefps();
- 
--    if (env = getenv("WNDBVERSION")) {
-+    if ((env = getenv("WNDBVERSION")) != NULL) {
- 	wnrelease = strdup(env);	/* set release */
- 	assert(wnrelease);
-     }
-@@ -149,25 +149,25 @@ static int do_init(void)
- 	sprintf(searchdir, DEFAULTPATH);
- #else
-     if ((env = getenv("WNSEARCHDIR")) != NULL)
--	strcpy(searchdir, env);
-+	snprintf(searchdir, sizeof(searchdir), "%s", env);
-     else if ((env = getenv("WNHOME")) != NULL)
--	sprintf(searchdir, "%s%s", env, DICTDIR);
-+	snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR);
-     else
- 	strcpy(searchdir, DEFAULTPATH);
- #endif
- 
-     for (i = 1; i < NUMPARTS + 1; i++) {
--	sprintf(tmpbuf, DATAFILE, searchdir, partnames[i]);
-+	snprintf(tmpbuf, sizeof(tmpbuf), DATAFILE, searchdir, partnames[i]);
- 	if((datafps[i] = fopen(tmpbuf, "r")) == NULL) {
--	    sprintf(msgbuf,
-+	    snprintf(msgbuf, sizeof(msgbuf),
- 		    "WordNet library error: Can't open datafile(%s)\n",
- 		    tmpbuf);
- 	    display_message(msgbuf);
- 	    openerr = -1;
- 	}
--	sprintf(tmpbuf, INDEXFILE, searchdir, partnames[i]);
-+	snprintf(tmpbuf, sizeof(tmpbuf), INDEXFILE, searchdir, partnames[i]);
- 	if((indexfps[i] = fopen(tmpbuf, "r")) == NULL) {
--	    sprintf(msgbuf,
-+	    snprintf(msgbuf, sizeof(msgbuf),
- 		    "WordNet library error: Can't open indexfile(%s)\n",
- 		    tmpbuf);
- 	    display_message(msgbuf);
-@@ -178,35 +178,35 @@ static int do_init(void)
-     /* This file isn't used by the library and doesn't have to
-        be present.  No error is reported if the open fails. */
- 
--    sprintf(tmpbuf, SENSEIDXFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), SENSEIDXFILE, searchdir);
-     sensefp = fopen(tmpbuf, "r");
- 
-     /* If this file isn't present, the runtime code will skip printint out
-        the number of times each sense was tagged. */
- 
--    sprintf(tmpbuf, CNTLISTFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), CNTLISTFILE, searchdir);
-     cntlistfp = fopen(tmpbuf, "r");
- 
-     /* This file doesn't have to be present.  No error is reported if the
-        open fails. */
- 
--    sprintf(tmpbuf, KEYIDXFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), KEYIDXFILE, searchdir);
-     keyindexfp = fopen(tmpbuf, "r");
- 
--    sprintf(tmpbuf, REVKEYIDXFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), REVKEYIDXFILE, searchdir);
-     revkeyindexfp = fopen(tmpbuf, "r");
- 
--    sprintf(tmpbuf, VRBSENTFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), VRBSENTFILE, searchdir);
-     if ((vsentfilefp = fopen(tmpbuf, "r")) == NULL) {
--	sprintf(msgbuf,
-+	snprintf(msgbuf, sizeof(msgbuf),
- "WordNet library warning: Can't open verb example sentence file(%s)\n",
- 		tmpbuf);
- 	display_message(msgbuf);
-     }
- 
--    sprintf(tmpbuf, VRBIDXFILE, searchdir);
-+    snprintf(tmpbuf, sizeof(tmpbuf), VRBIDXFILE, searchdir);
-     if ((vidxfilefp = fopen(tmpbuf, "r")) == NULL) {
--	sprintf(msgbuf,
-+	snprintf(msgbuf, sizeof(msgbuf),
- "WordNet library warning: Can't open verb example sentence index file(%s)\n",
- 		tmpbuf);
- 	display_message(msgbuf);
-diff --git a/src/wn.c b/src/wn.c
-index ddb27aa..5c6a255 100644
---- a/src/wn.c
-+++ b/src/wn.c
-@@ -129,7 +129,7 @@ static void printusage(), printlicense(),
-        printsearches(char *, int, unsigned long);
- static int error_message(char *);
- 
--main(int argc,char *argv[])
-+int main(int argc,char *argv[])
- {
-     display_message = error_message;
-     
-@@ -225,14 +225,14 @@ static int do_search(char *searchword, int pos, int search, int whichsense,
- 	printf("\n%s of %s %s\n%s",
- 	       label, partnames[pos], searchword, outbuf);
- 
--    if (morphword = morphstr(searchword, pos))
-+    if ((morphword = morphstr(searchword, pos)) != NULL)
- 	do {
- 	    outbuf = findtheinfo(morphword, pos, search, whichsense);
- 	    totsenses += wnresults.printcnt;
- 	    if (strlen(outbuf) > 0) 
- 		printf("\n%s of %s %s\n%s",
- 		       label, partnames[pos], morphword, outbuf);
--	} while (morphword = morphstr(NULL, pos));
-+	} while ((morphword = morphstr(NULL, pos)) != NULL);
- 
-     return(totsenses);
- }
diff --git a/app-dicts/wordnet/wordnet-3.0-r1.ebuild b/app-dicts/wordnet/wordnet-3.0-r2.ebuild
index 16984acd2ce8..fe7a198586e1 100644
--- a/app-dicts/wordnet/wordnet-3.0-r1.ebuild
+++ b/app-dicts/wordnet/wordnet-3.0-r2.ebuild
@@ -1,12 +1,13 @@
 # Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/wordnet-3.0-r1.ebuild,v 1.1 2008/09/10 06:57:39 pva Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/wordnet-3.0-r2.ebuild,v 1.1 2008/09/12 19:36:30 pva Exp $
 
 inherit flag-o-matic autotools
 
 DESCRIPTION="A lexical database for the English language"
 HOMEPAGE="http://wordnet.princeton.edu/"
-SRC_URI="ftp://ftp.cogsci.princeton.edu/pub/wordnet/${PV}/WordNet-${PV}.tar.gz"
+SRC_URI="ftp://ftp.cogsci.princeton.edu/pub/wordnet/${PV}/WordNet-${PV}.tar.gz
+		mirrors://gentoo/${P}-patchset-1.tar.bz2"
 LICENSE="Princeton"
 
 SLOT="0"
@@ -23,15 +24,15 @@ S=${WORKDIR}/WordNet-${PV}
 
 src_unpack() {
 	unpack ${A}
+	cd "${S}"
 	# Don't install into PREFIX/dict but PREFIX/share/wordnet/dict
-	epatch "${FILESDIR}/${P}-dict-location.patch"
+	epatch "${WORKDIR}/${P}-dict-location.patch"
 	# Fixes bug 130024, make an additional shared lib
-	epatch "${FILESDIR}/${P}-shared-lib.patch"
+	epatch "${WORKDIR}/${P}-shared-lib.patch"
 	# Don't install the docs directly into PREFIX/doc but PREFIX/doc/PN
-	epatch "${FILESDIR}/${P}-docs-path.patch"
-
-	cd "${S}"
-	epatch "${FILESDIR}"/${P}-CVE-2008-3908.patch #211491
+	epatch "${WORKDIR}/${P}-docs-path.patch"
+	epatch "${WORKDIR}"/${P}-CVE-2008-3908.patch #211491
+	epatch "${WORKDIR}"/${P}-CVE-2008-2149.patch #211491
 
 	# Don't install all the extra docs (html, pdf, ps) without doc USE flag.
 	use doc || sed -i -e "s:SUBDIRS =.*:SUBDIRS = man:" doc/Makefile.am
@@ -49,13 +50,11 @@ src_compile() {
 	WN_MANDIR="${T}/usr/share/man" \
 	WN_DOCDIR="${T}/usr/share/doc/wordnet-${PV}" \
 	WNHOME="/usr/share/wordnet" \
-	econf || die "econf failed"
+	econf
 	emake || die "emake Failed"
 }
 
 src_install() {
 	emake install DESTDIR="${D}" || die "install failed"
-
-	# We don't install COPYING because it's identical to LICENSE
-	dodoc AUTHORS ChangeLog INSTALL LICENSE README || die "dodoc failed"
+	dodoc AUTHORS ChangeLog INSTALL README || die "dodoc failed"
 }
diff --git a/app-dicts/wordnet/wordnet-3.0.ebuild b/app-dicts/wordnet/wordnet-3.0.ebuild
index 2706105ca21a..6a17fc80aca7 100644
--- a/app-dicts/wordnet/wordnet-3.0.ebuild
+++ b/app-dicts/wordnet/wordnet-3.0.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2007 Gentoo Foundation
+# Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/wordnet-3.0.ebuild,v 1.2 2007/10/22 16:42:18 cla Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-dicts/wordnet/wordnet-3.0.ebuild,v 1.3 2008/09/12 19:36:30 pva Exp $
 
 inherit flag-o-matic autotools
 
@@ -48,13 +48,11 @@ src_compile() {
 	WN_MANDIR="${T}/usr/share/man" \
 	WN_DOCDIR="${T}/usr/share/doc/wordnet-${PV}" \
 	WNHOME="/usr/share/wordnet" \
-	econf || die "econf failed"
+	econf
 	emake || die "emake Failed"
 }
 
 src_install() {
 	emake install DESTDIR="${D}" || die "install failed"
-
-	# We don't install COPYING because it's identical to LICENSE
-	dodoc AUTHORS ChangeLog INSTALL LICENSE README || die "dodoc failed"
+	dodoc AUTHORS ChangeLog INSTALL README || die "dodoc failed"
 }