7008376 CVE-2009-3546 Upgrade GD
authorStefan Teleman <stefan.teleman@oracle.com>
Mon, 14 Mar 2011 15:17:54 -0700
changeset 130 5e67396e42dc
parent 129 15b2436fafb0
child 131 651976f969f6
7008376 CVE-2009-3546 Upgrade GD 7025797 libgd should move to userland
components/gd2/Makefile
components/gd2/SUNWgd2.p5m
components/gd2/Solaris/libgd2.1
components/gd2/Solaris/libgd2.1-extra
components/gd2/Solaris/libgd2.3
components/gd2/gd2.license
components/gd2/gd2.p5m
components/gd2/llib-lgd
components/gd2/patches/000-add-extra.patch
components/gd2/patches/001-configure.patch
components/gd2/patches/003-default_fontpath.patch
components/gd2/patches/004-gd2-2.0.35-CVE-2009-3546.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/Makefile	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,89 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+#
+include ../../make-rules/shared-macros.mk
+
+COMPONENT_NAME=         gd
+COMPONENT_VERSION=      2.0.35
+COMPONENT_SRC=          $(COMPONENT_NAME)-$(COMPONENT_VERSION)
+COMPONENT_PROJECT_URL=  http://www.libgd.org/
+COMPONENT_ARCHIVE=      $(COMPONENT_SRC).tar.gz
+COMPONENT_ARCHIVE_HASH= sha1:ad6b6ce72c83e513ef7c31b7f8a5c6f07a2e0143
+COMPONENT_ARCHIVE_URL=  http://www.libgd.org/releases/$(COMPONENT_ARCHIVE)
+
+include ../../make-rules/prep.mk
+include ../../make-rules/configure.mk
+include ../../make-rules/ips.mk
+
+LIBNAME =       gd
+LINTOUT =       lint.out
+
+PKG_CONFIG_PATH_32 = /usr/lib/pkgconfig
+PKG_CONFIG_PATH_64 = /usr/lib/$(MACH64)/pkgconfig
+
+PATCH_LEVEL = 0
+
+CFLAGS += $(CPP_LARGEFILES)
+CPPFLAGS += $(CPP_LARGEFILES)
+
+CONFIGURE_ENV += CFLAGS="$(CFLAGS)"
+CONFIGURE_ENV += CPPFLAGS="$(CPPFLAGS)"
+CONFIGURE_ENV += PKG_CONFIG_PATH="$(PKG_CONFIG_PATH_$(BITS))"
+
+CONFIGURE_OPTIONS  +=           --includedir=$(CONFIGURE_INCLUDEDIR)/gd2
+CONFIGURE_OPTIONS  +=           --disable-static
+CONFIGURE_OPTIONS  +=           --disable-rpath
+CONFIGURE_OPTIONS  +=           --with-x
+CONFIGURE_OPTIONS  +=           --with-pic
+
+PKG_PROTO_DIRS +=	$(COMPONENT_SRC)
+
+COMPONENT_PREP_ACTION = (cd $(@D) ; autoconf)
+
+COMPONENT_POST_BUILD_ACTION = \
+	 (cd $(@D); $(LINT) -nsvx $(CC_BITS) -o $(LIBNAME) -I$(@D) \
+			-I$(COMPONENT_DIR)/$(COMPONENT_SRC) \
+			$(COMPONENT_DIR)/llib-l$(LIBNAME) > $(LINTOUT) 2>&1)
+
+COMPONENT_POST_INSTALL_ACTION = \
+	(cd $(@D); $(INSTALL) llib-l$(LIBNAME).ln \
+			$(PROTO_DIR)/$(CONFIGURE_LIBDIR.$(BITS)))
+
+PROTOUSRSHAREDOCDIR = $(PROTOUSRSHAREDIR)/doc/gd2/html
+
+build: $(BUILD_32_and_64)
+
+GSED =	/usr/gnu/bin/sed
+
+include ../../make-rules/shared-targets.mk
+
+install: $(INSTALL_32_and_64)
+
+test: $(BUILD_32_and_64)
+	@echo "There is no test harness for libgd2."
+	@echo "Test programs must be run manually and their output"
+	@echo "should be visually inspected."
+
+BUILD_PKG_DEPENDENCIES = $(BUILD_TOOLS)
+
+include ../../make-rules/depend.mk
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/SUNWgd2.p5m	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,27 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+#
+
+set name=pkg.fmri value=pkg://solaris/[email protected],5.11-0.133
+set name=pkg.renamed value=true
+set name=org.opensolaris.consolidation value=$(CONSOLIDATION)
+depend fmri=library/[email protected] type=require
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/Solaris/libgd2.1	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,50 @@
+.\" generic libgd man page for the LibGD Project
+.TH libgd 1 "19 Mar 2007" "LibGD 2.0.34" "User commands"
+
+.SH NAME
+\fBannotate\fP,
+\fBgd2copypal\fP,
+\fBgd2time\fP,
+\fBgd2togif\fP,
+\fBgd2topng\fP,
+\fBgdcmpgif\fP,
+\fBgdparttopng\fP,
+\fBgdtopng\fP,
+\fBgiftogd2\fP,
+\fBpngtogd\fP,
+\fBpngtogd2\fP,
+\fBwebpng\fP
+.PP
+.br
+\fBLibGD\fR - The Graphics Draw Library is an open source code library
+for the dynamic creation of images by programmers.
+.br
+.SH "SEE ALSO"
+Complete documentation in HTML format for LibGD and all its command-line
+utilities is available under
+\fI/usr/share/doc/gd2/html\fR.
+.SH AUTHOR
+\fBLibGD\fR was originally written by Thomas Boutell, and is now maintained
+and developed by Pierre-A. Joye, member of the PHP Development Team. Further
+details are available at \fIhttp://www.libgd.org/\fR.  LibGD is released
+under the \fILibGD License\fR.
+.LP
+.SH ATTRIBUTES
+See
+.BR attributes (5)
+for descriptions of the following attributes:
+.sp
+.TS
+box;
+cbp-1 | cbp-1
+l | l .
+ATTRIBUTE TYPE  ATTRIBUTE VALUE
+=
+Availability    library/gd
+=
+Interface Stability     Uncommitted
+.TE
+.PP
+.SH NOTES
+Source for LibGD is available on http://opensolaris.org.
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/Solaris/libgd2.1-extra	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,1 @@
+.so man1/libgd2.1
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/Solaris/libgd2.3	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,46 @@
+.\" generic libgd man page for the LibGD Project
+.TH libgd 3 "19 Mar 2007" "LibGD 2.0.34" "Libraries"
+
+.SH NAME
+\fBLibGD\fR - The Graphics Draw Library is an open source code library
+for the dynamic creation of images by programmers.
+.br
+.SH LIBRARY
+The Graphics Draw Library (-lgd)
+.PP
+.br
+.SH DESCRIPTION
+.PP
+\fB#include <gd2/gd.h>\fP
+.PP
+.br
+.SH "SEE ALSO"
+Complete documentation in HTML format for LibGD and all its command-line
+utilities is available under
+\fI/usr/share/doc/gd2/html\fR.
+.SH AUTHOR
+\fBLibGD\fR was originally written by Thomas Boutell, and is now maintained
+and developed by Pierre-A. Joye, member of the PHP Development Team. Further
+details are available at \fIhttp://www.libgd.org/\fR.  LibGD is released
+under the \fILibGD License\fR.
+.LP
+.SH ATTRIBUTES
+See
+.BR attributes (5)
+for descriptions of the following attributes:
+.sp
+.TS
+box;
+cbp-1 | cbp-1
+l | l .
+ATTRIBUTE TYPE  ATTRIBUTE VALUE
+=
+Availability    library/gd
+=
+Interface Stability     Uncommitted
+.TE
+.PP
+.SH NOTES
+Source for LibGD is available on http://opensolaris.org.
+
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/gd2.license	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,56 @@
+
+The Graphics Draw Library and its associated programs are
+copyright (C) 1994-2002 by one or more of the following:
+
+Portions copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
+2002 by Cold Spring Harbor Laboratory. Funded under Grant
+P41-RR02188 by the National Institutes of Health.
+
+Portions copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002 by
+Boutell.Com, Inc.
+
+Portions relating to GD2 format copyright (C) 1999, 2000, 2001, 2002
+Philip Warner.
+
+Portions relating to PNG copyright (C) 1999, 2000, 2001, 2002 Greg
+Roelofs.
+
+Portions relating to gdttf.c copyright (C) 1999, 2000, 2001, 2002 John
+Ellson ([email protected]).
+
+Portions relating to gdft.c copyright (C) 2001, 2002 John Ellson
+([email protected]).
+
+Portions copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
+Pierre-Alain Joye ([email protected]).
+
+Portions relating to JPEG and to color quantization copyright (C) 2000,
+2001, 2002, Doug Becker and copyright (C) 1994, 1995, 1996, 1997,
+1998, 1999, 2000, 2001, 2002, Thomas G. Lane. This software is
+based in part on the work of the Independent JPEG Group. See the
+file README-JPEG.TXT for more information.
+
+Portions relating to WBMP copyright (C) 2000, 2001, 2002 Maurice
+Szmurlo and Johan Van den Brande.
+
+Permission has been granted to copy, distribute and modify gd in
+any context without fee, including a commercial application,
+provided that this notice is present in user-accessible supporting
+documentation.
+
+This does not affect your ownership of the derived work itself, and
+the intent is to assure proper credit for the authors of gd, not to
+interfere with your productive use of gd. If you have questions,
+   ask. "Derived works" includes all programs that utilize the
+library. Credit must be given in user-accessible documentation.
+
+This software is provided "AS IS." The copyright holders disclaim
+all warranties, either express or implied, including but not
+limited to implied warranties of merchantability and fitness for a
+particular purpose, with respect to this code and accompanying
+documentation.
+
+Although their code does not appear in gd, the authors wish to thank
+David Koblas, David Rowley, and Hutchison Avenue Software Corporation
+for their prior contributions.
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/gd2.p5m	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,106 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+#
+
+set name=pkg.fmri value=pkg:/library/[email protected]$(IPS_COMPONENT_VERSION),$(BUILD_VERSION)
+set name=pkg.summary value="The Graphics Draw Library"
+set name=pkg.description value="GD - An open source code library for the dynamic creation of images by programmers" 
+set name=info.classification value="org.opensolaris.category.2008:System/Libraries"
+set name=info.upstream_url value="http://www.libgd.org/"
+set name=info.source_url value=$(COMPONENT_ARCHIVE_URL)
+set name=org.opensolaris.consolidation value=$(CONSOLIDATION)
+#
+dir path=usr
+dir path=usr/bin
+dir path=usr/include
+dir path=usr/include/gd2
+dir path=usr/lib
+dir path=usr/lib/$(MACH64)
+dir path=usr/share
+dir path=usr/share/doc
+dir path=usr/share/doc/gd2
+dir path=usr/share/doc/gd2/html
+dir path=usr/share/man
+dir path=usr/share/man/man1
+dir path=usr/share/man/man3
+#
+file path=usr/bin/annotate
+file path=usr/bin/gd2copypal
+file path=usr/bin/gd2time
+file path=usr/bin/gd2togif
+file path=usr/bin/gd2topng
+file path=usr/bin/gdcmpgif
+file path=usr/bin/gdlib-config
+file path=usr/bin/gdparttopng
+file path=usr/bin/gdtopng
+file path=usr/bin/giftogd2
+file path=usr/bin/pngtogd
+file path=usr/bin/pngtogd2
+file path=usr/bin/webpng
+file path=usr/include/gd2/entities.h
+file path=usr/include/gd2/gd.h
+file path=usr/include/gd2/gd_io.h
+file path=usr/include/gd2/gdcache.h
+file path=usr/include/gd2/gdfontg.h
+file path=usr/include/gd2/gdfontl.h
+file path=usr/include/gd2/gdfontmb.h
+file path=usr/include/gd2/gdfonts.h
+file path=usr/include/gd2/gdfontt.h
+file path=usr/include/gd2/gdfx.h
+file path=usr/include/gd2/gdhelpers.h
+file path=usr/include/gd2/jisx0208.h
+file path=usr/include/gd2/wbmp.h
+file path=usr/lib/libgd.so.2.0.0
+file path=usr/lib/$(MACH64)/libgd.so.2.0.0
+file llib-lgd path=usr/lib/llib-lgd
+file path=usr/lib/llib-lgd.ln
+file path=usr/lib/$(MACH64)/llib-lgd.ln
+file index.html path=usr/share/doc/gd2/html/index.html
+file entities.html path=usr/share/doc/gd2/html/entities.html
+file Solaris/libgd2.1-extra path=usr/share/man/man1/annotate.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gd2copypal.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gd2time.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gd2togif.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gd2topng.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gdcmpgif.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gdparttopng.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/gdtopng.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/giftogd2.1
+file Solaris/libgd2.1 path=usr/share/man/man1/libgd2.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/pngtogd.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/pngtogd2.1
+file Solaris/libgd2.1-extra path=usr/share/man/man1/webpng.1
+file Solaris/libgd2.3 path=usr/share/man/man3/libgd2.3
+#
+link path=usr/lib/libgd.so.2 target=libgd.so.2.0.0
+link path=usr/lib/libgd.so target=libgd.so.2.0.0
+link path=usr/lib/$(MACH64)/libgd.so.2 target=libgd.so.2.0.0
+link path=usr/lib/$(MACH64)/libgd.so target=libgd.so.2.0.0
+#
+license gd2.license license="GD2 License"
+#
+legacy pkg=SUNWgd2 \
+    desc="GD - The Graphics Draw Library (2.0.35)" \
+    name="The Graphics Draw Library"
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/llib-lgd	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,39 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright (c) 2011, Oracle and/or its affiliates.  All rights reserved.
+ */
+
+/* LINTLIBRARY */
+/* PROTOLIB1 */
+
+/*
+ * This little dance is necessary to avoid ftello/fseeko
+ * complaints vs libc. We don't use them but we do #include
+ * stdio.h and as we are large file aware they get defined
+ * differently than libc.
+ */
+#include <sys/types.h>
+
+#include <gd.h>
+#include <gdhelpers.h>
+#include <gdcache.h>
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/patches/000-add-extra.patch	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,21 @@
+--- Makefile.am.orig	Sat Mar 12 23:00:26 2011
++++ Makefile.am	Sat Mar 12 23:03:00 2011
[email protected]@ -5,15 +5,15 @@
+ 
+ SUBDIRS = config test
+ 
+-bin_PROGRAMS = annotate gdparttopng gdtopng gd2copypal gd2topng pngtogd pngtogd2 webpng gd2togif gdcmpgif giftogd2
++bin_PROGRAMS = annotate gdparttopng gdtopng gd2copypal gd2topng pngtogd pngtogd2 webpng gd2togif gdcmpgif giftogd2 gd2time
+ 
+ bin_SCRIPTS = bdftogd config/gdlib-config
+ 
+-noinst_PROGRAMS = fontsizetest fontwheeltest gdtest gddemo gd2time gdtestft testac circletexttest testtr fontconfigtest gifanimtest
++noinst_PROGRAMS = fontsizetest fontwheeltest gdtest gddemo gdtestft testac circletexttest testtr fontconfigtest gifanimtest
+ 
+ EXTRA_DIST = README-JPEG.TXT README.TXT configure.pl bdftogd demoin.png err.out index.html install-item makefile.sample readme.jpn entities.html entities.tcl
+ 
+-include_HEADERS = gd.h gdfx.h gd_io.h gdcache.h gdfontg.h gdfontl.h gdfontmb.h gdfonts.h gdfontt.h entities.h
++include_HEADERS = gd.h gdfx.h gd_io.h gdcache.h gdfontg.h gdfontl.h gdfontmb.h gdfonts.h gdfontt.h entities.h gdhelpers.h jisx0208.h wbmp.h
+ 
+ lib_LTLIBRARIES = libgd.la
+ 
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/patches/001-configure.patch	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,21 @@
+# remove searching for libpng12 first since we want the default libpng.
+# see 6989480
+
+--- configure.ac.orig	Sun Mar 13 21:09:25 2011
++++ configure.ac	Sun Mar 13 21:10:10 2011
[email protected]@ -350,14 +350,8 @@
+ # authors decide to do this AGAIN. Which I really hope they won't. TBB
+ 
+ if test "$withval" != no; then
+-  AC_PATH_PROG([LIBPNG12_CONFIG], [libpng12-config])
+   AC_PATH_PROG([LIBPNG_CONFIG], [libpng-config])
+-  if test -n "$LIBPNG12_CONFIG"; then
+-    libpng_CPPFLAGS=`libpng12-config --cflags`
+-    # should be --ldopts, but it's currently broken
+-    libpng_LDFLAGS=`libpng12-config --ldflags`
+-    libpng_LDFLAGS=`echo " $libpng_LDFLAGS" | sed 's/ -l[[^ ]][[^ ]]*//g'`
+-  elif test -n "$LIBPNG_CONFIG"; then
++  if test -n "$LIBPNG_CONFIG"; then
+     libpng_CPPFLAGS=`libpng-config --cflags`
+     # should be --ldopts, but it's currently broken
+     libpng_LDFLAGS=`libpng-config --ldflags`
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/patches/003-default_fontpath.patch	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,32 @@
+--- gd.h 2007-05-06 13:38:20.000000000 -0800
++++ gd.h 2010-04-15 12:13:00.000000000 -0800
[email protected]@ -71,7 +71,28 @@
+ /* 2.0.23: more Type 1 fonts */
+ #ifndef DEFAULT_FONTPATH
+ /* default fontpath for unix systems  - whatever happened to standards ! */
+-#define DEFAULT_FONTPATH "/usr/X11R6/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/truetype:/usr/X11R6/lib/X11/fonts/TTF:/usr/share/fonts/TrueType:/usr/share/fonts/truetype:/usr/openwin/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/Type1:/usr/lib/X11/fonts/Type1:/usr/openwin/lib/X11/fonts/Type1"
++#define DEFAULT_FONTPATH \
++"/usr/share/fonts/TrueType/arphic:" \
++"/usr/share/fonts/TrueType/baekmuk:" \
++"/usr/share/fonts/TrueType/bh-luxi:" \
++"/usr/share/fonts/TrueType/bitstream-vera:" \
++"/usr/share/fonts/TrueType/bpg-georgian:" \
++"/usr/share/fonts/TrueType/core:" \
++"/usr/share/fonts/TrueType/dejavu:" \
++"/usr/share/fonts/TrueType/freefont:" \
++"/usr/share/fonts/TrueType/gentium:" \
++"/usr/share/fonts/TrueType/google-droid:" \
++"/usr/share/fonts/TrueType/hanyang:" \
++"/usr/share/fonts/TrueType/indic-fonts-core:" \
++"/usr/share/fonts/TrueType/ipafont:" \
++"/usr/share/fonts/TrueType/kacst:" \
++"/usr/share/fonts/TrueType/liberation:" \
++"/usr/share/fonts/TrueType/mgopen:" \
++"/usr/share/fonts/TrueType/sil:" \
++"/usr/share/fonts/TrueType/unifont:" \
++"/usr/share/fonts/X11/Type1:" \
++"/usr/share/fonts/sun/TrueType:" \
++"/usr/share/fonts/sun/Type1"
+ #endif
+ #ifndef PATHSEPARATOR
+ #define PATHSEPARATOR ":"
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/gd2/patches/004-gd2-2.0.35-CVE-2009-3546.patch	Mon Mar 14 15:17:54 2011 -0700
@@ -0,0 +1,14 @@
+# Patch for libgd2 Version 2.0.35 CVE-2009-3546
+--- gd_gd.c	2006-04-05 08:52:22.000000000 -0700
++++ gd_gd.c	2011-02-16 17:57:09.865711091 -0800
[email protected]@ -44,6 +44,10 @@
+ 	    {
+ 	      goto fail1;
+ 	    }
++	  if (im->colorsTotal > gdMaxColors)
++	    {
++		goto fail1;
++	    }
+ 	}
+       /* Int to accommodate truecolor single-color transparency */
+       if (!gdGetInt (&im->transparent, in))