Pullup ticket #4240 - requested by wiz
x11/modular-xorg-server: security fix

Revisions pulled up:
- x11/modular-xorg-server/Makefile                              1.81
- x11/modular-xorg-server/distinfo                              1.52
- x11/modular-xorg-server/patches/patch-dix_dixfonts.c          1.1

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Oct  8 20:33:54 UTC 2013

   Modified Files:
   	pkgsrc/x11/modular-xorg-server: Makefile distinfo
   Added Files:
   	pkgsrc/x11/modular-xorg-server/patches: patch-dix_dixfonts.c

   Log Message:
   Fix CVE-2013-4396.

   From a4d9bf1259ad28f54b6d59a480b2009cc89ca623 Mon Sep 17 00:00:00 2001
   From: Alan Coopersmith <alan.coopersmith@oracle.com>
   Date: Mon, 16 Sep 2013 21:47:16 -0700
   Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText()

   Save a pointer to the passed in closure structure before copying it
   and overwriting the *c pointer to point to our copy instead of the
   original.  If we hit an error, once we free(c), reset c to point to
   the original structure before jumping to the cleanup code that
   references *c.

   Since one of the errors being checked for is whether the server was
   able to malloc(c->nChars * itemSize), the client can potentially pass
   a number of characters chosen to cause the malloc to fail and the
   error path to be taken, resulting in the read from freed memory.

   Since the memory is accessed almost immediately afterwards, and the
   X server is mostly single threaded, the odds of the free memory having
   invalid contents are low with most malloc implementations when not using
   memory debugging features, but some allocators will definitely overwrite
   the memory there, leading to a likely crash.

   Reported-by: Pedro Ribeiro <pedrib@gmail.com>
   Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
   Reviewed-by: Julien Cristau <jcristau@debian.org>

   Bump PKGREVISION.


   To generate a diff of this commit:
   cvs rdiff -u -r1.80 -r1.81 pkgsrc/x11/modular-xorg-server/Makefile
   cvs rdiff -u -r1.51 -r1.52 pkgsrc/x11/modular-xorg-server/distinfo
   cvs rdiff -u -r0 -r1.1 \
       pkgsrc/x11/modular-xorg-server/patches/patch-dix_dixfonts.c
pullup 4240
Pullup ticket #4241 - requested by tez
graphics/librsvg: security patch

Revisions pulled up:
- graphics/librsvg/Makefile                                     1.74
- graphics/librsvg/distinfo                                     1.26
- graphics/librsvg/patches/patch-CVE-2013-1881                  1.1

---
   Module Name:    pkgsrc
   Committed By:   tez
   Date:           Thu Oct  3 13:39:13 UTC 2013

   Modified Files:
           pkgsrc/graphics/librsvg: Makefile distinfo
   Added Files:
           pkgsrc/graphics/librsvg/patches: patch-CVE-2013-1881

   Log Message:
   Fix for CVE-2013-1881 (SA55088)
   Modified (for portability) from
   https://git.gnome.org/browse/librsvg/patch/?id=f01aded72c38f0e18bc7ff67dee800e380251c8e
Pullup ticket #4241.
Pullup ticket #4242 - requested by taca
sysutils/ruby-rb-appscript: build fix

Revisions pulled up:
- sysutils/ruby-rb-appscript/Makefile                           1.4
- sysutils/ruby-rb-appscript/PLIST                              1.5

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Oct  1 15:24:02 UTC 2013

   Modified Files:
   	pkgsrc/sysutils/ruby-rb-appscript: Makefile PLIST

   Log Message:
   Fix build problem and clean up PLIST.

   Bump PKGREVISION.
Pullup ticket #4243 - requested by he
graphics/png: build fix

Revisions pulled up:
- graphics/png/Makefile                                         1.163
- graphics/png/distinfo                                         1.108

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Sep 30 18:17:03 UTC 2013

   Modified Files:
   	pkgsrc/graphics/png: Makefile distinfo

   Log Message:
   Update to 1.6.6:

   Version 1.6.6 [September 16, 2013]
     Removed two stray lines of code from arm/arm_init.c, again.
Pullup ticket #4244 - requested by obache
www/py-genshi: security update

Revisions pulled up:
- www/py-genshi/Makefile                                        1.8
- www/py-genshi/distinfo                                        1.3

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Fri Oct 11 10:54:15 UTC 2013

   Modified Files:
   	pkgsrc/www/py-genshi: Makefile distinfo

   Log Message:
   Update genshi to 0.6.1.

   Version 0.6.1
   http://svn.edgewall.org/repos/genshi/tags/0.6.1/
   (Jan 27 2013, from branches/stable/0.6.x)

     * Security fix to enhance sanitizing of CSS in style attributes. Genshi's
       `HTMLSanitizer` disallows style attributes by default (this remains
       unchanged) and warns against such attacks in its documentation, but
       the provided CSS santizing is now less lacking (see #455).
     * Fix for error in how `HTMLFormFiller` would handle `textarea` elements if
       no value was not supplied form them.
     * The `HTMLFormFiller` now correctly handles check boxes and radio buttons
       with an empty `value` attribute.
     * Template `Context` objects now have a `.copy` method.
     * Added a simple `tox.ini` file for using tox to test against multiple
       verions of Python.
     * Fix for bug in `QName` comparison (see #413).
     * Fix for bug in handling of trailing events in match template matches
       (see #399).
     * Fix i18n namespace declaration in documentation (see #400).
     * Fix for bug in caching of events in serializers by no longer caching
       `(TEXT, Markup)` events (see #429).
     * Fix handling of `None` by `Markup.escape` in `_speedups.c` (see #439).
     * Fix handling of internal state by match templates (relevant when multiple
       templates match the same part of the stream, see #370).
     * Fix handling of multiple events between or on either side of start and end
       tags in translated messages (see #404).
     * Fix test failures caused by changes in HTMLParser in Python 2.7 (see #501).
     * Fix infinite loop in interplotation lexing that was introduced by a change
       in Python 2.7's tokenizer (see #540).
     * Fix handling of processing instructions without data (see #368).
     * Updated MANIFEST.in so as not to rely on build from Subersion 1.6.
Pullup tickets #4242, #4243 and #4244.
Merge branch 'pkgsrc_2013Q3' into joyent/feature/smf/2013Q3