media-libs/gegl: 0.1.{6,8}-r1 CVE-2012-4433 (bug #442016)

Package-Manager: portage-2.1.11.31/cvs/Linux x86_64
Manifest-Sign-Key: 0x401A1600

5 files changed, 328 insertions, 22 deletions

diff --git a/media-libs/gegl/ChangeLog b/media-libs/gegl/ChangeLog
index 05c4df57a854..e715d14ce57b 100644
--- a/media-libs/gegl/ChangeLog
+++ b/media-libs/gegl/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for media-libs/gegl
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-libs/gegl/ChangeLog,v 1.75 2012/11/06 19:39:50 sping Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-libs/gegl/ChangeLog,v 1.76 2012/11/17 15:48:02 sping Exp $
+
+*gegl-0.1.8-r1 (17 Nov 2012)
+*gegl-0.1.6-r1 (17 Nov 2012)
+
+  17 Nov 2012; Sebastian Pipping <sping@gentoo.org> +gegl-0.1.6-r1.ebuild,
+  +gegl-0.1.8-r1.ebuild, +files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch:
+  Patch 0.1.6 and 0.1.8 for CVE-2012-4433, too (bug #442016)
 
 *gegl-0.2.0-r1 (06 Nov 2012)
 
diff --git a/media-libs/gegl/Manifest b/media-libs/gegl/Manifest
index 636a462372bd..56500cfc4463 100644
--- a/media-libs/gegl/Manifest
+++ b/media-libs/gegl/Manifest
@@ -1,27 +1,30 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
+Hash: SHA256
 
-AUX 0.1.6-ffmpeg.patch 1288 RMD160 1d087764d314061d57d959e4b1fbc9fad3c6865a SHA1 d62d4987f1c0fc256f5968271fc65cce0cc4c195 SHA256 1de42f9403602c6c96bcaefb4140221607f8e3e98f2c856e208357c1722a94d2
-AUX gegl-0.0.22-locale_h.diff 282 RMD160 e3b6efcd91de6da23442c5da5ae9eaec2ee079b5 SHA1 59d008f5b9b971d44b859927dbbe4adedbbe5104 SHA256 7cbd5937ceb20dacd5abd9bf0180422d95ae85bd79e71b6d639d4d5d7f6fa28d
-AUX gegl-0.2.0-cve-2012-4433-1e92e523.patch 2365 RMD160 afddc297bf62dd1bed6d44e0ff588c5296e9fd44 SHA1 8a4be096b8d3197a532dcbc00f62c3515b80591c SHA256 0351770b65c4620868e575ba8e3f5d4e46b09fcf83cb52231ecdc42b2bc96bac
-AUX gegl-0.2.0-cve-2012-4433-4757cdf7.patch 1952 RMD160 d77b2d8b857278a5d50e3c6a57cb6a280062e7f5 SHA1 ed5cc37a2bae5fc92daad506b4da6aafc97101af SHA256 6ecb465e6fc060417b353418c23c1d97d664666f652f2c4967d7fa6e0125fc84
-AUX gegl-0.2.0-ffmpeg-0.11.diff 515 RMD160 9648d9866ac89c2a2853a707b2da2773e370050b SHA1 c10fd988c634fcf0948cc91a51d6528f6f1704ba SHA256 1f18ad7b397bcb6bc225a5eedea8e7516d60e6c6ae49814da53ca47f0953f4fe
-AUX gegl-doubledestdir.diff 438 RMD160 0b5f29d54e57d65f9e9ce58ccaf049235a176118 SHA1 975ee3a2346c14ad67c3dd2667f54cbea316bbd4 SHA256 a39da1569b510092ba345f52f33486fc246165ffd0f84d0129d29e77a26ccc2b
-AUX replace-imgconvert-by-swsscale.patch 2154 RMD160 fcf0e6c524a3e2071e474bdb62c4ccf3df1cfa09 SHA1 b8202e020c28cd70ca7aa96421edee940abf7a9c SHA256 d0470dd22814afffbbb2fffa7fc9488129b9cae715f26c8330eea913550885dc
-DIST gegl-0.1.6.tar.bz2 4118465 SHA256 a166225625eebfb57fd417c88cf1fa6e29b1d308d50ac3bd9ef30bad9f3726d1
-DIST gegl-0.1.8.tar.bz2 5532682 SHA256 106b9574b6d5fb282683794f7a7f090a1a3f4a388890e592b202827a4ca76f75
-DIST gegl-0.2.0.tar.bz2 7502040 RMD160 cc10365cff27dd42b002bf305f82de54d8c158fa SHA1 764cc66cb3c7b261b8fc18a6268a0e264a91d573 SHA256 df2e6a0d9499afcbc4f9029c18d9d1e0dd5e8710a75e17c9b1d9a6480dd8d426
-EBUILD gegl-0.1.6.ebuild 2743 RMD160 564534a8319d52d099c0c6a9c32d4685c308e69b SHA1 9c8eeae80e6515f9cb3302eb5ee192a9cd2d67e0 SHA256 6829f93779057e10caf9a985556190e72ff64371511f952971f28c421dfa6884
-EBUILD gegl-0.1.8.ebuild 3215 RMD160 eacc03e5a85155901428748c360b0ccf395e1e9a SHA1 b0eadef12f07a5a4d6fac666ea229ec41ab711c2 SHA256 3eb7db2d937e0dc698bea674f40fc1b4bb810a8e40267e28eef7ac21a1f4b708
-EBUILD gegl-0.2.0-r1.ebuild 3428 RMD160 42074e64ce60735b49eb05707551b7aabae1a3f5 SHA1 35296dafe1884bf59cb93c816d8f5af175eaff0a SHA256 2032cb4a882e4cac4987b64f8d7622905d681112c7c304dcb3275a6142a81b26
-EBUILD gegl-0.2.0.ebuild 3262 RMD160 14c01d4627eccc5b95ef594dda2caaade77f08c7 SHA1 a54b58d898367fa88a8beb1a348fb48eef6bf8cc SHA256 a06b1b6df11911cb9a2e8c81e6278118d20af1491534f53d69489b8d53cf29d7
-EBUILD gegl-9999.ebuild 3186 RMD160 fc85b8f165c40259949d3e813d6aae5bd9afef26 SHA1 319a966e5f788bebadad8af72a1b3ab9c1b8fee1 SHA256 c30cd8b5f557ed8df82cd7ac2053ca0cc450723ab5e4f7d3175b0e11f2bf5af2
-MISC ChangeLog 10371 RMD160 26870e26b8276b452310192abdac1f5ad953c6db SHA1 6afe633c0b02f12a44eb0e75c2ed527a8c6f95c6 SHA256 6453488c3bc5a30977193a42c89faaf956fb96035765dcf57b793307d3144531
-MISC metadata.xml 546 RMD160 024a63c2273fbee451b7389fc1a56e6770a870c1 SHA1 007826eb21331bad4028f8bd6778131d12198e19 SHA256 76148af87ef72e06a1daae6476a80a97058f4f9e5d115c0603e156aeb3fd492d
+AUX 0.1.6-ffmpeg.patch 1288 SHA256 1de42f9403602c6c96bcaefb4140221607f8e3e98f2c856e208357c1722a94d2 SHA512 7df01359c7bea588b01ede213a34950e6208a5c17b3224ea7a0c300fb522797e96a1400c31a237c9438c8adf0da9ea2f531c0bc74592d4315743c2f6e23921d8 WHIRLPOOL d305576300f9969af2095bf403ed5b00c0f59433b5ef7a972f465dc3a9fd90aebd15ce0246d6cd65a4f19d3dbbdadd6e7eba37cb286ca7303e539fe66500447b
+AUX gegl-0.0.22-locale_h.diff 282 SHA256 7cbd5937ceb20dacd5abd9bf0180422d95ae85bd79e71b6d639d4d5d7f6fa28d SHA512 cde065207208f99f4d16662c6cbddf6f5046ef722f05fa147e0648a56a3c963dcfeac2ced317e08d7ee5994727355f2ffb1766a35fc20b08b3a5d6e3743330c9 WHIRLPOOL c0ff6d406097a5693a0c004edd599888c010064b28c3ce4fb8afc6971b30f096a39f749171c3fbf7ec1b7edcbcbb3a5cb74586b2e7a826429a8a98c473c529c9
+AUX gegl-0.1.8-cve-2012-4433-4757cdf7.patch 2118 SHA256 b9d0d3a304525af4524d18650a31f49b5ddfc2363ade8c07c37f728db3258f39 SHA512 0f6d9d55c94c7643ce13fe592c460987bfd5b0fef7b13ee080a6f71f904700727bd36f950c4b5fd9969f81be1d31e091218e3c3e01ed05d1fb01dd4dc4b03ed5 WHIRLPOOL 9705c5c5a745b1cb71621cb0a24c3958f2344876f10442d3dfcaa160763f78791bf2efbbe299d4119a799757371e2171f8dda55c2c2fa0c795223e002819a76c
+AUX gegl-0.2.0-cve-2012-4433-1e92e523.patch 2365 SHA256 0351770b65c4620868e575ba8e3f5d4e46b09fcf83cb52231ecdc42b2bc96bac SHA512 f27c89ac3b7742da348f75190cb1d5ad2569ab71a188b42a64e23a6254489770c701714e8de49602fdb8e8f063c3c9130abac330dceacee15603098bc1b70348 WHIRLPOOL 107f7ae3d7aa6eac22a5c127cc2dcc1387f808bbab4254cb55aebbc5f1e70be2dbf9b40d6b79c2b62fdc5edde5f2384164ec3b441c281829ba89b366131c873a
+AUX gegl-0.2.0-cve-2012-4433-4757cdf7.patch 1952 SHA256 6ecb465e6fc060417b353418c23c1d97d664666f652f2c4967d7fa6e0125fc84 SHA512 c48ed73b4a042263464819981e5f9fb0c0fc7abe8291840da9e839833a8cd548077fa99fed4b523a5bbac120d4336d2007a243baa359b40a0f0e3ff633bffa57 WHIRLPOOL 34287b2ae70f0d2f61c1aa817e767b3db6041857ce6a09a85371177ae31575d3b73d1f2efe6dccdb6776bdbf9cc518a06e7ed77662eeee85fe4658bb13815dc7
+AUX gegl-0.2.0-ffmpeg-0.11.diff 515 SHA256 1f18ad7b397bcb6bc225a5eedea8e7516d60e6c6ae49814da53ca47f0953f4fe SHA512 4d8ea87bec1f2e8b83477e95cb8b59c02ca50ddab0e308f4c2a5c26682db2d130c2db1a9f28eaa6cd73e3b48d4542986eeb0668ca5cdc6a693a80f75e3592c65 WHIRLPOOL 721dec0599bbf924f311b29461eb56b90ada158eb0f416ff4c2082367bc09043bffbfc8fda421413599064f4c7f1309a4f50118c43bacadeb485c8e890233f76
+AUX gegl-doubledestdir.diff 438 SHA256 a39da1569b510092ba345f52f33486fc246165ffd0f84d0129d29e77a26ccc2b SHA512 dcfd999de171ebc80a4016d380793ea5bf39bfb4839715acd01a26edd28dea0a81cc31e92343934a6940f5aece8b2fc476f3328ba45343a3995e79040560b131 WHIRLPOOL da248cfb52a39157d0ef010121182151a00ad684e354c8d3fd2110d64344ca80f77acea5cf0c22ee6467a63ca43d6c2efc846d74137d1a9262d56baa042bad1f
+AUX replace-imgconvert-by-swsscale.patch 2154 SHA256 d0470dd22814afffbbb2fffa7fc9488129b9cae715f26c8330eea913550885dc SHA512 e988ea43516b5664ed8e359e1d964875916540f617b810e958f0644efc98f41abaed6c6cac41c049524dd85decf8819382fb49a5ddd3df42c12747a16fed79e1 WHIRLPOOL 0f28afaf5b9bedb18b178f5df9eddbfc6219899a189e16e15bbeed5da1d1417c55988cf1b6ee5da643fe7494c53f54c2d531cf2d543c94f03869279947b73ef0
+DIST gegl-0.1.6.tar.bz2 4118465 SHA256 a166225625eebfb57fd417c88cf1fa6e29b1d308d50ac3bd9ef30bad9f3726d1 SHA512 dc1cd83d822fc52293357601172b066eca842b74b459b0efce2348a60cfd57116e37b4ee926829fb7859355a48c2fee082fc057d72f2a8cf3f7de02e11247a5f WHIRLPOOL 1cd5cdb0714f79982918a8bb9ff9b653e242d1c472fc8b43b64042cefe905f225fd9499598ef9522dd871e629b87ac62b9f158e20df9eaf16a82b512e3402f63
+DIST gegl-0.1.8.tar.bz2 5532682 SHA256 106b9574b6d5fb282683794f7a7f090a1a3f4a388890e592b202827a4ca76f75 SHA512 22a1b20a132aecebdd6022c74fce9115bcfaef8e85400579083d682b7b177b69bd643694d88642f812b78f7c5db9b0a93d68648b19d144cd9ade2b5d0763495e WHIRLPOOL b04aa5ec727b425d1560f964ad5ed7d68a50986a953d11bb90c511d9474c714e362070ad03001e8e7233e430f71342328789950d0e1143a809a3a3b2d9817f0a
+DIST gegl-0.2.0.tar.bz2 7502040 SHA256 df2e6a0d9499afcbc4f9029c18d9d1e0dd5e8710a75e17c9b1d9a6480dd8d426 SHA512 16ef3f6852fd8efef2b6468a754342a2d003f2c2bef468d9465a448e6c89dedb8e791570f073a9faed05218a7c94c6c418eaa0f3abeadfb3e6b88d766ab792c8 WHIRLPOOL 74e9c18b095526b1d053f0700b3c3776197a5c1066cb77adb7c83f154aae9087319f7b7f0379fb9e895a5ef3ac62ebf05e2158c1d18180bafcef41dff096c01d
+EBUILD gegl-0.1.6-r1.ebuild 2930 SHA256 5e98248ff90ee11d8c6129bb114dc3358c9d940c0ffb76459f0f58988508a7e6 SHA512 24066c1a43565ff28ddfa9d123bc1ad43580454f9a33168fbcd75e62163f5dcd02b4b281c38ea77f6ac42b85edef59c49bab9282de573a972ef29f818567ce70 WHIRLPOOL 616a93a20e6d4bed93e2d78b9fb57823b6d958821144e3ce6096b214e04995c7e23a40538d01e2d32f73e607c6945c4b4dc09dbfbe2c26454833d6248b9358ba
+EBUILD gegl-0.1.6.ebuild 2743 SHA256 6829f93779057e10caf9a985556190e72ff64371511f952971f28c421dfa6884 SHA512 a5ee9f166ed68698c55e1a1da561536705c9c8282dcb949694eeae751dd31748972b943c2f4cab38ffde9caad12eeb60e45639e0cabffaa594e6006a87bfb3f0 WHIRLPOOL e6dbf18465bf4112dde66c20c4e87fe47634d119cc787db48390f2e6324fd76e93c3a1f6372c0ad4b7b3fd89d868ec3c5a04efb84c45f2782f782d5e79210445
+EBUILD gegl-0.1.8-r1.ebuild 3386 SHA256 5f641e709b1269b31009b5c86ba205dc0c0891e5f1ed2fbd6afae7efde2df36e SHA512 4d38163f2e3713a5560197192b436efd3f2d35891048ecb892d190e37111df743cde6de7b1949d20b9bf1763c985e1ebb1bd20789e5132674a96156954e5a213 WHIRLPOOL 1bf465de6b63967f79a9a0deb9908e66beb0d4970a18bc134734a85b1cc23055b91afafd85bbdce5f8a590a6684b343de3bdb132d1aeb7997b1204fe6802f1c1
+EBUILD gegl-0.1.8.ebuild 3215 SHA256 3eb7db2d937e0dc698bea674f40fc1b4bb810a8e40267e28eef7ac21a1f4b708 SHA512 34c57cb573ec2387b69128dd3a2b523f6ef8120f17e84c29a05961f88b75203b91cf53500f4e323aa41523c71cce4900486da06f3fe627ce1c87740fda046242 WHIRLPOOL c04c028d7d12c42f007ca31a8dc3ef18c99213c6a760e9802e92d42a2cfef6f47afa918eff29ae77539346b45ee223579fb6af08cca40226c7335daae6910248
+EBUILD gegl-0.2.0-r1.ebuild 3428 SHA256 2032cb4a882e4cac4987b64f8d7622905d681112c7c304dcb3275a6142a81b26 SHA512 d220bb1e0f89ccba1d8dc8aec5db6878d030324f07cb185771af178adacac33924f0f7fb2bc080cb5cfc0f3a42333a1aa19ac0e1622753358b52fca21306f1a3 WHIRLPOOL d825d801792bf4ea5929ae5735b5bf7bbb637807ec4d75e87501591ec2d35ca3841526cd75e465dd0a65e69bce27de3ced1bf733065cbdb02ff7d881bbacb5e9
+EBUILD gegl-0.2.0.ebuild 3262 SHA256 a06b1b6df11911cb9a2e8c81e6278118d20af1491534f53d69489b8d53cf29d7 SHA512 2a4410f0a349e6a1e3859209efad411922a8b96bbb26db24381068db00e501f780f4220a32951699a50faef2fe13d3aed217fbe94bcc2df4df70b50473c3911f WHIRLPOOL ddf9cb998fe164000efb13406af8b2029516e3147df112ca54df70f1686af2310349e7513e9b25789925cb50dccd9e5cf694c10809f8916c38aa385c8c5cb59d
+EBUILD gegl-9999.ebuild 3186 SHA256 c30cd8b5f557ed8df82cd7ac2053ca0cc450723ab5e4f7d3175b0e11f2bf5af2 SHA512 560bc9384e925ba463a3491a9b453dbcfb93d05cc3a19141f9771f8053ba4a891fe4c1c234f04a24bf72bf1b36ffdead07b90880e6d52f1a7812dd9c054fcb6e WHIRLPOOL 419daa7a6f7e92fc1e81840ab6fb07bb7a32945533137af70c9a0d911cc076a7e31be9a4df233aa06f0988eb0d5c73a14ea3d79f3df9df2c9d07bed6ed7c1b12
+MISC ChangeLog 10640 SHA256 fd7f371f9f61f13d15a7358667d0af8943abe13bfe8cef2dd88ae92dfc7393a4 SHA512 643521c06b948fe381659253a2e646e4456fa7869cd28befee07221d56ac2be89c9d58a83db9eea053bbc0a4e30c2e59d5954fe0d92a6f8faf28c3e58d7b787a WHIRLPOOL 0297b79ae9cd39cf571a6edb971f8ce1fb69d13495a2fb7e3bf635c0009dd189bd36d136c99d044f4cce651d67fe654a9871bac0e51565c57edbdd0df6a0d887
+MISC metadata.xml 546 SHA256 76148af87ef72e06a1daae6476a80a97058f4f9e5d115c0603e156aeb3fd492d SHA512 0aab6757fb995142f0407c2b9aa35fdd7d18566541ca2dd06134451482287d0fb9b3fabf3b744644edba43d7d5b5838558c622792c041144d1b160f44cf48fb4 WHIRLPOOL a073c9fe5d73789ed6ba380b1c0337948300765d1e509f0097be34f1bdbbdebf8863608dbdfa63b0430695d9f22ae0c3b2a2513cba1520a6fc4178419854bee5
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
-iEYEARECAAYFAlCZZ48ACgkQsAvGakAaFgCZFACg1vclhV6vp/NdsWpcAo3ZiZ0t
-xucAn1QQqq38Tousm2UWcMcvkV/XdTU3
-=QAx0
+iEYEAREIAAYFAlCnsb0ACgkQsAvGakAaFgBEZgCgslsMwr5LrfEuf3RM4+AWDdKv
+uvQAn1bqfrZfnnJ7Hbv1Q5vUnazUGTX+
+=OvEf
 -----END PGP SIGNATURE-----
diff --git a/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch b/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch
new file mode 100644
index 000000000000..7bda5b065c0a
--- /dev/null
+++ b/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch
@@ -0,0 +1,74 @@
+From 3d3b1559cb34bc862f145c9880d156f6f2fe7b5f Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 17 Nov 2012 16:22:21 +0100
+Subject: [PATCH] ppm-load: CVE-2012-4433: add plausibility checks for header
+ fields
+
+"Port" of 4757cdf73d3675478d645a3ec8250ba02168a230 by Nils Philippsen from GEGL 0.2.0 to 0.1.8
+---
+ operations/external/ppm-load.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index 6db6e5a..2d4f0ca 100644
+--- a/operations/external/ppm-load.c
++++ b/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+ 
+ typedef enum {
+   PIXMAP_ASCII  = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+ 
+ typedef struct {
+ 	map_type   type;
+-	gint       width;
+-	gint       height;
++	glong      width;
++	glong      height;
+         gsize      numsamples; /* width * height * channels */
+         gsize      bpc;        /* bytes per channel */
+ 	guchar    *data;
+@@ -82,11 +83,33 @@ ppm_load_read_header(FILE       *fp,
+       }
+ 
+     /* Get Width and Height */
+-    img->width  = strtol (header,&ptr,0);
+-    img->height = atoi (ptr);
++    errno = 0;
++    img->width  = strtol (header,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading width: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: width is negative");
++        return FALSE;
++      }
++
++    img->height = strtol (ptr,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading height: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: height is negative");
++        return FALSE;
++      }
+ 
+     retval = fgets (header,MAX_CHARS_IN_ROW,fp);
+-    maxval = strtol (header,&ptr,0);
++    maxval = strtol (header,&ptr,10);
+ 
+     if ((maxval != 255) && (maxval != 65535))
+       {
+-- 
+1.7.12.4
+
diff --git a/media-libs/gegl/gegl-0.1.6-r1.ebuild b/media-libs/gegl/gegl-0.1.6-r1.ebuild
new file mode 100644
index 000000000000..f8831c3042c4
--- /dev/null
+++ b/media-libs/gegl/gegl-0.1.6-r1.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/gegl/gegl-0.1.6-r1.ebuild,v 1.1 2012/11/17 15:48:02 sping Exp $
+
+EAPI=4
+
+inherit eutils autotools
+
+DESCRIPTION="A graph based image processing framework"
+HOMEPAGE="http://www.gegl.org/"
+SRC_URI="ftp://ftp.gimp.org/pub/${PN}/${PV:0:3}/${P}.tar.bz2"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~x64-solaris ~x86-solaris"
+
+IUSE="cairo debug exif ffmpeg graphviz jpeg jpeg2k lua mmx openexr png raw sdl sse svg umfpack v4l"
+
+DEPEND=">=media-libs/babl-0.1.4 <media-libs/babl-0.1.8
+	dev-libs/glib:2
+	x11-libs/gtk+:2
+	x11-libs/gdk-pixbuf:2
+	x11-libs/pango
+	sys-libs/zlib
+	cairo? ( x11-libs/cairo )
+	exif? ( media-gfx/exiv2 )
+	ffmpeg? ( virtual/ffmpeg )
+	graphviz? ( media-gfx/graphviz )
+	jpeg? ( virtual/jpeg )
+	jpeg2k? ( media-libs/jasper )
+	lua? ( dev-lang/lua )
+	openexr? ( media-libs/openexr )
+	png? ( media-libs/libpng )
+	raw? ( media-libs/libopenraw )
+	sdl? ( media-libs/libsdl )
+	svg? ( gnome-base/librsvg:2 )
+	umfpack? ( sci-libs/umfpack )
+	v4l? ( media-libs/libv4l )"
+RDEPEND="${DEPEND}"
+
+# tests fail in various ways:
+#   see bug #362215
+RESTRICT="test"
+
+DOCS=( ChangeLog INSTALL README NEWS )
+
+src_prepare() {
+	# https://bugs.gentoo.org/show_bug.cgi?id=442016
+	epatch "${FILESDIR}/${PN}-0.2.0-cve-2012-4433-1e92e523.patch"
+	epatch "${FILESDIR}/${PN}-0.1.8-cve-2012-4433-4757cdf7.patch"
+
+	# upstream bug report:
+	# https://bugzilla.gnome.org/show_bug.cgi?id=642494
+	epatch "${FILESDIR}"/gegl-doubledestdir.diff
+
+	# new ffmpeg api
+	epatch "${FILESDIR}/${PV}-ffmpeg.patch"
+
+	# fix OSX loadable module filename extension
+	sed -i -e 's/\.dylib/.bundle/' configure.ac || die
+	eautoreconf
+}
+
+src_configure() {
+	# never enable altering of CFLAGS via profile option
+	# libspiro: not in portage main tree
+	# disable documentation as the generating is bit automagic
+	#    if anyone wants to work on it just create bug with patch
+	# gtk and friends: always enable
+	econf \
+		--disable-profile \
+		--without-libspiro \
+		--disable-docs --disable-workshop \
+		--with-gtk --with-pango --with-gdk-pixbuf --with-gio \
+		$(use_enable mmx) \
+		$(use_enable sse) \
+		$(use_enable debug) \
+		$(use_with cairo) \
+		$(use_with cairo pangocairo) \
+		$(use_with exif exiv2) \
+		$(use_with ffmpeg libavformat) \
+		$(use_with graphviz) \
+		$(use_with jpeg libjpeg) \
+		$(use_with jpeg2k jasper) \
+		$(use_with lua) \
+		$(use_with openexr) \
+		$(use_with png libpng) \
+		$(use_with raw libopenraw) \
+		$(use_with sdl) \
+		$(use_with svg librsvg) \
+		$(use_with umfpack) \
+		$(use_with v4l libv4l)
+}
+
+src_test() {
+	# set xdg dirs to not violate sandbox constrains
+	export XDG_CONFIG_HOME="${T}"
+	export XDG_CACHE_HOME="${T}"
+
+	default
+}
+
+src_install() {
+	default
+	find "${ED}" -name '*.la' -delete
+}
diff --git a/media-libs/gegl/gegl-0.1.8-r1.ebuild b/media-libs/gegl/gegl-0.1.8-r1.ebuild
new file mode 100644
index 000000000000..5df94ee401b7
--- /dev/null
+++ b/media-libs/gegl/gegl-0.1.8-r1.ebuild
@@ -0,0 +1,116 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-libs/gegl/gegl-0.1.8-r1.ebuild,v 1.1 2012/11/17 15:48:02 sping Exp $
+
+EAPI=4
+
+inherit gnome2-utils eutils autotools
+
+DESCRIPTION="A graph based image processing framework"
+HOMEPAGE="http://www.gegl.org/"
+SRC_URI="ftp://ftp.gimp.org/pub/${PN}/${PV:0:3}/${P}.tar.bz2"
+
+LICENSE="|| ( GPL-3 LGPL-3 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x64-solaris ~x86-solaris"
+
+IUSE="cairo debug exif ffmpeg graphviz introspection jpeg jpeg2k lensfun lua mmx openexr png raw sdl sse svg umfpack v4l vala"
+
+VALASLOT="0.14"
+
+RDEPEND=">=media-libs/babl-0.1.6[introspection?] <media-libs/babl-0.1.8[introspection?]
+	>=dev-libs/glib-2.28:2
+	>=x11-libs/gdk-pixbuf-2.18:2
+	x11-libs/pango
+	sys-libs/zlib
+	cairo? ( x11-libs/cairo )
+	exif? ( media-gfx/exiv2 )
+	ffmpeg? ( virtual/ffmpeg )
+	graphviz? ( media-gfx/graphviz )
+	jpeg? ( virtual/jpeg )
+	jpeg2k? ( >=media-libs/jasper-1.900.1 )
+	lua? ( >=dev-lang/lua-5.1 )
+	openexr? ( media-libs/openexr )
+	png? ( media-libs/libpng )
+	raw? ( >=media-libs/libopenraw-0.0.5 )
+	sdl? ( media-libs/libsdl )
+	svg? ( >=gnome-base/librsvg-2.14:2 )
+	umfpack? ( sci-libs/umfpack )
+	v4l? ( media-libs/libv4l )
+	dev-lang/perl
+	introspection? ( >=dev-libs/gobject-introspection-0.10
+			>=dev-python/pygobject-2.26:2 )
+	lensfun? ( >=media-libs/lensfun-0.2.5 )"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	>=sys-devel/libtool-2.2
+	vala? ( dev-lang/vala:${VALASLOT}[vapigen] )"
+
+# tests fail in various ways:
+#   see bug #362215
+RESTRICT="test"
+
+DOCS=( ChangeLog INSTALL README NEWS )
+
+src_prepare() {
+	# https://bugs.gentoo.org/show_bug.cgi?id=442016
+	epatch "${FILESDIR}/${PN}-0.2.0-cve-2012-4433-1e92e523.patch"
+	epatch "${FILESDIR}/${P}-cve-2012-4433-4757cdf7.patch"
+
+	# Fix for upstream bug "gegl/gegl-0.1.deps missing from gegl-0.1.8 tarball"
+	# https://bugzilla.gnome.org/show_bug.cgi?id=666737
+	[ -f gegl/gegl-0.1.deps ] || echo 'Babl-0.1' > gegl/gegl-0.1.deps
+
+	# fix OSX loadable module filename extension
+	sed -i -e 's/\.dylib/.bundle/' configure.ac || die
+	eautoreconf
+}
+
+src_configure() {
+	# never enable altering of CFLAGS via profile option
+	# libspiro: not in portage main tree
+	# disable documentation as the generating is bit automagic
+	#    if anyone wants to work on it just create bug with patch
+	VAPIGEN="$(type -p vapigen-${VALASLOT})" \
+	econf \
+		--disable-profile \
+		--without-libspiro \
+		--disable-docs --disable-workshop \
+		--with-pango --with-gdk-pixbuf \
+		$(use_enable mmx) \
+		$(use_enable sse) \
+		$(use_enable debug) \
+		$(use_with cairo) \
+		$(use_with cairo pangocairo) \
+		$(use_with exif exiv2) \
+		$(use_with ffmpeg libavformat) \
+		$(use_with graphviz) \
+		$(use_with jpeg libjpeg) \
+		$(use_with jpeg2k jasper) \
+		$(use_with lua) \
+		$(use_with openexr) \
+		$(use_with png libpng) \
+		$(use_with raw libopenraw) \
+		$(use_with sdl) \
+		$(use_with svg librsvg) \
+		$(use_with umfpack) \
+		$(use_with v4l libv4l) \
+		$(use_enable introspection) \
+		$(use_with lensfun) \
+		$(use_with vala)
+}
+
+src_test() {
+	gnome2_environment_reset  # sandbox issues
+	default
+}
+
+src_compile() {
+	gnome2_environment_reset  # sandbox issues (bug #396687)
+	default
+}
+
+src_install() {
+	default
+	find "${ED}" -name '*.la' -delete
+}