[notify] bzip2: fix for CVE-2016-3189. closes FS#1585

bzip2/.md5sum

@@ -1,2 +1,3 @@
+3b17081b71204ddfaa1cef6f5f9d8747  CVE-2016-3189.patch
 00b516f4704d4a7cb50a1d97e6e8e15b  bzip2-1.0.6.tar.gz
 ab2b0d7367fc6f14a3d943a3861ad2c1  bzip2.patch

bzip2/.signature

@@ -1,6 +1,7 @@
 untrusted comment: verify with /etc/ports/core.pub
-RWRJc1FUaeVeqqfPftfIF0ivBJPCnvaKfb3TRTwhrHN2HwJzwZnalx90xUtEQ05eddc+wTr4TBkDpfdlnZ8wHaz4+pZOxRRSZQU=
-SHA256 (Pkgfile) = b5093f1b2cdc92c7773a0eb48bd20aa058fa677b9fc053f2ba1b4c82afe83b2e
+RWRJc1FUaeVeqm1TQVFfW0gKA8At/dPhtV6NvWErI7K10qCoVdy+G3YMe2g5Zlh1u5pYju9Ph8byE7Uxm6vIntJdAWeV8x219w0=
+SHA256 (Pkgfile) = fa4a0928f6530d495d431e37ba880d2359cf96da3cd3b64d68dc5f49b0428ebd
 SHA256 (.footprint) = bd0f9e3ca456b7ff1fcc5440865dc233e263307cb4b59f5d3c5d7ccfdadfcd6d
 SHA256 (bzip2-1.0.6.tar.gz) = a2848f34fcd5d6cf47def00461fcb528a0484d8edef8208d6d2e2909dc61d9cd
 SHA256 (bzip2.patch) = b8aa64ff17bc5704cbaf2b7012086575acfa6557c89fafdcc6dcd847fb29b5cf
+SHA256 (CVE-2016-3189.patch) = 5c1cce66d2d1dfa61a627734c1a00bf0441c5ab6be0458676e20787705a14a6b

bzip2/CVE-2016-3189.patch

@@ -0,0 +1,10 @@
+--- a/bzip2recover.c
++++ b/bzip2recover.c
+@@ -457,6 +457,7 @@ Int32 main ( Int32 argc, Char** argv )
+             bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 );
+             bsPutUInt32 ( bsWr, blockCRC );
+             bsClose ( bsWr );
++            outFile = NULL;
+          }
+          if (wrBlock >= rbCtr) break;
+          wrBlock++;

bzip2/Pkgfile

@@ -4,14 +4,15 @@
 
 name=bzip2
 version=1.0.6
-release=2
+release=3
 source=(http://www.bzip.org/$version/$name-$version.tar.gz \
-        $name.patch)
+        $name.patch CVE-2016-3189.patch)
 
 build() {
 	cd $name-$version
 
 	patch -Np1 -i $SRC/$name.patch
+	patch -p1 -i $SRC/CVE-2016-3189.patch
 
 	make
 	make PREFIX=$PKG/usr install