4 files changed, 10 insertions, 282 deletions

diff --git a/security/gnupg/Makefile b/security/gnupg/Makefile
index 0e3bb000ac9d..b49661aa1174 100644
--- a/security/gnupg/Makefile
+++ b/security/gnupg/Makefile
@@ -6,8 +6,7 @@
 #
 
 PORTNAME=	gnupg
-PORTVERSION=	2.0.1
-PORTREVISION=	1
+PORTVERSION=	2.0.2
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_GNUPG}
 MASTER_SITE_SUBDIR=	gnupg
@@ -32,8 +31,8 @@ USE_ICONV=	YES
 USE_LDCONFIG=	YES
 USE_GETTEXT=	YES
 CONFIGURE_TARGET=# empty
-CONFIGURE_ARGS+=	--infodir=${PREFIX}/info --mandir=${PREFIX}/man \
-	--enable-nls
+CONFIGURE_ARGS+=	--infodir=${PREFIX}/info --mandir=${PREFIX}/man
+CONFIGURE_ARGS+=	--enable-nls
 MAN1=		gpg2.1 gpgsm.1 gpgv2.1 gpg-agent.1 scdaemon.1 watchgnupg.1 \
 		gpgconf.1 gpg-preset-passphrase.1 gpg-connect-agent.1 \
 		gpgparsemail.1 symcryptrun.1 gpgsm-gencert.sh.1
@@ -41,10 +40,10 @@ MAN8=		addgnupghome.8
 INFO=		gnupg
 
 OPTIONS=	LDAP "LDAP keyserver interface" off \
-		NLS "National Language Support" off \
 		SCDAEMON "Enable Smartcard daemon (with libusb)" off \
 		CURL "Use the real curl library (worked around if no)" on \
 		GPGSM "Enable GPGSM" on
+#OPTIONS+=	NLS "National Language Support" off
 
 .include <bsd.port.pre.mk>
 
diff --git a/security/gnupg/distinfo b/security/gnupg/distinfo
index c46fb4722345..542d4955b8a3 100644
--- a/security/gnupg/distinfo
+++ b/security/gnupg/distinfo
@@ -1,6 +1,6 @@
-MD5 (gnupg-2.0.1.tar.bz2) = eb24e258db73f4cb53a3ce18375efa21
-SHA256 (gnupg-2.0.1.tar.bz2) = 49949762a4e080379dcca23948442d50488f0d74e04bcba87fc49e19a899b01d
-SIZE (gnupg-2.0.1.tar.bz2) = 3923924
-MD5 (gnupg-2.0.1.tar.bz2.sig) = 58b1bbc2f34c0882ab1a49542a8ffd45
-SHA256 (gnupg-2.0.1.tar.bz2.sig) = 2e49d6cfcb9ad12bc10e7185435761622c2da12b850c6c31925da3b4c8100628
-SIZE (gnupg-2.0.1.tar.bz2.sig) = 158
+MD5 (gnupg-2.0.2.tar.bz2) = 9f972c78135a7dea1bae66bb9f263980
+SHA256 (gnupg-2.0.2.tar.bz2) = 10da9a7adadedaa4a9bba8ed936e0421526eea3ea7b63081273d7aa740b3bef9
+SIZE (gnupg-2.0.2.tar.bz2) = 3969476
+MD5 (gnupg-2.0.2.tar.bz2.sig) = a2bde7013f6fa047e617088bbdc29d7b
+SHA256 (gnupg-2.0.2.tar.bz2.sig) = 87dafb0a150f0a7b1aecb97de1ca6622caa4e2d0644925651597489054717286
+SIZE (gnupg-2.0.2.tar.bz2.sig) = 158
diff --git a/security/gnupg/files/patch-CVE-2006-6235 b/security/gnupg/files/patch-CVE-2006-6235
deleted file mode 100644
index c1692572cafc..000000000000
--- a/security/gnupg/files/patch-CVE-2006-6235
+++ /dev/null
@@ -1,260 +0,0 @@
-This is a patch against GnuPG 2.0.1. Change the directory to g10/ and
-apply this patch.
-
-2006-12-02  Werner Koch  <wk@g10code.com>
-
-	* encr-data.c: Allocate DFX context on the heap and not on the
-	stack.  Changes at several places.  Fixes CVE-2006-6235.
-	
-
-Index: g10/encr-data.c
-===================================================================
---- g10/encr-data.c	(revision 4352)
-+++ g10/encr-data.c	(working copy)
-@@ -39,16 +39,37 @@
- static int decode_filter ( void *opaque, int control, IOBUF a,
- 					byte *buf, size_t *ret_len);
- 
--typedef struct 
-+typedef struct decode_filter_context_s
- {
-   gcry_cipher_hd_t cipher_hd;
-   gcry_md_hd_t mdc_hash;
-   char defer[22];
-   int  defer_filled;
-   int  eof_seen;
--} decode_filter_ctx_t;
-+  int  refcount;
-+} *decode_filter_ctx_t;
- 
- 
-+/* Helper to release the decode context.  */
-+static void
-+release_dfx_context (decode_filter_ctx_t dfx)
-+{
-+  if (!dfx)
-+    return;
-+
-+  assert (dfx->refcount);
-+  if ( !--dfx->refcount )
-+    {
-+      gcry_cipher_close (dfx->cipher_hd);
-+      dfx->cipher_hd = NULL;
-+      gcry_md_close (dfx->mdc_hash);
-+      dfx->mdc_hash = NULL;
-+      xfree (dfx);
-+    }
-+}
-+
-+
-+
- /****************
-  * Decrypt the data, specified by ED with the key DEK.
-  */
-@@ -62,7 +83,11 @@
-   unsigned blocksize;
-   unsigned nprefix;
-   
--  memset( &dfx, 0, sizeof dfx );
-+  dfx = xtrycalloc (1, sizeof *dfx);
-+  if (!dfx)
-+    return gpg_error_from_syserror ();
-+  dfx->refcount = 1;
-+
-   if ( opt.verbose && !dek->algo_info_printed )
-     {
-       const char *s = gcry_cipher_algo_name (dek->algo);
-@@ -77,20 +102,20 @@
-     goto leave;
-   blocksize = gcry_cipher_get_algo_blklen (dek->algo);
-   if ( !blocksize || blocksize > 16 )
--    log_fatal("unsupported blocksize %u\n", blocksize );
-+    log_fatal ("unsupported blocksize %u\n", blocksize );
-   nprefix = blocksize;
-   if ( ed->len && ed->len < (nprefix+2) )
-     BUG();
- 
-   if ( ed->mdc_method ) 
-     {
--      if (gcry_md_open (&dfx.mdc_hash, ed->mdc_method, 0 ))
-+      if (gcry_md_open (&dfx->mdc_hash, ed->mdc_method, 0 ))
-         BUG ();
-       if ( DBG_HASHING )
--        gcry_md_start_debug (dfx.mdc_hash, "checkmdc");
-+        gcry_md_start_debug (dfx->mdc_hash, "checkmdc");
-     }
- 
--  rc = gcry_cipher_open (&dfx.cipher_hd, dek->algo,
-+  rc = gcry_cipher_open (&dfx->cipher_hd, dek->algo,
-                          GCRY_CIPHER_MODE_CFB,
-                          (GCRY_CIPHER_SECURE
-                           | ((ed->mdc_method || dek->algo >= 100)?
-@@ -104,7 +129,7 @@
- 
- 
-   /* log_hexdump( "thekey", dek->key, dek->keylen );*/
--  rc = gcry_cipher_setkey (dfx.cipher_hd, dek->key, dek->keylen);
-+  rc = gcry_cipher_setkey (dfx->cipher_hd, dek->key, dek->keylen);
-   if ( gpg_err_code (rc) == GPG_ERR_WEAK_KEY )
-     {
-       log_info(_("WARNING: message was encrypted with"
-@@ -123,7 +148,7 @@
-       goto leave;
-     }
- 
--  gcry_cipher_setiv (dfx.cipher_hd, NULL, 0);
-+  gcry_cipher_setiv (dfx->cipher_hd, NULL, 0);
- 
-   if ( ed->len )
-     {
-@@ -144,8 +169,8 @@
-           temp[i] = c;
-     }
-   
--  gcry_cipher_decrypt (dfx.cipher_hd, temp, nprefix+2, NULL, 0);
--  gcry_cipher_sync (dfx.cipher_hd);
-+  gcry_cipher_decrypt (dfx->cipher_hd, temp, nprefix+2, NULL, 0);
-+  gcry_cipher_sync (dfx->cipher_hd);
-   p = temp;
-   /* log_hexdump( "prefix", temp, nprefix+2 ); */
-   if (dek->symmetric
-@@ -155,17 +180,18 @@
-       goto leave;
-     }
-   
--  if ( dfx.mdc_hash )
--    gcry_md_write (dfx.mdc_hash, temp, nprefix+2);
--  
-+  if ( dfx->mdc_hash )
-+    gcry_md_write (dfx->mdc_hash, temp, nprefix+2);
-+
-+  dfx->refcount++;
-   if ( ed->mdc_method )
--    iobuf_push_filter( ed->buf, mdc_decode_filter, &dfx );
-+    iobuf_push_filter ( ed->buf, mdc_decode_filter, dfx );
-   else
--    iobuf_push_filter( ed->buf, decode_filter, &dfx );
-+    iobuf_push_filter ( ed->buf, decode_filter, dfx );
- 
-   proc_packets ( procctx, ed->buf );
-   ed->buf = NULL;
--  if ( ed->mdc_method && dfx.eof_seen == 2 )
-+  if ( ed->mdc_method && dfx->eof_seen == 2 )
-     rc = gpg_error (GPG_ERR_INV_PACKET);
-   else if ( ed->mdc_method )
-     { 
-@@ -184,26 +210,28 @@
-          bytes are appended.  */
-       int datalen = gcry_md_get_algo_dlen (ed->mdc_method);
- 
--      gcry_cipher_decrypt (dfx.cipher_hd, dfx.defer, 22, NULL, 0);
--      gcry_md_write (dfx.mdc_hash, dfx.defer, 2);
--      gcry_md_final (dfx.mdc_hash);
-+      assert (dfx->cipher_hd);
-+      assert (dfx->mdc_hash);
-+      gcry_cipher_decrypt (dfx->cipher_hd, dfx->defer, 22, NULL, 0);
-+      gcry_md_write (dfx->mdc_hash, dfx->defer, 2);
-+      gcry_md_final (dfx->mdc_hash);
- 
--      if (dfx.defer[0] != '\xd3' || dfx.defer[1] != '\x14' )
-+      if (dfx->defer[0] != '\xd3' || dfx->defer[1] != '\x14' )
-         {
-           log_error("mdc_packet with invalid encoding\n");
-           rc = gpg_error (GPG_ERR_INV_PACKET);
-         }
-       else if (datalen != 20
--               || memcmp (gcry_md_read (dfx.mdc_hash, 0),dfx.defer+2,datalen))
-+               || memcmp (gcry_md_read (dfx->mdc_hash, 0),
-+                          dfx->defer+2,datalen ))
-         rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
--      /* log_printhex("MDC message:", dfx.defer, 22); */
--      /* log_printhex("MDC calc:", gcry_md_read (dfx.mdc_hash,0), datalen); */
-+      /* log_printhex("MDC message:", dfx->defer, 22); */
-+      /* log_printhex("MDC calc:", gcry_md_read (dfx->mdc_hash,0), datalen); */
-     }
-   
-   
-  leave:
--  gcry_cipher_close (dfx.cipher_hd);
--  gcry_md_close (dfx.mdc_hash);
-+  release_dfx_context (dfx);
-   return rc;
- }
- 
-@@ -214,7 +242,7 @@
- mdc_decode_filter (void *opaque, int control, IOBUF a,
-                    byte *buf, size_t *ret_len)
- {
--  decode_filter_ctx_t *dfx = opaque;
-+  decode_filter_ctx_t dfx = opaque;
-   size_t n, size = *ret_len;
-   int rc = 0;
-   int c;
-@@ -226,11 +254,11 @@
-     }
-   else if( control == IOBUFCTRL_UNDERFLOW )
-     {
--      assert(a);
--      assert( size > 44 );
-+      assert (a);
-+      assert ( size > 44 );
-       
-       /* Get at least 22 bytes and put it somewhere ahead in the buffer. */
--      for(n=22; n < 44 ; n++ )
-+      for (n=22; n < 44 ; n++ )
-         {
-           if( (c = iobuf_get(a)) == -1 )
-             break;
-@@ -279,8 +307,10 @@
- 
-       if ( n )
-         {
--          gcry_cipher_decrypt (dfx->cipher_hd, buf, n, NULL, 0);
--          gcry_md_write (dfx->mdc_hash, buf, n);
-+          if ( dfx->cipher_hd )
-+            gcry_cipher_decrypt (dfx->cipher_hd, buf, n, NULL, 0);
-+          if ( dfx->mdc_hash )
-+            gcry_md_write (dfx->mdc_hash, buf, n);
- 	}
-       else
-         {
-@@ -289,6 +319,10 @@
- 	}
-       *ret_len = n;
-     }
-+  else if ( control == IOBUFCTRL_FREE ) 
-+    {
-+      release_dfx_context (dfx);
-+    }
-   else if ( control == IOBUFCTRL_DESC ) 
-     {
-       *(char**)buf = "mdc_decode_filter";
-@@ -300,7 +334,7 @@
- static int
- decode_filter( void *opaque, int control, IOBUF a, byte *buf, size_t *ret_len)
- {
--  decode_filter_ctx_t *fc = opaque;
-+  decode_filter_ctx_t fc = opaque;
-   size_t n, size = *ret_len;
-   int rc = 0;
-   
-@@ -311,11 +345,18 @@
-       if ( n == -1 )
-         n = 0;
-       if ( n )
--        gcry_cipher_decrypt (fc->cipher_hd, buf, n, NULL, 0);
-+        {
-+          if (fc->cipher_hd)
-+            gcry_cipher_decrypt (fc->cipher_hd, buf, n, NULL, 0);
-+        }
-       else
-         rc = -1; /* EOF */
-       *ret_len = n;
-     }
-+  else if ( control == IOBUFCTRL_FREE ) 
-+    {
-+      release_dfx_context (fc);
-+    }
-   else if ( control == IOBUFCTRL_DESC )
-     {
-       *(char**)buf = "decode_filter";
diff --git a/security/gnupg/files/patch-tools:Makefile.in b/security/gnupg/files/patch-tools:Makefile.in
deleted file mode 100644
index 98683c9441f0..000000000000
--- a/security/gnupg/files/patch-tools:Makefile.in
+++ /dev/null
@@ -1,11 +0,0 @@
---- tools/Makefile.in.orig	Mon Dec 25 11:52:16 2006
-+++ tools/Makefile.in	Mon Dec 25 11:53:00 2006
-@@ -453,7 +453,7 @@
- @BUILD_SYMCRYPTRUN_TRUE@symcryptrun = symcryptrun
- common_libs = ../jnlib/libjnlib.a ../common/libcommon.a ../gl/libgnu.a
- pwquery_libs = ../common/libsimple-pwquery.a
--gpgsplit_LDADD = $(common_libs) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) $(ZLIBS)
-+gpgsplit_LDADD = $(common_libs) $(LIBINTL) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) $(ZLIBS)
- gpgconf_SOURCES = gpgconf.c gpgconf.h gpgconf-comp.c no-libgcrypt.c
- 
- # jnlib/common sucks in gpg-error, will they, nil they (some compilers