@@ -, +, @@ 
  http://security.ubuntu.com/ubuntu/pool/main/libw/libwmf/libwmf_0.2.8.3-3.1ubuntu0.2.diff.gz
---
 graphics/libwmf/Makefile                  |    2 +-
 graphics/libwmf/files/patch-cve-2006-3376 |   30 +++++++++++++++++++++++++++++
 graphics/libwmf/files/patch-cve-2009-1364 |   14 +++++++++++++
 3 files changed, 45 insertions(+), 1 deletions(-)
 create mode 100644 graphics/libwmf/files/patch-cve-2006-3376
 create mode 100644 graphics/libwmf/files/patch-cve-2009-1364
--- b/graphics/libwmf/Makefile	
+++ b/graphics/libwmf/Makefile	
@@ -7,7 +7,7 @@ 
 
 PORTNAME=	libwmf
 PORTVERSION=	0.2.8.4
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	graphics
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=	wvware
--- /dev/null	
+++ b/graphics/libwmf/files/patch-cve-2006-3376	
@@ -0,0 +1,30 @@ 
+Fix for CVE-2006-3376.
+
+Obtained from: Ubuntu
+--- src/player.c
++++ src/player.c
+@@ -23,6 +23,7 @@
+ 
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <stdint.h>
+ #include <string.h>
+ #include <math.h>
+ 
+@@ -132,8 +133,14 @@
+ 		}
+ 	}
+ 
+-/*	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char));
+- */	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)  ) * 2 * sizeof (unsigned char));
++	if (MAX_REC_SIZE(API) > UINT32_MAX / 2)
++	{
++		API->err = wmf_E_InsMem;
++		WMF_DEBUG (API,"bailing...");
++		return (API->err);
++	}
++
++ 	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)  ) * 2 * sizeof (unsigned char));
+ 
+ 	if (ERR (API))
+ 	{	WMF_DEBUG (API,"bailing...");
--- /dev/null	
+++ b/graphics/libwmf/files/patch-cve-2009-1364	
@@ -0,0 +1,14 @@ 
+Patch for CVE-2009-1364
+
+Obtained from: Ubuntu
+
+--- src/extra/gd/gd_clip.c
++++ src/extra/gd/gd_clip.c
+@@ -70,6 +70,7 @@
+ 	{	more = gdRealloc (im->clip->list,(im->clip->max + 8) * sizeof (gdClipRectangle));
+ 		if (more == 0) return;
+ 		im->clip->max += 8;
++		im->clip->list = more;
+ 	}
+ 	im->clip->list[im->clip->count] = (*rect);
+ 	im->clip->count++;
--