gnu: icecat: Add several security fixes.

* gnu/packages/patches/icecat-CVE-2015-4513-pt01.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt02.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt03.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt04.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt05.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt06.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt07.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt08.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt09.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt10.patch,
  gnu/packages/patches/icecat-CVE-2015-4513-pt11.patch,
  gnu/packages/patches/icecat-CVE-2015-7188.patch,
  gnu/packages/patches/icecat-CVE-2015-7189.patch,
  gnu/packages/patches/icecat-CVE-2015-7193.patch,
  gnu/packages/patches/icecat-CVE-2015-7194.patch,
  gnu/packages/patches/icecat-CVE-2015-7196.patch,
  gnu/packages/patches/icecat-CVE-2015-7197.patch,
  gnu/packages/patches/icecat-CVE-2015-7198.patch,
  gnu/packages/patches/icecat-CVE-2015-7199.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patches.

1 files changed, 143 insertions, 0 deletions

diff --git a/gnu/packages/patches/icecat-CVE-2015-7189.patch b/gnu/packages/patches/icecat-CVE-2015-7189.patch
new file mode 100644
index 0000000000..329d1b6f1f
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7189.patch
@@ -0,0 +1,143 @@
+From 377e1cefec0fcf230caafb97b4414c835d27c7fe Mon Sep 17 00:00:00 2001
+From: Milan Sreckovic <milan@mozilla.com>
+Date: Fri, 2 Oct 2015 09:18:26 +0200
+Subject: [PATCH] Bug 1205900 - Compare context and canvas element sizes before
+ extracting the data. r=gwright, a=al
+
+--HG--
+extra : source : f6c99c8baa9b0b6a34d6791e5d4031a2de8f2087
+---
+ dom/canvas/CanvasRenderingContext2D.cpp        |  2 --
+ dom/canvas/CanvasRenderingContext2D.h          |  7 +++----
+ dom/canvas/WebGLContext.cpp                    |  2 --
+ dom/canvas/WebGLContext.h                      |  3 +--
+ dom/canvas/nsICanvasRenderingContextInternal.h |  8 +++-----
+ dom/html/HTMLCanvasElement.cpp                 | 13 +++++++------
+ 6 files changed, 14 insertions(+), 21 deletions(-)
+
+diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
+index d9eaf99..a06fbce 100644
+--- a/dom/canvas/CanvasRenderingContext2D.cpp
++++ b/dom/canvas/CanvasRenderingContext2D.cpp
+@@ -1418,7 +1418,6 @@ CanvasRenderingContext2D::EnsureTarget(RenderingMode aRenderingMode)
+   return mode;
+ }
+ 
+-#ifdef DEBUG
+ int32_t
+ CanvasRenderingContext2D::GetWidth() const
+ {
+@@ -1430,7 +1429,6 @@ CanvasRenderingContext2D::GetHeight() const
+ {
+   return mHeight;
+ }
+-#endif
+ 
+ NS_IMETHODIMP
+ CanvasRenderingContext2D::SetDimensions(int32_t width, int32_t height)
+diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
+index af29c78..e853987 100644
+--- a/dom/canvas/CanvasRenderingContext2D.h
++++ b/dom/canvas/CanvasRenderingContext2D.h
+@@ -481,10 +481,9 @@ public:
+ 
+   nsresult Redraw();
+ 
+-#ifdef DEBUG
+-    virtual int32_t GetWidth() const override;
+-    virtual int32_t GetHeight() const override;
+-#endif
++  virtual int32_t GetWidth() const override;
++  virtual int32_t GetHeight() const override;
++
+   // nsICanvasRenderingContextInternal
+   /**
+     * Gets the pres shell from either the canvas element or the doc shell
+diff --git a/dom/canvas/WebGLContext.cpp b/dom/canvas/WebGLContext.cpp
+index 1c22c27..f2a620a 100644
+--- a/dom/canvas/WebGLContext.cpp
++++ b/dom/canvas/WebGLContext.cpp
+@@ -463,7 +463,6 @@ WebGLContext::SetContextOptions(JSContext* cx, JS::Handle<JS::Value> options)
+     return NS_OK;
+ }
+ 
+-#ifdef DEBUG
+ int32_t
+ WebGLContext::GetWidth() const
+ {
+@@ -475,7 +474,6 @@ WebGLContext::GetHeight() const
+ {
+     return mHeight;
+ }
+-#endif
+ 
+ /* So there are a number of points of failure here. We might fail based
+  * on EGL vs. WGL, or we might fail to alloc a too-large size, or we
+diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
+index 63c4091..210f341 100644
+--- a/dom/canvas/WebGLContext.h
++++ b/dom/canvas/WebGLContext.h
+@@ -202,10 +202,9 @@ public:
+     NS_DECL_NSIDOMWEBGLRENDERINGCONTEXT
+ 
+     // nsICanvasRenderingContextInternal
+-#ifdef DEBUG
+     virtual int32_t GetWidth() const override;
+     virtual int32_t GetHeight() const override;
+-#endif
++
+     NS_IMETHOD SetDimensions(int32_t width, int32_t height) override;
+     NS_IMETHOD InitializeWithSurface(nsIDocShell*, gfxASurface*, int32_t,
+                                      int32_t) override
+diff --git a/dom/canvas/nsICanvasRenderingContextInternal.h b/dom/canvas/nsICanvasRenderingContextInternal.h
+index 3b1120f..fb1ef7c 100644
+--- a/dom/canvas/nsICanvasRenderingContextInternal.h
++++ b/dom/canvas/nsICanvasRenderingContextInternal.h
+@@ -81,11 +81,9 @@ public:
+     return mCanvasElement;
+   }
+ 
+-#ifdef DEBUG
+-    // Useful for testing
+-    virtual int32_t GetWidth() const = 0;
+-    virtual int32_t GetHeight() const = 0;
+-#endif
++  // Dimensions of the canvas, in pixels.
++  virtual int32_t GetWidth() const = 0;
++  virtual int32_t GetHeight() const = 0;
+ 
+   // Sets the dimensions of the canvas, in pixels.  Called
+   // whenever the size of the element changes.
+diff --git a/dom/html/HTMLCanvasElement.cpp b/dom/html/HTMLCanvasElement.cpp
+index f326662..68649f5 100644
+--- a/dom/html/HTMLCanvasElement.cpp
++++ b/dom/html/HTMLCanvasElement.cpp
+@@ -526,18 +526,19 @@ HTMLCanvasElement::ToBlob(JSContext* aCx,
+     return;
+   }
+ 
+-#ifdef DEBUG
+   if (mCurrentContext) {
+     // We disallow canvases of width or height zero, and set them to 1, so
+     // we will have a discrepancy with the sizes of the canvas and the context.
+     // That discrepancy is OK, the rest are not.
+     nsIntSize elementSize = GetWidthHeight();
+-    MOZ_ASSERT(elementSize.width == mCurrentContext->GetWidth() ||
+-               (elementSize.width == 0 && mCurrentContext->GetWidth() == 1));
+-    MOZ_ASSERT(elementSize.height == mCurrentContext->GetHeight() ||
+-               (elementSize.height == 0 && mCurrentContext->GetHeight() == 1));
++    if ((elementSize.width != mCurrentContext->GetWidth() &&
++         (elementSize.width != 0 || mCurrentContext->GetWidth() != 1)) ||
++        (elementSize.height != mCurrentContext->GetHeight() &&
++         (elementSize.height != 0 || mCurrentContext->GetHeight() != 1))) {
++    aRv.Throw(NS_ERROR_FAILURE);
++    return;
++    }
+   }
+-#endif
+ 
+   uint8_t* imageBuffer = nullptr;
+   int32_t format = 0;
+-- 
+2.5.0
+