summaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/automake-regexp-syntax.patch34
-rw-r--r--gnu/packages/patches/doxygen-test.patch4
-rw-r--r--gnu/packages/patches/doxygen-tmake.patch24
-rw-r--r--gnu/packages/patches/emacs-source-date-epoch.patch20
-rw-r--r--gnu/packages/patches/findutils-absolute-paths.patch29
-rw-r--r--gnu/packages/patches/findutils-test-xargs.patch22
-rw-r--r--gnu/packages/patches/flex-bison-tests.patch24
-rw-r--r--gnu/packages/patches/gawk-fts-test.patch51
-rw-r--r--gnu/packages/patches/gnutls-doc-fix.patch546
-rw-r--r--gnu/packages/patches/grep-CVE-2015-1345.patch17
-rw-r--r--gnu/packages/patches/grep-timing-sensitive-test.patch15
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch34
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch33
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch308
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch47
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch51
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch170
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch56
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch48
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch189
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch33
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch183
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch91
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch34
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch83
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch35
-rw-r--r--gnu/packages/patches/icecat-CVE-2016-1935.patch77
-rw-r--r--gnu/packages/patches/icecat-bug-1146335-pt1.patch141
-rw-r--r--gnu/packages/patches/icecat-bug-1146335-pt2.patch43
-rw-r--r--gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch73
-rw-r--r--gnu/packages/patches/libarchive-bsdtar-test.patch74
-rw-r--r--gnu/packages/patches/librsvg-tests.patch27
-rw-r--r--gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch107
-rw-r--r--gnu/packages/patches/libtiff-oob-accesses-in-decode.patch171
-rw-r--r--gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch49
-rw-r--r--gnu/packages/patches/perl-CVE-2015-8607.patch68
-rw-r--r--gnu/packages/patches/perl-deterministic-ordering.patch29
-rwxr-xr-x[-rw-r--r--]gnu/packages/patches/perl-module-pluggable-search.patch16
-rw-r--r--gnu/packages/patches/perl-no-build-time.patch26
-rw-r--r--gnu/packages/patches/perl-no-sys-dirs.patch152
-rw-r--r--gnu/packages/patches/perl-source-date-epoch.patch19
-rw-r--r--gnu/packages/patches/procps-make-3.82.patch14
-rw-r--r--gnu/packages/patches/python-2.7-search-paths.patch6
-rw-r--r--gnu/packages/patches/python-3-search-paths.patch6
44 files changed, 2555 insertions, 724 deletions
diff --git a/gnu/packages/patches/automake-regexp-syntax.patch b/gnu/packages/patches/automake-regexp-syntax.patch
new file mode 100644
index 0000000000..2e965c8c50
--- /dev/null
+++ b/gnu/packages/patches/automake-regexp-syntax.patch
@@ -0,0 +1,34 @@
+From <https://lists.gnu.org/archive/html/automake-patches/2015-07/msg00000.html>.
+See also <http://bugs.gnu.org/22372>.
+
+From 34163794a58b5bd91c5d6bd9adf5437571c7a479 Mon Sep 17 00:00:00 2001
+From: Pavel Raiskup <[email protected]>
+Date: Tue, 7 Jul 2015 10:54:24 +0200
+Subject: [PATCH] bin/automake: escape '{' in regexp pattern
+
+Based on perlre(1) documentation:
+.. in Perl v5.26, literal uses of a curly bracket will be required
+to be escaped, say by preceding them with a backslash ("\{" ) or
+enclosing them within square brackets ("[{]") ..
+
+References:
+https://bugzilla.redhat.com/1239379
+
+* bin/automake.in (substitute_ac_subst_variables): Escape the
+occurrence of '{' character.
+---
+ bin/automake.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bin/automake.in b/bin/automake.in
+index 0c29184..c294ced 100644
+--- a/bin/automake.in
++++ b/bin/automake.in
+@@ -3898,7 +3898,7 @@ sub substitute_ac_subst_variables_worker
+ sub substitute_ac_subst_variables
+ {
+ my ($text) = @_;
+- $text =~ s/\${([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge;
++ $text =~ s/\$\{([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge;
+ return $text;
+ }
diff --git a/gnu/packages/patches/doxygen-test.patch b/gnu/packages/patches/doxygen-test.patch
index 7a7f4e963f..5ac063adbf 100644
--- a/gnu/packages/patches/doxygen-test.patch
+++ b/gnu/packages/patches/doxygen-test.patch
@@ -31,8 +31,8 @@ diff -u -r doxygen-1.8.7.orig/testing/012/indexpage.xml doxygen-1.8.7/testing/01
<title>My Project</title>
<detaileddescription>
- <para>See <ref refid="citelist_1CITEREF_knuth79" kindref="member">[1]</ref> for more info. </para>
-+ <para>See <ref refid="citelist_1CITEREF_knuth79" kindref="member">knuth79</ref> for more info. </para>
++ <para>See knuth79 for more info. </para>
</detaileddescription>
</compounddef>
</doxygen>
-Nur in doxygen-1.8.7/testing: test_output_012.
+
diff --git a/gnu/packages/patches/doxygen-tmake.patch b/gnu/packages/patches/doxygen-tmake.patch
deleted file mode 100644
index 3579243702..0000000000
--- a/gnu/packages/patches/doxygen-tmake.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Fix the `check_unix' function, which looks for `/bin/uname' to determine
-whether we're on a Unix-like system.
-Taken from nixpkgs.
-
---- doxygen-1.5.8/tmake/bin/tmake 2008-12-06 14:16:20.000000000 +0100
-+++ doxygen-1.5.8/tmake/bin/tmake 2009-03-05 11:29:55.000000000 +0100
-@@ -234,17 +234,7 @@ sub tmake_verb {
- #
-
- sub check_unix {
-- my($r);
-- $r = 0;
-- if ( -f "/bin/uname" ) {
-- $r = 1;
-- (-f "\\bin\\uname") && ($r = 0);
-- }
-- if ( -f "/usr/bin/uname" ) {
-- $r = 1;
-- (-f "\\usr\\bin\\uname") && ($r = 0);
-- }
-- return $r;
-+ return 1;
- }
-
diff --git a/gnu/packages/patches/emacs-source-date-epoch.patch b/gnu/packages/patches/emacs-source-date-epoch.patch
new file mode 100644
index 0000000000..41c03ef514
--- /dev/null
+++ b/gnu/packages/patches/emacs-source-date-epoch.patch
@@ -0,0 +1,20 @@
+Honor SOURCE_DATE_EPOCH variable to avoid non-determinism in generated
+"autoloads" files.
+
+--- a/lisp/emacs-lisp/autoload.el
++++ b/lisp/emacs-lisp/autoload.el
+@@ -378,8 +378,12 @@
+ "Insert the section-header line,
+ which lists the file name and which functions are in it, etc."
+ (insert generate-autoload-section-header)
+- (prin1 `(autoloads ,autoloads ,load-name ,file ,time)
+- outbuf)
++ (let* ((env (getenv "SOURCE_DATE_EPOCH"))
++ (time (if env
++ (seconds-to-time (string-to-number env))
++ time)))
++ (prin1 `(autoloads ,autoloads ,load-name ,file ,time)
++ outbuf))
+ (terpri outbuf)
+ ;; Break that line at spaces, to avoid very long lines.
+ ;; Make each sub-line into a comment.
diff --git a/gnu/packages/patches/findutils-absolute-paths.patch b/gnu/packages/patches/findutils-absolute-paths.patch
deleted file mode 100644
index 96341e281f..0000000000
--- a/gnu/packages/patches/findutils-absolute-paths.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-Fix use of LFS-style absolute paths.
-
-Patches from Nixpkgs by Armijn Hemel <[email protected]>
-and Wouter den Breejen <[email protected]>.
-
-diff -ruN findutils-4.2.20/locate/updatedb.sh findutils-4.2.20.new/locate/updatedb.sh
---- findutils-4.2.20/locate/updatedb.sh 2005-01-24 17:12:35.000000000 +0100
-+++ findutils-4.2.20.new/locate/updatedb.sh 2005-08-23 14:37:10.000000000 +0200
-@@ -141,7 +141,7 @@
- : ${code:=${LIBEXECDIR}/@code@}
-
-
--PATH=/bin:/usr/bin:${BINDIR}; export PATH
-+PATH=/bin:/usr/bin:${BINDIR}:${PATH}; export PATH
-
- : ${PRUNEFS="nfs NFS proc afs proc smbfs autofs iso9660 ncpfs coda devpts ftpfs devfs mfs sysfs shfs"}
-
-diff -Naur findutils-4.2.30/xargs/xargs.c findutils-4.2.30_new/xargs/xargs.c
---- findutils-4.2.30/xargs/xargs.c 2007-02-27 11:21:08.000000000 +0100
-+++ findutils-4.2.30_new/xargs/xargs.c 2007-07-17 19:02:05.000000000 +0200
-@@ -402,7 +402,7 @@
- int show_limits = 0; /* --show-limits */
- int always_run_command = 1;
- char *input_file = "-"; /* "-" is stdin */
-- char *default_cmd = "/bin/echo";
-+ char *default_cmd = "echo";
- int (*read_args) PARAMS ((void)) = read_line;
- void (*act_on_init_result)(void) = noop;
- int env_too_big = 0;
diff --git a/gnu/packages/patches/findutils-test-xargs.patch b/gnu/packages/patches/findutils-test-xargs.patch
new file mode 100644
index 0000000000..10c7bed28d
--- /dev/null
+++ b/gnu/packages/patches/findutils-test-xargs.patch
@@ -0,0 +1,22 @@
+This test relies on 'xargs' being available in $PATH, which is not
+the case when we build the initial Findutils doing bootstrapping.
+Reported at <https://savannah.gnu.org/bugs/index.php?46786>.
+
+--- findutils-4.6.0/find/testsuite/sv-34976-execdir-fd-leak.sh 2015-12-31 19:37:59.401526288 +0100
++++ findutils-4.6.0/find/testsuite/sv-34976-execdir-fd-leak.sh 2015-12-31 19:38:36.061770693 +0100
+@@ -50,13 +50,14 @@ die() {
+ # Create test files, each 98 in the directories ".", "one" and "two".
+ make_test_data() {
+ d="$1"
++ xargs="`cd ../../xargs; pwd -P`/xargs"
+ (
+ cd "$1" || exit 1
+ mkdir one two || exit 1
+ for i in ${three_to_hundred} ; do
+ printf "./%03d one/%03d two/%03d " $i $i $i
+ done \
+- | xargs touch || exit 1
++ | "$xargs" touch || exit 1
+ ) \
+ || die "failed to set up the test in ${outdir}"
+ }
diff --git a/gnu/packages/patches/flex-bison-tests.patch b/gnu/packages/patches/flex-bison-tests.patch
deleted file mode 100644
index 0f372f83bf..0000000000
--- a/gnu/packages/patches/flex-bison-tests.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-The `test-bison-yyl{loc,val}' tests fail with "conflicting types for
-'testparse'" because `YYPARSE_PARAM' is undefined; work around that.
-
---- flex-2.5.37/tests/test-bison-yylloc/main.c 2012-11-22 18:17:01.000000000 +0100
-+++ flex-2.5.37/tests/test-bison-yylloc/main.c 2012-11-22 18:17:07.000000000 +0100
-@@ -21,6 +21,7 @@
- * PURPOSE.
- */
-
-+#define YYPARSE_PARAM scanner
- #include "parser.h"
- #include "scanner.h"
-
-
---- flex-2.5.37/tests/test-bison-yylval/main.c 2012-11-22 18:17:42.000000000 +0100
-+++ flex-2.5.37/tests/test-bison-yylval/main.c 2012-11-22 18:17:49.000000000 +0100
-@@ -21,6 +21,7 @@
- * PURPOSE.
- */
-
-+#define YYPARSE_PARAM scanner
- #include "parser.h"
- #include "scanner.h"
-
diff --git a/gnu/packages/patches/gawk-fts-test.patch b/gnu/packages/patches/gawk-fts-test.patch
new file mode 100644
index 0000000000..de1f5c431c
--- /dev/null
+++ b/gnu/packages/patches/gawk-fts-test.patch
@@ -0,0 +1,51 @@
+This is upstream commit c9a018c. We have observed random failures of
+this test on i686 that seem related to load.
+
+2015-05-21 Arnold D. Robbins <[email protected]>
+
+ * fts.awk: Really remove atime from the output.
+ This avoids spurious failures on heavily loaded systems.
+
+diff --git a/test/fts.awk b/test/fts.awk
+index b1df060..dea5b68 100644
+--- a/test/fts.awk
++++ b/test/fts.awk
+@@ -50,6 +50,11 @@ function sort_traverse(data, sorted, i)
+ {
+ asorti(data, sorted)
+ for (i = 1; i in sorted; i++) {
++ # 5/2015: skip for atime, since there can
++ # occasionally be small differences.
++ if (sorted[i] == "atime")
++ continue
++
+ indent()
+ printf("%s --> %s\n", sorted[i], data[sorted[i]]) > output
+ }
+@@ -63,17 +68,20 @@ function traverse(data, i)
+ printf("%s:\n", i) > output
+
+ Level++
+- if (("mtime" in data[i]) && ! isarray(data[i][mtime])) {
++ if (("mtime" in data[i]) && ! isarray(data[i]["mtime"])) {
+ sort_traverse(data[i])
+ } else {
+ traverse(data[i])
+ }
+ Level--
+- } else if (data[i] != "atime") {
+- # 4/2015: skip for atime, since there can
+- # occasionally be small differences.
+- indent()
+- printf("%s --> %s\n", i, data[i]) > output
++# } else {
++# JUNK = 1
++# if (i != "atime") {
++# # 4/2015: skip for atime, since there can
++# # occasionally be small differences.
++# indent()
++# printf("%s --> %s\n", i, data[i]) > output
++# }
+ }
+ }
+ }
diff --git a/gnu/packages/patches/gnutls-doc-fix.patch b/gnu/packages/patches/gnutls-doc-fix.patch
deleted file mode 100644
index 170d2468bc..0000000000
--- a/gnu/packages/patches/gnutls-doc-fix.patch
+++ /dev/null
@@ -1,546 +0,0 @@
-diff -ru gnutls-3.4.4/doc/invoke-certtool.texi gnutls-3.4.4.1/doc/invoke-certtool.texi
---- gnutls-3.4.4.1/doc/invoke-certtool.texi 2015-08-10 13:43:52.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-certtool.texi 2015-07-31 15:44:21.000000000 -0400
-@@ -41,7 +41,97 @@
-
- @exampleindent 0
- @example
--certtool is unavailable - no --help
-+certtool - GnuTLS certificate tool
-+Usage: certtool [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -V, --verbose More verbose output
-+ - may appear multiple times
-+ --infile=file Input file
-+ - file must pre-exist
-+ --outfile=str Output file
-+ -s, --generate-self-signed Generate a self-signed certificate
-+ -c, --generate-certificate Generate a signed certificate
-+ --generate-proxy Generates a proxy certificate
-+ --generate-crl Generate a CRL
-+ -u, --update-certificate Update a signed certificate
-+ -p, --generate-privkey Generate a private key
-+ -q, --generate-request Generate a PKCS #10 certificate request
-+ - prohibits the option 'infile'
-+ -e, --verify-chain Verify a PEM encoded certificate chain
-+ --verify Verify a PEM encoded certificate chain using a trusted list
-+ --verify-crl Verify a CRL using a trusted list
-+ - requires the option 'load-ca-certificate'
-+ --generate-dh-params Generate PKCS #3 encoded Diffie-Hellman parameters
-+ --get-dh-params Get the included PKCS #3 encoded Diffie-Hellman parameters
-+ --dh-info Print information PKCS #3 encoded Diffie-Hellman parameters
-+ --load-privkey=str Loads a private key file
-+ --load-pubkey=str Loads a public key file
-+ --load-request=str Loads a certificate request file
-+ --load-certificate=str Loads a certificate file
-+ --load-ca-privkey=str Loads the certificate authority's private key file
-+ --load-ca-certificate=str Loads the certificate authority's certificate file
-+ --password=str Password to use
-+ --null-password Enforce a NULL password
-+ --empty-password Enforce an empty password
-+ --hex-numbers Print big number in an easier format to parse
-+ --cprint In certain operations it prints the information in C-friendly format
-+ -i, --certificate-info Print information on the given certificate
-+ --certificate-pubkey Print certificate's public key
-+ --pgp-certificate-info Print information on the given OpenPGP certificate
-+ --pgp-ring-info Print information on the given OpenPGP keyring structure
-+ -l, --crl-info Print information on the given CRL structure
-+ --crq-info Print information on the given certificate request
-+ --no-crq-extensions Do not use extensions in certificate requests
-+ --p12-info Print information on a PKCS #12 structure
-+ --p12-name=str The PKCS #12 friendly name to use
-+ --p7-info Print information on a PKCS #7 structure
-+ --smime-to-p7 Convert S/MIME to PKCS #7 structure
-+ -k, --key-info Print information on a private key
-+ --pgp-key-info Print information on an OpenPGP private key
-+ --pubkey-info Print information on a public key
-+ --v1 Generate an X.509 version 1 certificate (with no extensions)
-+ -!, --to-p12 Generate a PKCS #12 structure
-+ - requires the option 'load-certificate'
-+ -", --to-p8 Generate a PKCS #8 structure
-+ -8, --pkcs8 Use PKCS #8 format for private keys
-+ -#, --rsa Generate RSA key
-+ -$, --dsa Generate DSA key
-+ -%, --ecc Generate ECC (ECDSA) key
-+ -&, --ecdsa an alias for the 'ecc' option
-+ -', --hash=str Hash algorithm to use for signing
-+ -(, --inder Use DER format for input certificates, private keys, and DH parameters
-+ - disabled as '--no-inder'
-+ -), --inraw an alias for the 'inder' option
-+ -*, --outder Use DER format for output certificates, private keys, and DH parameters
-+ - disabled as '--no-outder'
-+ -+, --outraw an alias for the 'outder' option
-+ -,, --bits=num Specify the number of bits for key generate
-+ --, --curve=str Specify the curve used for EC key generation
-+ -., --sec-param=str Specify the security level [low, legacy, medium, high, ultra]
-+ -/, --disable-quick-random No effect
-+ -0, --template=str Template file to use for non-interactive operation
-+ -1, --stdout-info Print information to stdout instead of stderr
-+ -2, --ask-pass Enable interaction for entering password when in batch mode.
-+ -3, --pkcs-cipher=str Cipher to use for PKCS #8 and #12 operations
-+ -4, --provider=str Specify the PKCS #11 provider library
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+
-+Tool to parse and generate X.509 certificates, requests and private keys.
-+It can be used interactively or non interactively by specifying the
-+template command line option.
-+
-+The tool accepts files or URLs supported by GnuTLS. In case PIN is
-+required for the URL access you can provide it using the environment
-+variables GNUTLS_PIN and GNUTLS_SO_PIN.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-gnutls-cli-debug.texi gnutls-3.4.4.1/doc/invoke-gnutls-cli-debug.texi
---- gnutls-3.4.4.1/doc/invoke-gnutls-cli-debug.texi 2015-08-10 13:43:50.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-gnutls-cli-debug.texi 2015-07-31 15:44:18.000000000 -0400
-@@ -40,7 +40,34 @@
-
- @exampleindent 0
- @example
--gnutls-cli-debug is unavailable - no --help
-+gnutls-cli-debug - GnuTLS debug client
-+Usage: gnutls-cli-debug [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -V, --verbose More verbose output
-+ - may appear multiple times
-+ -p, --port=num The port to connect to
-+ - it must be in the range:
-+ 0 to 65536
-+ --app-proto=str The application protocol to be used to obtain the server's certificate
-+(https, ftp, smtp, imap)
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+Operands and options may be intermixed. They will be reordered.
-+
-+TLS debug client. It sets up multiple TLS connections to a server and
-+queries its capabilities. It was created to assist in debugging GnuTLS,
-+but it might be useful to extract a TLS server's capabilities. It connects
-+to a TLS server, performs tests and print the server's capabilities. If
-+called with the `-v' parameter more checks will be performed. Can be used
-+to check for servers with special needs or bugs.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-gnutls-cli.texi gnutls-3.4.4.1/doc/invoke-gnutls-cli.texi
---- gnutls-3.4.4.1/doc/invoke-gnutls-cli.texi 2015-08-10 13:43:49.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-gnutls-cli.texi 2015-07-31 15:44:17.000000000 -0400
-@@ -36,7 +36,95 @@
-
- @exampleindent 0
- @example
--gnutls-cli is unavailable - no --help
-+gnutls-cli - GnuTLS client
-+Usage: gnutls-cli [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... [hostname]
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -V, --verbose More verbose output
-+ - may appear multiple times
-+ --tofu Enable trust on first use authentication
-+ - disabled as '--no-tofu'
-+ --strict-tofu Fail to connect if a known certificate has changed
-+ - disabled as '--no-strict-tofu'
-+ --dane Enable DANE certificate verification (DNSSEC)
-+ - disabled as '--no-dane'
-+ --local-dns Use the local DNS server for DNSSEC resolving
-+ - disabled as '--no-local-dns'
-+ --ca-verification Disable CA certificate verification
-+ - disabled as '--no-ca-verification'
-+ - enabled by default
-+ --ocsp Enable OCSP certificate verification
-+ - disabled as '--no-ocsp'
-+ -r, --resume Establish a session and resume
-+ -e, --rehandshake Establish a session and rehandshake
-+ -s, --starttls Connect, establish a plain session and start TLS
-+ --app-proto=str an alias for the 'starttls-proto' option
-+ --starttls-proto=str The application protocol to be used to obtain the server's certificate
-+(https, ftp, smtp, imap)
-+ - prohibits the option 'starttls'
-+ -u, --udp Use DTLS (datagram TLS) over UDP
-+ --mtu=num Set MTU for datagram TLS
-+ - it must be in the range:
-+ 0 to 17000
-+ --crlf Send CR LF instead of LF
-+ --x509fmtder Use DER format for certificates to read from
-+ -f, --fingerprint Send the openpgp fingerprint, instead of the key
-+ --print-cert Print peer's certificate in PEM format
-+ --dh-bits=num The minimum number of bits allowed for DH
-+ --priority=str Priorities string
-+ --x509cafile=str Certificate file or PKCS #11 URL to use
-+ --x509crlfile=file CRL file to use
-+ - file must pre-exist
-+ --pgpkeyfile=file PGP Key file to use
-+ - file must pre-exist
-+ --pgpkeyring=file PGP Key ring file to use
-+ - file must pre-exist
-+ --pgpcertfile=file PGP Public Key (certificate) file to use
-+ - file must pre-exist
-+ --x509keyfile=str X.509 key file or PKCS #11 URL to use
-+ --x509certfile=str X.509 Certificate file or PKCS #11 URL to use
-+ --pgpsubkey=str PGP subkey to use (hex or auto)
-+ --srpusername=str SRP username to use
-+ --srppasswd=str SRP password to use
-+ --pskusername=str PSK username to use
-+ --pskkey=str PSK key (in hex) to use
-+ -p, --port=str The port or service to connect to
-+ --insecure Don't abort program if server certificate can't be validated
-+ --ranges Use length-hiding padding to prevent traffic analysis
-+ --benchmark-ciphers Benchmark individual ciphers
-+ --benchmark-tls-kx Benchmark TLS key exchange methods
-+ --benchmark-tls-ciphers Benchmark TLS ciphers
-+ -l, --list Print a list of the supported algorithms and modes
-+ - prohibits the option 'port'
-+ --noticket Don't allow session tickets
-+ -!, --srtp-profiles=str Offer SRTP profiles
-+ -", --alpn=str Application layer protocol
-+ - may appear multiple times
-+ -b, --heartbeat Activate heartbeat support
-+ -#, --recordsize=num The maximum record size to advertize
-+ - it must be in the range:
-+ 0 to 4096
-+ -$, --disable-sni Do not send a Server Name Indication (SNI)
-+ -%, --disable-extensions Disable all the TLS extensions
-+ -&, --inline-commands Inline commands of the form ^<cmd>^
-+ -', --inline-commands-prefix=str Change the default delimiter for inline commands.
-+ -(, --provider=file Specify the PKCS #11 provider library
-+ - file must pre-exist
-+ -), --fips140-mode Reports the status of the FIPS140-2 mode in gnutls library
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+Operands and options may be intermixed. They will be reordered.
-+
-+Simple client program to set up a TLS connection to some other computer. It
-+sets up a TLS connection and forwards data from the standard input to the
-+secured socket and vice versa.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-gnutls-serv.texi gnutls-3.4.4.1/doc/invoke-gnutls-serv.texi
---- gnutls-3.4.4.1/doc/invoke-gnutls-serv.texi 2015-08-10 13:43:51.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-gnutls-serv.texi 2015-07-31 15:44:20.000000000 -0400
-@@ -35,7 +35,69 @@
-
- @exampleindent 0
- @example
--gnutls-serv is unavailable - no --help
-+gnutls-serv - GnuTLS server
-+Usage: gnutls-serv [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ --noticket Don't accept session tickets
-+ -g, --generate Generate Diffie-Hellman and RSA-export parameters
-+ -q, --quiet Suppress some messages
-+ --nodb Do not use a resumption database
-+ --http Act as an HTTP server
-+ --echo Act as an Echo server
-+ -u, --udp Use DTLS (datagram TLS) over UDP
-+ --mtu=num Set MTU for datagram TLS
-+ - it must be in the range:
-+ 0 to 17000
-+ --srtp-profiles=str Offer SRTP profiles
-+ -a, --disable-client-cert Do not request a client certificate
-+ -r, --require-client-cert Require a client certificate
-+ --verify-client-cert If a client certificate is sent then verify it.
-+ -b, --heartbeat Activate heartbeat support
-+ --x509fmtder Use DER format for certificates to read from
-+ --priority=str Priorities string
-+ --dhparams=file DH params file to use
-+ - file must pre-exist
-+ --x509cafile=str Certificate file or PKCS #11 URL to use
-+ --x509crlfile=file CRL file to use
-+ - file must pre-exist
-+ --pgpkeyfile=file PGP Key file to use
-+ - file must pre-exist
-+ --pgpkeyring=file PGP Key ring file to use
-+ - file must pre-exist
-+ --pgpcertfile=file PGP Public Key (certificate) file to use
-+ - file must pre-exist
-+ --x509keyfile=str X.509 key file or PKCS #11 URL to use
-+ --x509certfile=str X.509 Certificate file or PKCS #11 URL to use
-+ --x509dsakeyfile=str Alternative X.509 key file or PKCS #11 URL to use
-+ --x509dsacertfile=str Alternative X.509 Certificate file or PKCS #11 URL to use
-+ --x509ecckeyfile=str Alternative X.509 key file or PKCS #11 URL to use
-+ --x509ecccertfile=str Alternative X.509 Certificate file or PKCS #11 URL to use
-+ --pgpsubkey=str PGP subkey to use (hex or auto)
-+ --srppasswd=file SRP password file to use
-+ - file must pre-exist
-+ --srppasswdconf=file SRP password configuration file to use
-+ - file must pre-exist
-+ --pskpasswd=file PSK password file to use
-+ - file must pre-exist
-+ --pskhint=str PSK identity hint to use
-+ --ocsp-response=file The OCSP response to send to client
-+ - file must pre-exist
-+ -p, --port=num The port to connect to
-+ -l, --list Print a list of the supported algorithms and modes
-+ --provider=file Specify the PKCS #11 provider library
-+ - file must pre-exist
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+
-+Server program that listens to incoming TLS connections.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-ocsptool.texi gnutls-3.4.4.1/doc/invoke-ocsptool.texi
---- gnutls-3.4.4.1/doc/invoke-ocsptool.texi 2015-08-10 13:43:53.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-ocsptool.texi 2015-07-31 15:44:22.000000000 -0400
-@@ -37,7 +37,53 @@
-
- @exampleindent 0
- @example
--ocsptool is unavailable - no --help
-+ocsptool - GnuTLS OCSP tool
-+Usage: ocsptool [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -V, --verbose More verbose output
-+ - may appear multiple times
-+ --infile=file Input file
-+ - file must pre-exist
-+ --outfile=str Output file
-+ --ask[=arg] Ask an OCSP/HTTP server on a certificate validity
-+ - requires these options:
-+ load-cert
-+ load-issuer
-+ -e, --verify-response Verify response
-+ -i, --request-info Print information on a OCSP request
-+ -j, --response-info Print information on a OCSP response
-+ -q, --generate-request Generate an OCSP request
-+ --nonce Use (or not) a nonce to OCSP request
-+ - disabled as '--no-nonce'
-+ --load-issuer=file Read issuer certificate from file
-+ - file must pre-exist
-+ --load-cert=file Read certificate to check from file
-+ - file must pre-exist
-+ --load-trust=file Read OCSP trust anchors from file
-+ - prohibits the option 'load-signer'
-+ - file must pre-exist
-+ --load-signer=file Read OCSP response signer from file
-+ - prohibits the option 'load-trust'
-+ - file must pre-exist
-+ --inder Use DER format for input certificates and private keys
-+ - disabled as '--no-inder'
-+ -Q, --load-request=file Read DER encoded OCSP request from file
-+ - file must pre-exist
-+ -S, --load-response=file Read DER encoded OCSP response from file
-+ - file must pre-exist
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+
-+Ocsptool is a program that can parse and print information about OCSP
-+requests/responses, generate requests and verify responses.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-p11tool.texi gnutls-3.4.4.1/doc/invoke-p11tool.texi
---- gnutls-3.4.4.1/doc/invoke-p11tool.texi 2015-08-10 13:43:58.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-p11tool.texi 2015-07-31 15:44:26.000000000 -0400
-@@ -45,7 +45,97 @@
-
- @exampleindent 0
- @example
--p11tool is unavailable - no --help
-+p11tool - GnuTLS PKCS #11 tool
-+Usage: p11tool [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... [url]
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ --outfile=str Output file
-+ --list-tokens List all available tokens
-+ --export Export the object specified by the URL
-+ --export-chain Export the certificate specified by the URL and its chain of trust
-+ --list-mechanisms List all available mechanisms in a token
-+ --info List information on an available object in a token
-+ --list-all List all available objects in a token
-+ --list-all-certs List all available certificates in a token
-+ --list-certs List all certificates that have an associated private key
-+ --list-all-privkeys List all available private keys in a token
-+ --list-privkeys an alias for the 'list-all-privkeys' option
-+ --list-keys an alias for the 'list-all-privkeys' option
-+ --list-all-trusted List all available certificates marked as trusted
-+ --write Writes the loaded objects to a PKCS #11 token
-+ --delete Deletes the objects matching the PKCS #11 URL
-+ --generate-random=num Generate random data
-+ --generate-rsa Generate an RSA private-public key pair
-+ --generate-dsa Generate an RSA private-public key pair
-+ --generate-ecc Generate an RSA private-public key pair
-+ --export-pubkey Export the public key for a private key
-+ --label=str Sets a label for the write operation
-+ --mark-wrap Marks the generated key to be a wrapping key
-+ - disabled as '--no-mark-wrap'
-+ --mark-trusted Marks the object to be written as trusted
-+ - disabled as '--no-mark-trusted'
-+ --mark-ca Marks the object to be written as a CA
-+ - disabled as '--no-mark-ca'
-+ --mark-private Marks the object to be written as private
-+ - disabled as '--no-mark-private'
-+ - enabled by default
-+ --trusted an alias for the 'mark-trusted' option
-+ --ca an alias for the 'mark-ca' option
-+ --private an alias for the 'mark-private' option
-+ - enabled by default
-+ --login Force (user) login to token
-+ - disabled as '--no-login'
-+ --so-login Force security officer login to token
-+ - disabled as '--no-so-login'
-+ --admin-login an alias for the 'so-login' option
-+ --detailed-url Print detailed URLs
-+ - disabled as '--no-detailed-url'
-+ -!, --secret-key=str Provide a hex encoded secret key
-+ -", --load-privkey=file Private key file to use
-+ - file must pre-exist
-+ -#, --load-pubkey=file Public key file to use
-+ - file must pre-exist
-+ -$, --load-certificate=file Certificate file to use
-+ - file must pre-exist
-+ -8, --pkcs8 Use PKCS #8 format for private keys
-+ -%, --bits=num Specify the number of bits for key generate
-+ -&, --curve=str Specify the curve used for EC key generation
-+ -', --sec-param=str Specify the security level
-+ -(, --inder Use DER/RAW format for input
-+ - disabled as '--no-inder'
-+ -), --inraw an alias for the 'inder' option
-+ -*, --outder Use DER format for output certificates, private keys, and DH parameters
-+ - disabled as '--no-outder'
-+ -+, --outraw an alias for the 'outder' option
-+ -,, --initialize Initializes a PKCS #11 token
-+ --, --set-pin=str Specify the PIN to use on token initialization
-+ -., --set-so-pin=str Specify the Security Officer's PIN to use on token initialization
-+ -/, --provider=file Specify the PKCS #11 provider library
-+ - file must pre-exist
-+ -0, --batch Disable all interaction with the tool. All parameters need to be
-+specified on command line.
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+Operands and options may be intermixed. They will be reordered.
-+
-+Program that allows operations on PKCS #11 smart cards and security
-+modules.
-+
-+To use PKCS #11 tokens with GnuTLS the p11-kit configuration files need to
-+be setup. That is create a .module file in /etc/pkcs11/modules with the
-+contents 'module: /path/to/pkcs11.so'. Alternatively the configuration
-+file /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of
-+the form 'load=/usr/lib/opensc-pkcs11.so'.
-+
-+You can provide the PIN to be used for the PKCS #11 operations with the
-+environment variables GNUTLS_PIN and GNUTLS_SO_PIN.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-psktool.texi gnutls-3.4.4.1/doc/invoke-psktool.texi
---- gnutls-3.4.4.1/doc/invoke-psktool.texi 2015-08-10 13:43:57.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-psktool.texi 2015-07-31 15:44:25.000000000 -0400
-@@ -36,7 +36,27 @@
-
- @exampleindent 0
- @example
--psktool is unavailable - no --help
-+psktool - GnuTLS PSK tool
-+Usage: psktool [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -s, --keysize=num specify the key size in bytes
-+ - it must be in the range:
-+ 0 to 512
-+ -u, --username=str specify a username
-+ -p, --passwd=str specify a password file
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+
-+Program that generates random keys for use with TLS-PSK. The keys are
-+stored in hexadecimal format in a key file.
-+
- @end example
- @exampleindent 4
-
-diff -ru gnutls-3.4.4/doc/invoke-srptool.texi gnutls-3.4.4.1/doc/invoke-srptool.texi
---- gnutls-3.4.4.1/doc/invoke-srptool.texi 2015-08-10 13:43:56.000000000 -0400
-+++ gnutls-3.4.4/doc/invoke-srptool.texi 2015-07-31 15:44:24.000000000 -0400
-@@ -41,7 +41,34 @@
-
- @exampleindent 0
- @example
--srptool is unavailable - no --help
-+srptool - GnuTLS SRP tool
-+Usage: srptool [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]...
-+
-+ -d, --debug=num Enable debugging
-+ - it must be in the range:
-+ 0 to 9999
-+ -i, --index=num specify the index of the group parameters in tpasswd.conf to use
-+ -u, --username=str specify a username
-+ -p, --passwd=str specify a password file
-+ -s, --salt=num specify salt size
-+ --verify just verify the password.
-+ -v, --passwd-conf=str specify a password conf file.
-+ --create-conf=str Generate a password configuration file.
-+ -v, --version[=arg] output version information and exit
-+ -h, --help display extended usage information and exit
-+ -!, --more-help extended usage information passed thru pager
-+
-+Options are specified by doubled hyphens and their name or by a single
-+hyphen and the flag character.
-+
-+Simple program that emulates the programs in the Stanford SRP (Secure
-+Remote Password) libraries using GnuTLS. It is intended for use in places
-+where you don't expect SRP authentication to be the used for system users.
-+
-+In brief, to use SRP you need to create two files. These are the password
-+file that holds the users and the verifiers associated with them and the
-+configuration file to hold the group parameters (called tpasswd.conf).
-+
- @end example
- @exampleindent 4
-
diff --git a/gnu/packages/patches/grep-CVE-2015-1345.patch b/gnu/packages/patches/grep-CVE-2015-1345.patch
deleted file mode 100644
index b0d0c8e5dc..0000000000
--- a/gnu/packages/patches/grep-CVE-2015-1345.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Fix CVE-2015-1345. From upstream commit
-83a95bd8c8561875b948cadd417c653dbe7ef2e2
-by Yuliy Pisetsky <[email protected]>.
-
-diff --git a/src/kwset.c b/src/kwset.c
-index 4003c8d..376f7c3 100644
---- a/src/kwset.c
-+++ b/src/kwset.c
-@@ -643,6 +643,8 @@ bmexec_trans (kwset_t kwset, char const *text, size_t size)
- if (! tp)
- return -1;
- tp++;
-+ if (ep <= tp)
-+ break;
- }
- }
- }
diff --git a/gnu/packages/patches/grep-timing-sensitive-test.patch b/gnu/packages/patches/grep-timing-sensitive-test.patch
new file mode 100644
index 0000000000..8cfcc848bc
--- /dev/null
+++ b/gnu/packages/patches/grep-timing-sensitive-test.patch
@@ -0,0 +1,15 @@
+Skip this performance regression test.
+
+The test measures things on the order of 20ms. On a loaded machine, we
+have seen enough variation that the test would fail.
+
+--- grep-2.22/tests/long-pattern-perf 2016-01-03 12:52:38.491575007 +0100
++++ grep-2.22/tests/long-pattern-perf 2016-01-03 12:53:39.768464687 +0100
+@@ -16,6 +16,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program. If not, see <http://www.gnu.org/licenses/>.
+
++exit 77
+ . "${srcdir=.}/init.sh"; path_prepend_ ../src
+
+ fail=0
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch
new file mode 100644
index 0000000000..27768fa1ac
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch
@@ -0,0 +1,34 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/925215cae26f
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1233346
+
+# HG changeset patch
+# User Nils Ohlmeier <[email protected]>
+# Date 1451439902 18000
+# Node ID 925215cae26f9c0ccff07ef403a5b3194a4c45c4
+# Parent ff8e52467d793e935b80bf22a722a71a96fe2d63
+Bug 1233346 - r=ekr a=abillings
+
+diff --git a/media/mtransport/third_party/nICEr/src/stun/addrs.c b/media/mtransport/third_party/nICEr/src/stun/addrs.c
+--- a/media/mtransport/third_party/nICEr/src/stun/addrs.c
++++ b/media/mtransport/third_party/nICEr/src/stun/addrs.c
+@@ -530,16 +530,18 @@ stun_get_win32_addrs(nr_local_addr addrs
+
+ for (tmpAddress = AdapterAddresses; tmpAddress != NULL; tmpAddress = tmpAddress->Next) {
+ char *c;
+
+ if (tmpAddress->OperStatus != IfOperStatusUp)
+ continue;
+
+ snprintf(munged_ifname, IFNAMSIZ, "%S%c", tmpAddress->FriendlyName, 0);
++ munged_ifname[IFNAMSIZ-1] = '\0';
++
+ /* replace spaces with underscores */
+ c = strchr(munged_ifname, ' ');
+ while (c != NULL) {
+ *c = '_';
+ c = strchr(munged_ifname, ' ');
+ }
+ c = strchr(munged_ifname, '.');
+ while (c != NULL) {
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch
new file mode 100644
index 0000000000..fa1804eb82
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch
@@ -0,0 +1,33 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/fc78180165a8
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
+
+# HG changeset patch
+# User Karl Tomlinson <[email protected]>
+# Date 1449117514 -46800
+# Node ID fc78180165a8262c80bbb722ed99b2e0c27b02d0
+# Parent 925215cae26f9c0ccff07ef403a5b3194a4c45c4
+bug 1223670 assert that connected streams have the same graph r=padenot a=abillings
+
+diff --git a/dom/media/MediaStreamGraph.cpp b/dom/media/MediaStreamGraph.cpp
+--- a/dom/media/MediaStreamGraph.cpp
++++ b/dom/media/MediaStreamGraph.cpp
+@@ -2696,16 +2696,17 @@ ProcessedMediaStream::AllocateInputPort(
+ unused << mPort.forget();
+ }
+ virtual void RunDuringShutdown()
+ {
+ Run();
+ }
+ nsRefPtr<MediaInputPort> mPort;
+ };
++ MOZ_ASSERT(aStream->GraphImpl() == GraphImpl());
+ nsRefPtr<MediaInputPort> port = new MediaInputPort(aStream, this, aFlags,
+ aInputNumber, aOutputNumber);
+ port->SetGraphImpl(GraphImpl());
+ GraphImpl()->AppendMessage(new Message(port));
+ return port.forget();
+ }
+
+ void
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch
new file mode 100644
index 0000000000..cf0843b8b3
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch
@@ -0,0 +1,308 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/f746c38d160e
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
+
+# HG changeset patch
+# User Karl Tomlinson <[email protected]>
+# Date 1449764754 18000
+# Node ID f746c38d160ea29088c15cacae44f3662befaec5
+# Parent fc78180165a8262c80bbb722ed99b2e0c27b02d0
+bug 1223670 replace public constructors with fallible factory methods r=baku a=abillings
+
+diff --git a/dom/media/webaudio/AudioContext.cpp b/dom/media/webaudio/AudioContext.cpp
+--- a/dom/media/webaudio/AudioContext.cpp
++++ b/dom/media/webaudio/AudioContext.cpp
+@@ -299,32 +299,29 @@ AudioContext::CreateMediaElementSource(H
+ aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+ return nullptr;
+ }
+ #endif
+ nsRefPtr<DOMMediaStream> stream = aMediaElement.MozCaptureStream(aRv);
+ if (aRv.Failed()) {
+ return nullptr;
+ }
+- nsRefPtr<MediaElementAudioSourceNode> mediaElementAudioSourceNode =
+- new MediaElementAudioSourceNode(this, stream);
+- return mediaElementAudioSourceNode.forget();
++ return MediaElementAudioSourceNode::Create(this, stream, aRv);
+ }
+
+ already_AddRefed<MediaStreamAudioSourceNode>
+ AudioContext::CreateMediaStreamSource(DOMMediaStream& aMediaStream,
+ ErrorResult& aRv)
+ {
+ if (mIsOffline) {
+ aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+ return nullptr;
+ }
+- nsRefPtr<MediaStreamAudioSourceNode> mediaStreamAudioSourceNode =
+- new MediaStreamAudioSourceNode(this, &aMediaStream);
+- return mediaStreamAudioSourceNode.forget();
++
++ return MediaStreamAudioSourceNode::Create(this, &aMediaStream, aRv);
+ }
+
+ already_AddRefed<GainNode>
+ AudioContext::CreateGain()
+ {
+ nsRefPtr<GainNode> gainNode = new GainNode(this);
+ return gainNode.forget();
+ }
+diff --git a/dom/media/webaudio/AudioNode.cpp b/dom/media/webaudio/AudioNode.cpp
+--- a/dom/media/webaudio/AudioNode.cpp
++++ b/dom/media/webaudio/AudioNode.cpp
+@@ -61,34 +61,29 @@ AudioNode::AudioNode(AudioContext* aCont
+ ChannelInterpretation aChannelInterpretation)
+ : DOMEventTargetHelper(aContext->GetParentObject())
+ , mContext(aContext)
+ , mChannelCount(aChannelCount)
+ , mChannelCountMode(aChannelCountMode)
+ , mChannelInterpretation(aChannelInterpretation)
+ , mId(gId++)
+ , mPassThrough(false)
+-#ifdef DEBUG
+- , mDemiseNotified(false)
+-#endif
+ {
+ MOZ_ASSERT(aContext);
+ DOMEventTargetHelper::BindToOwner(aContext->GetParentObject());
+ aContext->UpdateNodeCount(1);
+ }
+
+ AudioNode::~AudioNode()
+ {
+ MOZ_ASSERT(mInputNodes.IsEmpty());
+ MOZ_ASSERT(mOutputNodes.IsEmpty());
+ MOZ_ASSERT(mOutputParams.IsEmpty());
+-#ifdef DEBUG
+- MOZ_ASSERT(mDemiseNotified,
++ MOZ_ASSERT(!mStream,
+ "The webaudio-node-demise notification must have been sent");
+-#endif
+ if (mContext) {
+ mContext->UpdateNodeCount(-1);
+ }
+ }
+
+ size_t
+ AudioNode::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+ {
+@@ -399,19 +394,16 @@ AudioNode::DestroyMediaStream()
+ mStream = nullptr;
+
+ nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+ if (obs) {
+ nsAutoString id;
+ id.AppendPrintf("%u", mId);
+ obs->NotifyObservers(nullptr, "webaudio-node-demise", id.get());
+ }
+-#ifdef DEBUG
+- mDemiseNotified = true;
+-#endif
+ }
+ }
+
+ void
+ AudioNode::RemoveOutputParam(AudioParam* aParam)
+ {
+ mOutputParams.RemoveElement(aParam);
+ }
+diff --git a/dom/media/webaudio/AudioNode.h b/dom/media/webaudio/AudioNode.h
+--- a/dom/media/webaudio/AudioNode.h
++++ b/dom/media/webaudio/AudioNode.h
+@@ -239,19 +239,14 @@ private:
+ nsTArray<nsRefPtr<AudioParam> > mOutputParams;
+ uint32_t mChannelCount;
+ ChannelCountMode mChannelCountMode;
+ ChannelInterpretation mChannelInterpretation;
+ const uint32_t mId;
+ // Whether the node just passes through its input. This is a devtools API that
+ // only works for some node types.
+ bool mPassThrough;
+-#ifdef DEBUG
+- // In debug builds, check to make sure that the node demise notification has
+- // been properly sent before the node is destroyed.
+- bool mDemiseNotified;
+-#endif
+ };
+
+ }
+ }
+
+ #endif
+diff --git a/dom/media/webaudio/MediaElementAudioSourceNode.cpp b/dom/media/webaudio/MediaElementAudioSourceNode.cpp
+--- a/dom/media/webaudio/MediaElementAudioSourceNode.cpp
++++ b/dom/media/webaudio/MediaElementAudioSourceNode.cpp
+@@ -5,22 +5,36 @@
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+ #include "MediaElementAudioSourceNode.h"
+ #include "mozilla/dom/MediaElementAudioSourceNodeBinding.h"
+
+ namespace mozilla {
+ namespace dom {
+
+-MediaElementAudioSourceNode::MediaElementAudioSourceNode(AudioContext* aContext,
+- DOMMediaStream* aStream)
+- : MediaStreamAudioSourceNode(aContext, aStream)
++MediaElementAudioSourceNode::MediaElementAudioSourceNode(AudioContext* aContext)
++ : MediaStreamAudioSourceNode(aContext)
+ {
+ }
+
++/* static */ already_AddRefed<MediaElementAudioSourceNode>
++MediaElementAudioSourceNode::Create(AudioContext* aContext,
++ DOMMediaStream* aStream, ErrorResult& aRv)
++{
++ nsRefPtr<MediaElementAudioSourceNode> node =
++ new MediaElementAudioSourceNode(aContext);
++
++ node->Init(aStream, aRv);
++ if (aRv.Failed()) {
++ return nullptr;
++ }
++
++ return node.forget();
++}
++
+ JSObject*
+ MediaElementAudioSourceNode::WrapObject(JSContext* aCx)
+ {
+ return MediaElementAudioSourceNodeBinding::Wrap(aCx, this);
+ }
+
+ }
+ }
+diff --git a/dom/media/webaudio/MediaElementAudioSourceNode.h b/dom/media/webaudio/MediaElementAudioSourceNode.h
+--- a/dom/media/webaudio/MediaElementAudioSourceNode.h
++++ b/dom/media/webaudio/MediaElementAudioSourceNode.h
+@@ -10,28 +10,30 @@
+ #include "MediaStreamAudioSourceNode.h"
+
+ namespace mozilla {
+ namespace dom {
+
+ class MediaElementAudioSourceNode : public MediaStreamAudioSourceNode
+ {
+ public:
+- MediaElementAudioSourceNode(AudioContext* aContext,
+- DOMMediaStream* aStream);
++ static already_AddRefed<MediaElementAudioSourceNode>
++ Create(AudioContext* aContext, DOMMediaStream* aStream, ErrorResult& aRv);
+
+ virtual JSObject* WrapObject(JSContext* aCx) override;
+
+ virtual const char* NodeType() const override
+ {
+ return "MediaElementAudioSourceNode";
+ }
+
+ virtual size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const override
+ {
+ return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf);
+ }
++private:
++ explicit MediaElementAudioSourceNode(AudioContext* aContext);
+ };
+
+ }
+ }
+
+ #endif
+diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
+--- a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
+@@ -25,26 +25,45 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(MediaStreamAudioSourceNode)
+ NS_INTERFACE_MAP_END_INHERITING(AudioNode)
+
+ NS_IMPL_ADDREF_INHERITED(MediaStreamAudioSourceNode, AudioNode)
+ NS_IMPL_RELEASE_INHERITED(MediaStreamAudioSourceNode, AudioNode)
+
+-MediaStreamAudioSourceNode::MediaStreamAudioSourceNode(AudioContext* aContext,
+- DOMMediaStream* aMediaStream)
++MediaStreamAudioSourceNode::MediaStreamAudioSourceNode(AudioContext* aContext)
+ : AudioNode(aContext,
+ 2,
+ ChannelCountMode::Max,
+- ChannelInterpretation::Speakers),
+- mInputStream(aMediaStream)
++ ChannelInterpretation::Speakers)
+ {
++}
++
++/* static */ already_AddRefed<MediaStreamAudioSourceNode>
++MediaStreamAudioSourceNode::Create(AudioContext* aContext,
++ DOMMediaStream* aStream, ErrorResult& aRv)
++{
++ nsRefPtr<MediaStreamAudioSourceNode> node =
++ new MediaStreamAudioSourceNode(aContext);
++
++ node->Init(aStream, aRv);
++ if (aRv.Failed()) {
++ return nullptr;
++ }
++
++ return node.forget();
++}
++
++void
++MediaStreamAudioSourceNode::Init(DOMMediaStream* aMediaStream, ErrorResult& aRv)
++{
++ mInputStream = aMediaStream;
+ AudioNodeEngine* engine = new MediaStreamAudioSourceNodeEngine(this);
+- mStream = aContext->Graph()->CreateAudioNodeExternalInputStream(engine);
++ mStream = Context()->Graph()->CreateAudioNodeExternalInputStream(engine);
+ ProcessedMediaStream* outputStream = static_cast<ProcessedMediaStream*>(mStream.get());
+ mInputPort = outputStream->AllocateInputPort(aMediaStream->GetStream(),
+ MediaInputPort::FLAG_BLOCK_INPUT);
+ mInputStream->AddConsumerToKeepAlive(static_cast<nsIDOMEventTarget*>(this));
+
+ PrincipalChanged(mInputStream); // trigger enabling/disabling of the connector
+ mInputStream->AddPrincipalChangeObserver(this);
+ }
+diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.h b/dom/media/webaudio/MediaStreamAudioSourceNode.h
+--- a/dom/media/webaudio/MediaStreamAudioSourceNode.h
++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.h
+@@ -38,17 +38,18 @@ public:
+ private:
+ bool mEnabled;
+ };
+
+ class MediaStreamAudioSourceNode : public AudioNode,
+ public DOMMediaStream::PrincipalChangeObserver
+ {
+ public:
+- MediaStreamAudioSourceNode(AudioContext* aContext, DOMMediaStream* aMediaStream);
++ static already_AddRefed<MediaStreamAudioSourceNode>
++ Create(AudioContext* aContext, DOMMediaStream* aStream, ErrorResult& aRv);
+
+ NS_DECL_ISUPPORTS_INHERITED
+ NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(MediaStreamAudioSourceNode, AudioNode)
+
+ virtual JSObject* WrapObject(JSContext* aCx) override;
+
+ virtual void DestroyMediaStream() override;
+
+@@ -60,16 +61,18 @@ public:
+ }
+
+ virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const override;
+ virtual size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const override;
+
+ virtual void PrincipalChanged(DOMMediaStream* aMediaStream) override;
+
+ protected:
++ explicit MediaStreamAudioSourceNode(AudioContext* aContext);
++ void Init(DOMMediaStream* aMediaStream, ErrorResult& aRv);
+ virtual ~MediaStreamAudioSourceNode();
+
+ private:
+ nsRefPtr<MediaInputPort> mInputPort;
+ nsRefPtr<DOMMediaStream> mInputStream;
+ };
+
+ }
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch
new file mode 100644
index 0000000000..b212a70d4a
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch
@@ -0,0 +1,47 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/6d43ff33bd55
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
+
+# HG changeset patch
+# User Karl Tomlinson <[email protected]>
+# Date 1451362442 -46800
+# Node ID 6d43ff33bd552b8f7a34e4105cf5bcc0a8c8ea8c
+# Parent f746c38d160ea29088c15cacae44f3662befaec5
+bug 1223670 throw not supported when creating a node from a stream with different channel r=baku a=abillings
+
+diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
+--- a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp
+@@ -51,21 +51,29 @@ MediaStreamAudioSourceNode::Create(Audio
+ }
+
+ return node.forget();
+ }
+
+ void
+ MediaStreamAudioSourceNode::Init(DOMMediaStream* aMediaStream, ErrorResult& aRv)
+ {
++ MOZ_ASSERT(aMediaStream);
++ MediaStream* inputStream = aMediaStream->GetStream();
++ MediaStreamGraph* graph = Context()->Graph();
++ if (NS_WARN_IF(graph != inputStream->Graph())) {
++ aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
++ return;
++ }
++
+ mInputStream = aMediaStream;
+ AudioNodeEngine* engine = new MediaStreamAudioSourceNodeEngine(this);
+- mStream = Context()->Graph()->CreateAudioNodeExternalInputStream(engine);
++ mStream = graph->CreateAudioNodeExternalInputStream(engine);
+ ProcessedMediaStream* outputStream = static_cast<ProcessedMediaStream*>(mStream.get());
+- mInputPort = outputStream->AllocateInputPort(aMediaStream->GetStream(),
++ mInputPort = outputStream->AllocateInputPort(inputStream,
+ MediaInputPort::FLAG_BLOCK_INPUT);
+ mInputStream->AddConsumerToKeepAlive(static_cast<nsIDOMEventTarget*>(this));
+
+ PrincipalChanged(mInputStream); // trigger enabling/disabling of the connector
+ mInputStream->AddPrincipalChangeObserver(this);
+ }
+
+ MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode()
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch
new file mode 100644
index 0000000000..3e62c9c5f1
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch
@@ -0,0 +1,51 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/4f6e81673f69
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
+
+# HG changeset patch
+# User Karl Tomlinson <[email protected]>
+# Date 1449145091 -46800
+# Node ID 4f6e81673f6938719c86516606f2fda493e8c23c
+# Parent 6d43ff33bd552b8f7a34e4105cf5bcc0a8c8ea8c
+bug 1223670 make SetMozAudioChannelType() private because the type will not change after construction r=baku a=abillings
+
+diff --git a/dom/media/webaudio/AudioDestinationNode.h b/dom/media/webaudio/AudioDestinationNode.h
+--- a/dom/media/webaudio/AudioDestinationNode.h
++++ b/dom/media/webaudio/AudioDestinationNode.h
+@@ -57,17 +57,16 @@ public:
+ void StartRendering(Promise* aPromise);
+
+ void OfflineShutdown();
+
+ // nsIDOMEventListener - by proxy
+ NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent) override;
+
+ AudioChannel MozAudioChannelType() const;
+- void SetMozAudioChannelType(AudioChannel aValue, ErrorResult& aRv);
+
+ virtual void NotifyMainThreadStateChanged() override;
+ void FireOfflineCompletionEvent();
+
+ // An amount that should be added to the MediaStream's current time to
+ // get the AudioContext.currentTime.
+ double ExtraCurrentTime();
+
+@@ -86,16 +85,17 @@ public:
+
+ void InputMuted(bool aInputMuted);
+ void ResolvePromise(AudioBuffer* aRenderedBuffer);
+
+ protected:
+ virtual ~AudioDestinationNode();
+
+ private:
++ void SetMozAudioChannelType(AudioChannel aValue, ErrorResult& aRv);
+ bool CheckAudioChannelPermissions(AudioChannel aValue);
+
+ void SetCanPlay(bool aCanPlay);
+
+ void NotifyStableState();
+ void ScheduleStableStateNotification();
+
+ SelfReference<AudioDestinationNode> mOfflineRenderingRef;
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch
new file mode 100644
index 0000000000..ec1f479ee4
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch
@@ -0,0 +1,170 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/93617c30c0df
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230686
+
+# HG changeset patch
+# User Lee Salzman <[email protected]>
+# Date 1451932822 18000
+# Node ID 93617c30c0df35f719dead526b78649d564f5ac3
+# Parent 4f6e81673f6938719c86516606f2fda493e8c23c
+Bug 1230686 - use RefPtr<DrawTarget>& instead of DrawTarget* to track changes in SurfaceFromElement a=ritu
+
+diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
+--- a/layout/base/nsLayoutUtils.cpp
++++ b/layout/base/nsLayoutUtils.cpp
+@@ -6494,17 +6494,17 @@ nsLayoutUtils::IsReallyFixedPos(nsIFrame
+ nsIAtom *parentType = aFrame->GetParent()->GetType();
+ return parentType == nsGkAtoms::viewportFrame ||
+ parentType == nsGkAtoms::pageContentFrame;
+ }
+
+ nsLayoutUtils::SurfaceFromElementResult
+ nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement,
+ uint32_t aSurfaceFlags,
+- DrawTarget* aTarget)
++ RefPtr<DrawTarget>& aTarget)
+ {
+ SurfaceFromElementResult result;
+ nsresult rv;
+
+ nsCOMPtr<imgIRequest> imgRequest;
+ rv = aElement->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
+ getter_AddRefs(imgRequest));
+ if (NS_FAILED(rv) || !imgRequest)
+@@ -6586,41 +6586,41 @@ nsLayoutUtils::SurfaceFromElement(nsIIma
+ result.mImageRequest = imgRequest.forget();
+
+ return result;
+ }
+
+ nsLayoutUtils::SurfaceFromElementResult
+ nsLayoutUtils::SurfaceFromElement(HTMLImageElement *aElement,
+ uint32_t aSurfaceFlags,
+- DrawTarget* aTarget)
++ RefPtr<DrawTarget>& aTarget)
+ {
+ return SurfaceFromElement(static_cast<nsIImageLoadingContent*>(aElement),
+ aSurfaceFlags, aTarget);
+ }
+
+ nsLayoutUtils::SurfaceFromElementResult
+ nsLayoutUtils::SurfaceFromElement(HTMLCanvasElement* aElement,
+ uint32_t aSurfaceFlags,
+- DrawTarget* aTarget)
++ RefPtr<DrawTarget>& aTarget)
+ {
+ SurfaceFromElementResult result;
+
+ bool* isPremultiplied = nullptr;
+ if (aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) {
+ isPremultiplied = &result.mIsPremultiplied;
+ }
+
+ gfxIntSize size = aElement->GetSize();
+
+ result.mSourceSurface = aElement->GetSurfaceSnapshot(isPremultiplied);
+ if (!result.mSourceSurface) {
+ // If the element doesn't have a context then we won't get a snapshot. The canvas spec wants us to not error and just
+ // draw nothing, so return an empty surface.
+- DrawTarget *ref = aTarget ? aTarget : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget();
++ DrawTarget *ref = aTarget ? aTarget.get() : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget();
+ RefPtr<DrawTarget> dt = ref->CreateSimilarDrawTarget(IntSize(size.width, size.height),
+ SurfaceFormat::B8G8R8A8);
+ if (dt) {
+ result.mSourceSurface = dt->Snapshot();
+ }
+ } else if (aTarget) {
+ RefPtr<SourceSurface> opt = aTarget->OptimizeSourceSurface(result.mSourceSurface);
+ if (opt) {
+@@ -6637,17 +6637,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLCa
+ result.mIsWriteOnly = aElement->IsWriteOnly();
+
+ return result;
+ }
+
+ nsLayoutUtils::SurfaceFromElementResult
+ nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement,
+ uint32_t aSurfaceFlags,
+- DrawTarget* aTarget)
++ RefPtr<DrawTarget>& aTarget)
+ {
+ SurfaceFromElementResult result;
+
+ NS_WARN_IF_FALSE((aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) == 0, "We can't support non-premultiplied alpha for video!");
+
+ #ifdef MOZ_EME
+ if (aElement->ContainsRestrictedContent()) {
+ return result;
+@@ -6689,17 +6689,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLVi
+ result.mIsWriteOnly = false;
+
+ return result;
+ }
+
+ nsLayoutUtils::SurfaceFromElementResult
+ nsLayoutUtils::SurfaceFromElement(dom::Element* aElement,
+ uint32_t aSurfaceFlags,
+- DrawTarget* aTarget)
++ RefPtr<DrawTarget>& aTarget)
+ {
+ // If it's a <canvas>, we may be able to just grab its internal surface
+ if (HTMLCanvasElement* canvas =
+ HTMLCanvasElement::FromContentOrNull(aElement)) {
+ return SurfaceFromElement(canvas, aSurfaceFlags, aTarget);
+ }
+
+ // Maybe it's <video>?
+diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
+--- a/layout/base/nsLayoutUtils.h
++++ b/layout/base/nsLayoutUtils.h
+@@ -2018,33 +2018,39 @@ public:
+ bool mIsStillLoading;
+ /* Whether the element used CORS when loading. */
+ bool mCORSUsed;
+ /* Whether the returned image contains premultiplied pixel data */
+ bool mIsPremultiplied;
+ };
+
+ static SurfaceFromElementResult SurfaceFromElement(mozilla::dom::Element *aElement,
+- uint32_t aSurfaceFlags = 0,
+- DrawTarget *aTarget = nullptr);
++ uint32_t aSurfaceFlags,
++ mozilla::RefPtr<DrawTarget>& aTarget);
++ static SurfaceFromElementResult SurfaceFromElement(mozilla::dom::Element *aElement,
++ uint32_t aSurfaceFlags = 0) {
++ mozilla::RefPtr<DrawTarget> target = nullptr;
++ return SurfaceFromElement(aElement, aSurfaceFlags, target);
++ }
++
+ static SurfaceFromElementResult SurfaceFromElement(nsIImageLoadingContent *aElement,
+- uint32_t aSurfaceFlags = 0,
+- DrawTarget *aTarget = nullptr);
++ uint32_t aSurfaceFlags,
++ mozilla::RefPtr<DrawTarget>& aTarget);
+ // Need an HTMLImageElement overload, because otherwise the
+ // nsIImageLoadingContent and mozilla::dom::Element overloads are ambiguous
+ // for HTMLImageElement.
+ static SurfaceFromElementResult SurfaceFromElement(mozilla::dom::HTMLImageElement *aElement,
+- uint32_t aSurfaceFlags = 0,
+- DrawTarget *aTarget = nullptr);
++ uint32_t aSurfaceFlags,
++ mozilla::RefPtr<DrawTarget>& aTarget);
+ static SurfaceFromElementResult SurfaceFromElement(mozilla::dom::HTMLCanvasElement *aElement,
+- uint32_t aSurfaceFlags = 0,
+- DrawTarget *aTarget = nullptr);
++ uint32_t aSurfaceFlags,
++ mozilla::RefPtr<DrawTarget>& aTarget);
+ static SurfaceFromElementResult SurfaceFromElement(mozilla::dom::HTMLVideoElement *aElement,
+- uint32_t aSurfaceFlags = 0,
+- DrawTarget *aTarget = nullptr);
++ uint32_t aSurfaceFlags,
++ mozilla::RefPtr<DrawTarget>& aTarget);
+
+ /**
+ * When the document is editable by contenteditable attribute of its root
+ * content or body content.
+ *
+ * Be aware, this returns nullptr if it's in designMode.
+ *
+ * For example:
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch
new file mode 100644
index 0000000000..4f349747c0
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch
@@ -0,0 +1,56 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/750e4cfc90f8
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1233152
+
+# HG changeset patch
+# User Jan de Mooij <[email protected]>
+# Date 1451478493 -3600
+# Node ID 750e4cfc90f80df657e44c9c63b1865023d88682
+# Parent 93617c30c0df35f719dead526b78649d564f5ac3
+Bug 1233152 - Use PersistentRooted for ParseTask script and sourceObject. r=terrence a=abillings
+
+diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
+--- a/js/src/vm/HelperThreads.cpp
++++ b/js/src/vm/HelperThreads.cpp
+@@ -198,17 +198,17 @@ static const JSClass parseTaskGlobalClas
+
+ ParseTask::ParseTask(ExclusiveContext* cx, JSObject* exclusiveContextGlobal, JSContext* initCx,
+ const char16_t* chars, size_t length,
+ JS::OffThreadCompileCallback callback, void* callbackData)
+ : cx(cx), options(initCx), chars(chars), length(length),
+ alloc(JSRuntime::TEMP_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+ exclusiveContextGlobal(initCx, exclusiveContextGlobal),
+ callback(callback), callbackData(callbackData),
+- script(nullptr), errors(cx), overRecursed(false)
++ script(initCx->runtime(), nullptr), errors(cx), overRecursed(false)
+ {
+ }
+
+ bool
+ ParseTask::init(JSContext* cx, const ReadOnlyCompileOptions& options)
+ {
+ if (!this->options.copy(cx, options))
+ return false;
+diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
+--- a/js/src/vm/HelperThreads.h
++++ b/js/src/vm/HelperThreads.h
+@@ -472,17 +472,17 @@ struct ParseTask
+
+ // Callback invoked off the main thread when the parse finishes.
+ JS::OffThreadCompileCallback callback;
+ void* callbackData;
+
+ // Holds the final script between the invocation of the callback and the
+ // point where FinishOffThreadScript is called, which will destroy the
+ // ParseTask.
+- JSScript* script;
++ PersistentRootedScript script;
+
+ // Any errors or warnings produced during compilation. These are reported
+ // when finishing the script.
+ Vector<frontend::CompileError*> errors;
+ bool overRecursed;
+
+ ParseTask(ExclusiveContext* cx, JSObject* exclusiveContextGlobal,
+ JSContext* initCx, const char16_t* chars, size_t length,
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch
new file mode 100644
index 0000000000..406ce1bf2b
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch
@@ -0,0 +1,48 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/4444e94a99cb
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1221385
+
+# HG changeset patch
+# User Jan de Mooij <[email protected]>
+# Date 1451478429 -3600
+# Node ID 4444e94a99cb9b00c0351cc8bf5459739cc036a5
+# Parent 750e4cfc90f80df657e44c9c63b1865023d88682
+Bug 1221385 - Handle OOM during JitRuntime initialization a bit better. r=bhackett a=abillings
+
+diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
+--- a/js/src/jscompartment.cpp
++++ b/js/src/jscompartment.cpp
+@@ -138,28 +138,20 @@ JSRuntime::createJitRuntime(JSContext* c
+
+ // Protect jitRuntime_ from being observed (by InterruptRunningJitCode)
+ // while it is being initialized. Unfortunately, initialization depends on
+ // jitRuntime_ being non-null, so we can't just wait to assign jitRuntime_.
+ JitRuntime::AutoMutateBackedges amb(jrt);
+ jitRuntime_ = jrt;
+
+ if (!jitRuntime_->initialize(cx)) {
+- js_ReportOutOfMemory(cx);
+-
+- js_delete(jitRuntime_);
+- jitRuntime_ = nullptr;
+-
+- JSCompartment* comp = cx->runtime()->atomsCompartment();
+- if (comp->jitCompartment_) {
+- js_delete(comp->jitCompartment_);
+- comp->jitCompartment_ = nullptr;
+- }
+-
+- return nullptr;
++ // Handling OOM here is complicated: if we delete jitRuntime_ now, we
++ // will destroy the ExecutableAllocator, even though there may still be
++ // JitCode instances holding references to ExecutablePools.
++ CrashAtUnhandlableOOM("OOM in createJitRuntime");
+ }
+
+ return jitRuntime_;
+ }
+
+ bool
+ JSCompartment::ensureJitCompartmentExists(JSContext* cx)
+ {
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch
new file mode 100644
index 0000000000..e87b95f729
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch
@@ -0,0 +1,189 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/f31d643afd41
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1233925
+
+# HG changeset patch
+# User Jan de Mooij <[email protected]>
+# Date 1452110721 -3600
+# Node ID f31d643afd4159b5422ae5aebcbbea0a088e018e
+# Parent 4444e94a99cb9b00c0351cc8bf5459739cc036a5
+Bug 1233925 - Treat functions with rest more like functions with lazy arguments. r=nbp a=ritu
+
+diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
+--- a/js/src/jit/BacktrackingAllocator.cpp
++++ b/js/src/jit/BacktrackingAllocator.cpp
+@@ -201,20 +201,19 @@ BacktrackingAllocator::tryGroupRegisters
+ // constructor calling convention.
+ if (IsThisSlotDefinition(reg0->def()) || IsThisSlotDefinition(reg1->def())) {
+ if (*reg0->def()->output() != *reg1->def()->output())
+ return true;
+ }
+
+ // Registers which might spill to the frame's argument slots can only be
+ // grouped with other such registers if the frame might access those
+- // arguments through a lazy arguments object.
++ // arguments through a lazy arguments object or rest parameter.
+ if (IsArgumentSlotDefinition(reg0->def()) || IsArgumentSlotDefinition(reg1->def())) {
+- JSScript* script = graph.mir().entryBlock()->info().script();
+- if (script && script->argumentsAliasesFormals()) {
++ if (graph.mir().entryBlock()->info().mayReadFrameArgsDirectly()) {
+ if (*reg0->def()->output() != *reg1->def()->output())
+ return true;
+ }
+ }
+
+ VirtualRegisterGroup* group0 = reg0->group(), *group1 = reg1->group();
+
+ if (!group0 && group1)
+diff --git a/js/src/jit/CompileInfo.h b/js/src/jit/CompileInfo.h
+--- a/js/src/jit/CompileInfo.h
++++ b/js/src/jit/CompileInfo.h
+@@ -194,16 +194,17 @@ enum AnalysisMode {
+ class CompileInfo
+ {
+ public:
+ CompileInfo(JSScript* script, JSFunction* fun, jsbytecode* osrPc, bool constructing,
+ AnalysisMode analysisMode, bool scriptNeedsArgsObj,
+ InlineScriptTree* inlineScriptTree)
+ : script_(script), fun_(fun), osrPc_(osrPc), constructing_(constructing),
+ analysisMode_(analysisMode), scriptNeedsArgsObj_(scriptNeedsArgsObj),
++ mayReadFrameArgsDirectly_(script->mayReadFrameArgsDirectly()),
+ inlineScriptTree_(inlineScriptTree)
+ {
+ MOZ_ASSERT_IF(osrPc, JSOp(*osrPc) == JSOP_LOOPENTRY);
+
+ // The function here can flow in from anywhere so look up the canonical
+ // function to ensure that we do not try to embed a nursery pointer in
+ // jit-code. Precisely because it can flow in from anywhere, it's not
+ // guaranteed to be non-lazy. Hence, don't access its script!
+@@ -222,17 +223,17 @@ class CompileInfo
+ fixedLexicalBegin_ = script->fixedLexicalBegin();
+ nstack_ = script->nslots() - script->nfixed();
+ nslots_ = nimplicit_ + nargs_ + nlocals_ + nstack_;
+ }
+
+ explicit CompileInfo(unsigned nlocals)
+ : script_(nullptr), fun_(nullptr), osrPc_(nullptr), osrStaticScope_(nullptr),
+ constructing_(false), analysisMode_(Analysis_None), scriptNeedsArgsObj_(false),
+- inlineScriptTree_(nullptr)
++ mayReadFrameArgsDirectly_(false), inlineScriptTree_(nullptr)
+ {
+ nimplicit_ = 0;
+ nargs_ = 0;
+ nbodyfixed_ = 0;
+ nlocals_ = nlocals;
+ nstack_ = 1; /* For FunctionCompiler::pushPhiInput/popPhiOutput */
+ nslots_ = nlocals_ + nstack_;
+ fixedLexicalBegin_ = nlocals;
+@@ -539,16 +540,20 @@ class CompileInfo
+ return false;
+
+ if (needsArgsObj() && isObservableArgumentSlot(slot))
+ return false;
+
+ return true;
+ }
+
++ bool mayReadFrameArgsDirectly() const {
++ return mayReadFrameArgsDirectly_;
++ }
++
+ private:
+ unsigned nimplicit_;
+ unsigned nargs_;
+ unsigned nbodyfixed_;
+ unsigned nlocals_;
+ unsigned nstack_;
+ unsigned nslots_;
+ unsigned fixedLexicalBegin_;
+@@ -559,15 +564,17 @@ class CompileInfo
+ bool constructing_;
+ AnalysisMode analysisMode_;
+
+ // Whether a script needs an arguments object is unstable over compilation
+ // since the arguments optimization could be marked as failed on the main
+ // thread, so cache a value here and use it throughout for consistency.
+ bool scriptNeedsArgsObj_;
+
++ bool mayReadFrameArgsDirectly_;
++
+ InlineScriptTree* inlineScriptTree_;
+ };
+
+ } // namespace jit
+ } // namespace js
+
+ #endif /* jit_CompileInfo_h */
+diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
+--- a/js/src/jit/JitFrames.cpp
++++ b/js/src/jit/JitFrames.cpp
+@@ -1002,17 +1002,17 @@ MarkThisAndArguments(JSTracer* trc, JitF
+ // formal arguments is taken care of by the frame's safepoint/snapshot,
+ // except when the script's lazy arguments object aliases those formals,
+ // in which case we mark them as well.
+
+ size_t nargs = layout->numActualArgs();
+ size_t nformals = 0;
+ if (CalleeTokenIsFunction(layout->calleeToken())) {
+ JSFunction* fun = CalleeTokenToFunction(layout->calleeToken());
+- nformals = fun->nonLazyScript()->argumentsAliasesFormals() ? 0 : fun->nargs();
++ nformals = fun->nonLazyScript()->mayReadFrameArgsDirectly() ? 0 : fun->nargs();
+ }
+
+ Value* argv = layout->argv();
+
+ // Trace |this|.
+ gc::MarkValueRoot(trc, argv, "ion-thisv");
+
+ // Trace actual arguments beyond the formals. Note + 1 for thisv.
+diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
+--- a/js/src/jsscript.cpp
++++ b/js/src/jsscript.cpp
+@@ -3894,16 +3894,22 @@ JSScript::hasLoops()
+ JSTryNote* tnlimit = tn + trynotes()->length;
+ for (; tn < tnlimit; tn++) {
+ if (tn->kind == JSTRY_FOR_IN || tn->kind == JSTRY_LOOP)
+ return true;
+ }
+ return false;
+ }
+
++bool
++JSScript::mayReadFrameArgsDirectly()
++{
++ return argumentsHasVarBinding() || (function_ && function_->hasRest());
++}
++
+ static inline void
+ LazyScriptHash(uint32_t lineno, uint32_t column, uint32_t begin, uint32_t end,
+ HashNumber hashes[3])
+ {
+ HashNumber hash = lineno;
+ hash = RotateLeft(hash, 4) ^ column;
+ hash = RotateLeft(hash, 4) ^ begin;
+ hash = RotateLeft(hash, 4) ^ end;
+diff --git a/js/src/jsscript.h b/js/src/jsscript.h
+--- a/js/src/jsscript.h
++++ b/js/src/jsscript.h
+@@ -1397,16 +1397,20 @@ class JSScript : public js::gc::TenuredC
+ }
+ inline void setFunction(JSFunction* fun);
+ /*
+ * De-lazifies the canonical function. Must be called before entering code
+ * that expects the function to be non-lazy.
+ */
+ inline void ensureNonLazyCanonicalFunction(JSContext* cx);
+
++ // Returns true if the script may read formal arguments on the stack
++ // directly, via lazy arguments or a rest parameter.
++ bool mayReadFrameArgsDirectly();
++
+ JSFlatString* sourceData(JSContext* cx);
+
+ static bool loadSource(JSContext* cx, js::ScriptSource* ss, bool* worked);
+
+ void setSourceObject(JSObject* object);
+ JSObject* sourceObject() const {
+ return sourceObject_;
+ }
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch
new file mode 100644
index 0000000000..b92bfa4f4e
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch
@@ -0,0 +1,33 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/debff255c08e
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1234571
+
+# HG changeset patch
+# User Randell Jesup <[email protected]>
+# Date 1451928471 18000
+# Node ID debff255c08e898be370e307e1e014f5601c20c6
+# Parent f31d643afd4159b5422ae5aebcbbea0a088e018e
+Bug 1234571 - unregister encoded-frame callback when releasing codec databases. r=pkerr, a=al
+
+diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc
+--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc
++++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/generic_encoder.cc
+@@ -71,16 +71,17 @@ VCMGenericEncoder::VCMGenericEncoder(Vid
+ VCMGenericEncoder::~VCMGenericEncoder()
+ {
+ }
+
+ int32_t VCMGenericEncoder::Release()
+ {
+ _bitRate = 0;
+ _frameRate = 0;
++ _encoder.RegisterEncodeCompleteCallback(NULL);
+ _VCMencodedFrameCallback = NULL;
+ return _encoder.Release();
+ }
+
+ int32_t
+ VCMGenericEncoder::InitEncode(const VideoCodec* settings,
+ int32_t numberOfCores,
+ uint32_t maxPayloadSize)
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch
new file mode 100644
index 0000000000..2e409d961c
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch
@@ -0,0 +1,183 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/0f7224441f20
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1234280
+
+# HG changeset patch
+# User Benjamin Bouvier <[email protected]>
+# Date 1450947090 -3600
+# Node ID 0f7224441f2089001f7934b46ac10cb72d267606
+# Parent debff255c08e898be370e307e1e014f5601c20c6
+Bug 1234280: Handle oom in CodeGeneratorShared::allocateData; r=jandem, a=sledru
+
+diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
+--- a/js/src/jit/CodeGenerator.cpp
++++ b/js/src/jit/CodeGenerator.cpp
+@@ -7902,17 +7902,19 @@ const VMFunction GetPropertyIC::UpdateIn
+ void
+ CodeGenerator::visitGetPropertyIC(OutOfLineUpdateCache* ool, DataPtr<GetPropertyIC>& ic)
+ {
+ LInstruction* lir = ool->lir();
+
+ if (ic->idempotent()) {
+ size_t numLocs;
+ CacheLocationList& cacheLocs = lir->mirRaw()->toGetPropertyCache()->location();
+- size_t locationBase = addCacheLocations(cacheLocs, &numLocs);
++ size_t locationBase;
++ if (!addCacheLocations(cacheLocs, &numLocs, &locationBase))
++ return;
+ ic->setLocationInfo(locationBase, numLocs);
+ }
+
+ saveLive(lir);
+
+ pushArg(ic->object());
+ pushArg(Imm32(ool->getCacheIndex()));
+ pushArg(ImmGCPtr(gen->info().script()));
+diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
+--- a/js/src/jit/shared/CodeGenerator-shared.cpp
++++ b/js/src/jit/shared/CodeGenerator-shared.cpp
+@@ -1527,31 +1527,34 @@ CodeGeneratorShared::jumpToBlock(MBasicB
+
+ masm.propagateOOM(patchableBackedges_.append(PatchableBackedgeInfo(backedge, mir->lir()->label(), oolEntry)));
+ } else {
+ masm.j(cond, mir->lir()->label());
+ }
+ }
+ #endif
+
+-size_t
+-CodeGeneratorShared::addCacheLocations(const CacheLocationList& locs, size_t* numLocs)
++MOZ_WARN_UNUSED_RESULT bool
++CodeGeneratorShared::addCacheLocations(const CacheLocationList& locs, size_t* numLocs,
++ size_t* curIndex)
+ {
+ size_t firstIndex = runtimeData_.length();
+ size_t numLocations = 0;
+ for (CacheLocationList::iterator iter = locs.begin(); iter != locs.end(); iter++) {
+ // allocateData() ensures that sizeof(CacheLocation) is word-aligned.
+ // If this changes, we will need to pad to ensure alignment.
+- size_t curIndex = allocateData(sizeof(CacheLocation));
+- new (&runtimeData_[curIndex]) CacheLocation(iter->pc, iter->script);
++ if (!allocateData(sizeof(CacheLocation), curIndex))
++ return false;
++ new (&runtimeData_[*curIndex]) CacheLocation(iter->pc, iter->script);
+ numLocations++;
+ }
+ MOZ_ASSERT(numLocations != 0);
+ *numLocs = numLocations;
+- return firstIndex;
++ *curIndex = firstIndex;
++ return true;
+ }
+
+ ReciprocalMulConstants
+ CodeGeneratorShared::computeDivisionConstants(int d) {
+ // In what follows, d is positive and is not a power of 2.
+ MOZ_ASSERT(d > 0 && (d & (d - 1)) != 0);
+
+ // Speeding up division by non power-of-2 constants is possible by
+diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h
+--- a/js/src/jit/shared/CodeGenerator-shared.h
++++ b/js/src/jit/shared/CodeGenerator-shared.h
+@@ -3,16 +3,17 @@
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+ #ifndef jit_shared_CodeGenerator_shared_h
+ #define jit_shared_CodeGenerator_shared_h
+
+ #include "mozilla/Alignment.h"
++#include "mozilla/TypeTraits.h"
+
+ #include "jit/JitFrames.h"
+ #include "jit/LIR.h"
+ #include "jit/MacroAssembler.h"
+ #include "jit/MIRGenerator.h"
+ #include "jit/MIRGraph.h"
+ #include "jit/OptimizationTracking.h"
+ #include "jit/Safepoints.h"
+@@ -242,24 +243,16 @@ class CodeGeneratorShared : public LElem
+ return SlotToStackOffset(a->toStackSlot()->slot());
+ }
+
+ uint32_t frameSize() const {
+ return frameClass_ == FrameSizeClass::None() ? frameDepth_ : frameClass_.frameSize();
+ }
+
+ protected:
+- // Ensure the cache is an IonCache while expecting the size of the derived
+- // class. We only need the cache list at GC time. Everyone else can just take
+- // runtimeData offsets.
+- size_t allocateCache(const IonCache&, size_t size) {
+- size_t dataOffset = allocateData(size);
+- masm.propagateOOM(cacheList_.append(dataOffset));
+- return dataOffset;
+- }
+
+ #ifdef CHECK_OSIPOINT_REGISTERS
+ void resetOsiPointRegs(LSafepoint* safepoint);
+ bool shouldVerifyOsiPointRegs(LSafepoint* safepoint);
+ void verifyOsiPointRegs(LSafepoint* safepoint);
+ #endif
+
+ bool addNativeToBytecodeEntry(const BytecodeSite* site);
+@@ -295,27 +288,33 @@ class CodeGeneratorShared : public LElem
+ return lookup();
+ }
+ T * operator*() {
+ return lookup();
+ }
+ };
+
+ protected:
+-
+- size_t allocateData(size_t size) {
++ MOZ_WARN_UNUSED_RESULT
++ bool allocateData(size_t size, size_t* offset) {
+ MOZ_ASSERT(size % sizeof(void*) == 0);
+- size_t dataOffset = runtimeData_.length();
++ *offset = runtimeData_.length();
+ masm.propagateOOM(runtimeData_.appendN(0, size));
+- return dataOffset;
++ return !masm.oom();
+ }
+
++ // Ensure the cache is an IonCache while expecting the size of the derived
++ // class. We only need the cache list at GC time. Everyone else can just take
++ // runtimeData offsets.
+ template <typename T>
+ inline size_t allocateCache(const T& cache) {
+- size_t index = allocateCache(cache, sizeof(mozilla::AlignedStorage2<T>));
++ static_assert(mozilla::IsBaseOf<IonCache, T>::value, "T must inherit from IonCache");
++ size_t index;
++ masm.propagateOOM(allocateData(sizeof(mozilla::AlignedStorage2<T>), &index));
++ masm.propagateOOM(cacheList_.append(index));
+ if (masm.oom())
+ return SIZE_MAX;
+ // Use the copy constructor on the allocated space.
+ MOZ_ASSERT(index == cacheList_.back());
+ new (&runtimeData_[index]) T(cache);
+ return index;
+ }
+
+@@ -475,17 +474,17 @@ class CodeGeneratorShared : public LElem
+
+ void callVM(const VMFunction& f, LInstruction* ins, const Register* dynStack = nullptr);
+
+ template <class ArgSeq, class StoreOutputTo>
+ inline OutOfLineCode* oolCallVM(const VMFunction& fun, LInstruction* ins, const ArgSeq& args,
+ const StoreOutputTo& out);
+
+ void addCache(LInstruction* lir, size_t cacheIndex);
+- size_t addCacheLocations(const CacheLocationList& locs, size_t* numLocs);
++ bool addCacheLocations(const CacheLocationList& locs, size_t* numLocs, size_t* offset);
+ ReciprocalMulConstants computeDivisionConstants(int d);
+
+ protected:
+ void addOutOfLineCode(OutOfLineCode* code, const MInstruction* mir);
+ void addOutOfLineCode(OutOfLineCode* code, const BytecodeSite* site);
+ bool hasOutOfLineCode() { return !outOfLineCode_.empty(); }
+ bool generateOutOfLineCode();
+
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch
new file mode 100644
index 0000000000..7861e24c89
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch
@@ -0,0 +1,91 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/8c184c30caa6
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230668
+
+# HG changeset patch
+# User L. David Baron <[email protected]>
+# Date 1452248144 -39600
+# Node ID 8c184c30caa6d16f5ec63cce9a77d16f25d2e57e
+# Parent 0f7224441f2089001f7934b46ac10cb72d267606
+Bug 1230668 - Don't use frame when not in composed document. r=heycam a=sylvestre
+
+diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
+--- a/layout/style/nsComputedDOMStyle.cpp
++++ b/layout/style/nsComputedDOMStyle.cpp
+@@ -421,26 +421,31 @@ nsComputedDOMStyle::GetStyleContextForEl
+ {
+ MOZ_ASSERT(aElement, "NULL element");
+ // If the content has a pres shell, we must use it. Otherwise we'd
+ // potentially mix rule trees by using the wrong pres shell's style
+ // set. Using the pres shell from the content also means that any
+ // content that's actually *in* a document will get the style from the
+ // correct document.
+ nsIPresShell *presShell = GetPresShellForContent(aElement);
++ bool inDocWithShell = true;
+ if (!presShell) {
++ inDocWithShell = false;
+ presShell = aPresShell;
+ if (!presShell)
+ return nullptr;
+ }
+
+- // XXX the !aElement->IsHTML(nsGkAtoms::area)
+- // check is needed due to bug 135040 (to avoid using
++ // XXX the !aElement->IsHTML(nsGkAtoms::area)
++ // check is needed due to bug 135040 (to avoid using
+ // mPrimaryFrame). Remove it once that's fixed.
+- if (!aPseudo && aStyleType == eAll && !aElement->IsHTML(nsGkAtoms::area)) {
++ if (!aPseudo && aStyleType == eAll && inDocWithShell &&
++ !aElement->IsHTML(nsGkAtoms::area)) {
++ if (!aPseudo && aStyleType == eAll && inDocWithShell &&
++ !aElement->IsHTMLElement(nsGkAtoms::area)) {
+ nsIFrame* frame = nsLayoutUtils::GetStyleFrame(aElement);
+ if (frame) {
+ nsStyleContext* result = frame->StyleContext();
+ // Don't use the style context if it was influenced by
+ // pseudo-elements, since then it's not the primary style
+ // for this element.
+ if (!result->HasPseudoElementData()) {
+ // this function returns an addrefed style context
+@@ -468,17 +473,18 @@ nsComputedDOMStyle::GetStyleContextForEl
+
+ nsRefPtr<nsStyleContext> sc;
+ if (aPseudo) {
+ nsCSSPseudoElements::Type type = nsCSSPseudoElements::GetPseudoType(aPseudo);
+ if (type >= nsCSSPseudoElements::ePseudo_PseudoElementCount) {
+ return nullptr;
+ }
+ nsIFrame* frame = nsLayoutUtils::GetStyleFrame(aElement);
+- Element* pseudoElement = frame ? frame->GetPseudoElement(type) : nullptr;
++ Element* pseudoElement =
++ frame && inDocWithShell ? frame->GetPseudoElement(type) : nullptr;
+ sc = styleSet->ResolvePseudoElementStyle(aElement, type, parentContext,
+ pseudoElement);
+ } else {
+ sc = styleSet->ResolveStyleFor(aElement, parentContext);
+ }
+
+ if (aStyleType == eDefaultOnly) {
+ // We really only want the user and UA rules. Filter out the other ones.
+@@ -592,18 +598,18 @@ nsComputedDOMStyle::UpdateCurrentStyleSo
+ mFlushedPendingReflows = aNeedsLayoutFlush;
+ #endif
+
+ mPresShell = document->GetShell();
+ if (!mPresShell || !mPresShell->GetPresContext()) {
+ return;
+ }
+
+- // XXX the !mContent->IsHTML(nsGkAtoms::area)
+- // check is needed due to bug 135040 (to avoid using
++ // XXX the !mContent->IsHTML(nsGkAtoms::area)
++ // check is needed due to bug 135040 (to avoid using
+ // mPrimaryFrame). Remove it once that's fixed.
+ if (!mPseudo && mStyleType == eAll && !mContent->IsHTML(nsGkAtoms::area)) {
+ mOuterFrame = mContent->GetPrimaryFrame();
+ mInnerFrame = mOuterFrame;
+ if (mOuterFrame) {
+ nsIAtom* type = mOuterFrame->GetType();
+ if (type == nsGkAtoms::tableOuterFrame) {
+ // If the frame is an outer table frame then we should get the style
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch
new file mode 100644
index 0000000000..0e5825becf
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch
@@ -0,0 +1,34 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/fceff80a84a3
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230668
+
+# HG changeset patch
+# User Wes Kocher <[email protected]>
+# Date 1452542163 28800
+# Node ID fceff80a84a32b68d02abc00486fe6c7b86d545b
+# Parent 8c184c30caa6d16f5ec63cce9a77d16f25d2e57e
+Fix up some rebase errors in bug 1230668 r=me a=bustage
+
+diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
+--- a/layout/style/nsComputedDOMStyle.cpp
++++ b/layout/style/nsComputedDOMStyle.cpp
+@@ -434,18 +434,16 @@ nsComputedDOMStyle::GetStyleContextForEl
+ return nullptr;
+ }
+
+ // XXX the !aElement->IsHTML(nsGkAtoms::area)
+ // check is needed due to bug 135040 (to avoid using
+ // mPrimaryFrame). Remove it once that's fixed.
+ if (!aPseudo && aStyleType == eAll && inDocWithShell &&
+ !aElement->IsHTML(nsGkAtoms::area)) {
+- if (!aPseudo && aStyleType == eAll && inDocWithShell &&
+- !aElement->IsHTMLElement(nsGkAtoms::area)) {
+ nsIFrame* frame = nsLayoutUtils::GetStyleFrame(aElement);
+ if (frame) {
+ nsStyleContext* result = frame->StyleContext();
+ // Don't use the style context if it was influenced by
+ // pseudo-elements, since then it's not the primary style
+ // for this element.
+ if (!result->HasPseudoElementData()) {
+ // this function returns an addrefed style context
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch
new file mode 100644
index 0000000000..02c1af1775
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch
@@ -0,0 +1,83 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/94a95291d095
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1224200
+
+# HG changeset patch
+# User Timothy Nikkel <[email protected]>
+# Date 1453303652 -3600
+# Node ID 94a95291d0958439dbed5b7dc99fae59e1318592
+# Parent 999c13acb40e1113306c65925a7d96688339d945
+Bug 1224200 - Allow downscaler to get (and ignore) new input lines after it has finished producing all output lines. r=seth, a=lizzard
+
+diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
+--- a/image/src/Downscaler.cpp
++++ b/image/src/Downscaler.cpp
+@@ -145,43 +145,44 @@ GetFilterOffsetAndLength(UniquePtr<skia:
+ aFilterLengthOut);
+ }
+
+ void
+ Downscaler::CommitRow()
+ {
+ MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
+ MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
+- MOZ_ASSERT(mCurrentOutLine < mTargetSize.height, "Past end of output");
+
+- int32_t filterOffset = 0;
+- int32_t filterLength = 0;
+- GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+- &filterOffset, &filterLength);
++ if (mCurrentOutLine < mTargetSize.height) {
++ int32_t filterOffset = 0;
++ int32_t filterLength = 0;
++ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++ &filterOffset, &filterLength);
+
+- int32_t inLineToRead = filterOffset + mLinesInBuffer;
+- MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+- if (mCurrentInLine == inLineToRead) {
+- skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+- mWindow[mLinesInBuffer++], mHasAlpha,
+- /* use_sse2 = */ true);
+- }
+-
+- MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+- "Writing past end of output");
+-
+- while (mLinesInBuffer == filterLength) {
+- DownscaleInputLine();
+-
+- if (mCurrentOutLine == mTargetSize.height) {
+- break; // We're done.
++ int32_t inLineToRead = filterOffset + mLinesInBuffer;
++ MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
++ if (mCurrentInLine == inLineToRead) {
++ skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
++ mWindow[mLinesInBuffer++], mHasAlpha,
++ /* use_sse2 = */ true);
+ }
+
+- GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+- &filterOffset, &filterLength);
++ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
++ "Writing past end of output");
++
++ while (mLinesInBuffer == filterLength) {
++ DownscaleInputLine();
++
++ if (mCurrentOutLine == mTargetSize.height) {
++ break; // We're done.
++ }
++
++ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++ &filterOffset, &filterLength);
++ }
+ }
+
+ mCurrentInLine += 1;
+ }
+
+ bool
+ Downscaler::HasInvalidation() const
+ {
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch
new file mode 100644
index 0000000000..9ebf18a5d3
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch
@@ -0,0 +1,35 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/ee68c3dae5f6
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230483
+
+# HG changeset patch
+# User JW Wang <[email protected]>
+# Date 1450698943 -28800
+# Node ID ee68c3dae5f639fdd439f69ef2f724067fce0ea6
+# Parent 762d015e1854c28c213293ac1e9b2ab51cf201f9
+Bug 1230483 - Part 2 - LoadFromSourceChildren() should be queued at most once in an event cycle. r=roc, a=lizzard
+
+diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
+--- a/dom/html/HTMLMediaElement.cpp
++++ b/dom/html/HTMLMediaElement.cpp
+@@ -4033,16 +4033,19 @@ void HTMLMediaElement::NotifyAddedSource
+ mNetworkState == nsIDOMHTMLMediaElement::NETWORK_EMPTY)
+ {
+ QueueSelectResourceTask();
+ }
+
+ // A load was paused in the resource selection algorithm, waiting for
+ // a new source child to be added, resume the resource selection algorithm.
+ if (mLoadWaitStatus == WAITING_FOR_SOURCE) {
++ // Rest the flag so we don't queue multiple LoadFromSourceTask() when
++ // multiple <source> are attached in an event loop.
++ mLoadWaitStatus = NOT_WAITING;
+ QueueLoadFromSourceTask();
+ }
+ }
+
+ nsIContent* HTMLMediaElement::GetNextSource()
+ {
+ nsCOMPtr<nsIDOMNode> thisDomNode = do_QueryObject(this);
+
+
diff --git a/gnu/packages/patches/icecat-CVE-2016-1935.patch b/gnu/packages/patches/icecat-CVE-2016-1935.patch
new file mode 100644
index 0000000000..a6db4b9b6a
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1935.patch
@@ -0,0 +1,77 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/f9aad6c0253a
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1220450
+
+# HG changeset patch
+# User Jeff Gilbert <[email protected]>
+# Date 1452570660 28800
+# Node ID f9aad6c0253a3b81699a3d7a05e78615dd814ea3
+# Parent c47640f24251b48c0bba9d2f0f6ee059eca58362
+Bug 1220450 - Clear length on cache OOM. r=kamidphish, a=ritu
+
+diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp
+--- a/dom/canvas/WebGLContextBuffers.cpp
++++ b/dom/canvas/WebGLContextBuffers.cpp
+@@ -185,16 +185,17 @@ WebGLContext::BufferData(GLenum target,
+
+ if (error) {
+ GenerateWarning("bufferData generated error %s", ErrorName(error));
+ return;
+ }
+
+ boundBuffer->SetByteLength(size);
+ if (!boundBuffer->ElementArrayCacheBufferData(nullptr, size)) {
++ boundBuffer->SetByteLength(0);
+ return ErrorOutOfMemory("bufferData: out of memory");
+ }
+ }
+
+ void
+ WebGLContext::BufferData(GLenum target,
+ const dom::Nullable<dom::ArrayBuffer>& maybeData,
+ GLenum usage)
+@@ -234,18 +235,20 @@ WebGLContext::BufferData(GLenum target,
+ GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
+
+ if (error) {
+ GenerateWarning("bufferData generated error %s", ErrorName(error));
+ return;
+ }
+
+ boundBuffer->SetByteLength(data.Length());
+- if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length()))
++ if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) {
++ boundBuffer->SetByteLength(0);
+ return ErrorOutOfMemory("bufferData: out of memory");
++ }
+ }
+
+ void
+ WebGLContext::BufferData(GLenum target, const dom::ArrayBufferView& data,
+ GLenum usage)
+ {
+ if (IsContextLost())
+ return;
+@@ -274,18 +277,20 @@ WebGLContext::BufferData(GLenum target,
+
+ GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
+ if (error) {
+ GenerateWarning("bufferData generated error %s", ErrorName(error));
+ return;
+ }
+
+ boundBuffer->SetByteLength(data.Length());
+- if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length()))
++ if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) {
++ boundBuffer->SetByteLength(0);
+ return ErrorOutOfMemory("bufferData: out of memory");
++ }
+ }
+
+ void
+ WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
+ const dom::Nullable<dom::ArrayBuffer>& maybeData)
+ {
+ if (IsContextLost())
+ return;
+
diff --git a/gnu/packages/patches/icecat-bug-1146335-pt1.patch b/gnu/packages/patches/icecat-bug-1146335-pt1.patch
new file mode 100644
index 0000000000..a41e638b2f
--- /dev/null
+++ b/gnu/packages/patches/icecat-bug-1146335-pt1.patch
@@ -0,0 +1,141 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/9d14787bd10e
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1146335
+
+# HG changeset patch
+# User Seth Fowler <[email protected]>
+# Date 1428627143 25200
+# Node ID 9d14787bd10e6f3013263a2cae0bcc78bebde1db
+# Parent aaf922ae679685acb5d2b8ffa5f0bf22f1e6987a
+Bug 1146335 (Part 1) - Add assertions and fix style issues in image::Downscaler. r=tn a=lizzard
+
+diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
+--- a/image/src/Downscaler.cpp
++++ b/image/src/Downscaler.cpp
+@@ -72,23 +72,25 @@ Downscaler::BeginFrame(const nsIntSize&
+ mOutputBuffer = aOutputBuffer;
+ mHasAlpha = aHasAlpha;
+
+ ResetForNextProgressivePass();
+ ReleaseWindow();
+
+ auto resizeMethod = skia::ImageOperations::RESIZE_LANCZOS3;
+
+- skia::resize::ComputeFilters(resizeMethod, mOriginalSize.width,
+- mTargetSize.width, 0,
+- mTargetSize.width, mXFilter.get());
++ skia::resize::ComputeFilters(resizeMethod,
++ mOriginalSize.width, mTargetSize.width,
++ 0, mTargetSize.width,
++ mXFilter.get());
+
+- skia::resize::ComputeFilters(resizeMethod, mOriginalSize.height,
+- mTargetSize.height, 0,
+- mTargetSize.height, mYFilter.get());
++ skia::resize::ComputeFilters(resizeMethod,
++ mOriginalSize.height, mTargetSize.height,
++ 0, mTargetSize.height,
++ mYFilter.get());
+
+ // Allocate the buffer, which contains scanlines of the original image.
+ size_t bufferLen = mOriginalSize.width * sizeof(uint32_t);
+ mRowBuffer = MakeUnique<uint8_t[]>(bufferLen);
+ if (MOZ_UNLIKELY(!mRowBuffer)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+@@ -126,39 +128,54 @@ void
+ Downscaler::ResetForNextProgressivePass()
+ {
+ mPrevInvalidatedLine = 0;
+ mCurrentOutLine = 0;
+ mCurrentInLine = 0;
+ mLinesInBuffer = 0;
+ }
+
++static void
++GetFilterOffsetAndLength(UniquePtr<skia::ConvolutionFilter1D>& aFilter,
++ int32_t aOutputImagePosition,
++ int32_t* aFilterOffsetOut,
++ int32_t* aFilterLengthOut)
++{
++ MOZ_ASSERT(aOutputImagePosition < aFilter->num_values());
++ aFilter->FilterForValue(aOutputImagePosition,
++ aFilterOffsetOut,
++ aFilterLengthOut);
++}
++
+ void
+ Downscaler::CommitRow()
+ {
+ MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
+ MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height, "Past end of output");
+
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
+- mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
++ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++ &filterOffset, &filterLength);
+
+ int32_t inLineToRead = filterOffset + mLinesInBuffer;
+ MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+ if (mCurrentInLine == inLineToRead) {
+ skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+ mWindow[mLinesInBuffer++], mHasAlpha,
+ /* use_sse2 = */ true);
+ }
+
+ while (mLinesInBuffer == filterLength &&
+ mCurrentOutLine < mTargetSize.height) {
+ DownscaleInputLine();
+- mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
++
++ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++ &filterOffset, &filterLength);
+ }
+
+ mCurrentInLine += 1;
+ }
+
+ bool
+ Downscaler::HasInvalidation() const
+ {
+@@ -184,16 +201,17 @@ Downscaler::DownscaleInputLine()
+ {
+ typedef skia::ConvolutionFilter1D::Fixed FilterValue;
+
+ MOZ_ASSERT(mOutputBuffer);
+ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height, "Writing past end of output");
+
+ int32_t filterOffset = 0;
+ int32_t filterLength = 0;
++ MOZ_ASSERT(mCurrentOutLine < mYFilter->num_values());
+ auto filterValues =
+ mYFilter->FilterForValue(mCurrentOutLine, &filterOffset, &filterLength);
+
+ uint8_t* outputLine =
+ &mOutputBuffer[mCurrentOutLine * mTargetSize.width * sizeof(uint32_t)];
+ skia::ConvolveVertically(static_cast<const FilterValue*>(filterValues),
+ filterLength, mWindow.get(), mXFilter->num_values(),
+ outputLine, mHasAlpha, /* use_sse2 = */ true);
+@@ -202,17 +220,18 @@ Downscaler::DownscaleInputLine()
+
+ if (mCurrentOutLine == mTargetSize.height) {
+ // We're done.
+ return;
+ }
+
+ int32_t newFilterOffset = 0;
+ int32_t newFilterLength = 0;
+- mYFilter->FilterForValue(mCurrentOutLine, &newFilterOffset, &newFilterLength);
++ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++ &newFilterOffset, &newFilterLength);
+
+ int diff = newFilterOffset - filterOffset;
+ MOZ_ASSERT(diff >= 0, "Moving backwards in the filter?");
+
+ // Shift the buffer. We're just moving pointers here, so this is cheap.
+ mLinesInBuffer -= diff;
+ mLinesInBuffer = max(mLinesInBuffer, 0);
+ for (int32_t i = 0; i < mLinesInBuffer; ++i) {
+
diff --git a/gnu/packages/patches/icecat-bug-1146335-pt2.patch b/gnu/packages/patches/icecat-bug-1146335-pt2.patch
new file mode 100644
index 0000000000..240e0cfc66
--- /dev/null
+++ b/gnu/packages/patches/icecat-bug-1146335-pt2.patch
@@ -0,0 +1,43 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/8bfaa27698ca
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1146335
+
+# HG changeset patch
+# User Seth Fowler <[email protected]>
+# Date 1428627143 25200
+# Node ID 8bfaa27698ca0720d5c9f3910ab7148b38db0625
+# Parent 9d14787bd10e6f3013263a2cae0bcc78bebde1db
+Bug 1146335 (Part 2) - Fix an off-by-one error in image::Downscaler. r=tn a=lizzard
+
+diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
+--- a/image/src/Downscaler.cpp
++++ b/image/src/Downscaler.cpp
+@@ -160,20 +160,26 @@ Downscaler::CommitRow()
+ int32_t inLineToRead = filterOffset + mLinesInBuffer;
+ MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+ if (mCurrentInLine == inLineToRead) {
+ skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+ mWindow[mLinesInBuffer++], mHasAlpha,
+ /* use_sse2 = */ true);
+ }
+
+- while (mLinesInBuffer == filterLength &&
+- mCurrentOutLine < mTargetSize.height) {
++ MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
++ "Writing past end of output");
++
++ while (mLinesInBuffer == filterLength) {
+ DownscaleInputLine();
+
++ if (mCurrentOutLine == mTargetSize.height) {
++ break; // We're done.
++ }
++
+ GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+ &filterOffset, &filterLength);
+ }
+
+ mCurrentInLine += 1;
+ }
+
+ bool
+
diff --git a/gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch b/gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch
new file mode 100644
index 0000000000..5a3a934dba
--- /dev/null
+++ b/gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch
@@ -0,0 +1,73 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/9632375c6aac
+
+# HG changeset patch
+# User Jeff Gilbert <[email protected]>
+# Date 1453320785 28800
+# Node ID 9632375c6aacbf673b996b53231d70b91e480fb5
+# Parent ee68c3dae5f639fdd439f69ef2f724067fce0ea6
+Limit max buffers size for ANGLE. r=jrmuizel a=lizzard
+
+diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp
+--- a/dom/canvas/WebGLContextBuffers.cpp
++++ b/dom/canvas/WebGLContextBuffers.cpp
+@@ -164,16 +164,19 @@ WebGLContext::BufferData(GLenum target,
+
+ if (!ValidateBufferUsageEnum(usage, "bufferData: usage"))
+ return;
+
+ // careful: WebGLsizeiptr is always 64-bit, but GLsizeiptr is like intptr_t.
+ if (!CheckedInt<GLsizeiptr>(size).isValid())
+ return ErrorOutOfMemory("bufferData: bad size");
+
++ if (gl->IsANGLE() && size > UINT32_MAX)
++ return ErrorOutOfMemory("bufferData: size too large");
++
+ WebGLBuffer* boundBuffer = bufferSlot.get();
+
+ if (!boundBuffer)
+ return ErrorInvalidOperation("bufferData: no buffer bound!");
+
+ UniquePtr<uint8_t> zeroBuffer((uint8_t*)moz_calloc(size, 1));
+ if (!zeroBuffer)
+ return ErrorOutOfMemory("bufferData: out of memory");
+@@ -216,16 +219,19 @@ WebGLContext::BufferData(GLenum target,
+ const dom::ArrayBuffer& data = maybeData.Value();
+ data.ComputeLengthAndData();
+
+ // Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
+ // is like intptr_t.
+ if (!CheckedInt<GLsizeiptr>(data.Length()).isValid())
+ return ErrorOutOfMemory("bufferData: bad size");
+
++ if (gl->IsANGLE() && data.Length() > UINT32_MAX)
++ return ErrorOutOfMemory("bufferData: size too large");
++
+ if (!ValidateBufferUsageEnum(usage, "bufferData: usage"))
+ return;
+
+ WebGLBuffer* boundBuffer = bufferSlot.get();
+
+ if (!boundBuffer)
+ return ErrorInvalidOperation("bufferData: no buffer bound!");
+
+@@ -267,16 +273,19 @@ WebGLContext::BufferData(GLenum target,
+
+ data.ComputeLengthAndData();
+
+ // Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
+ // is like intptr_t.
+ if (!CheckedInt<GLsizeiptr>(data.Length()).isValid())
+ return ErrorOutOfMemory("bufferData: bad size");
+
++ if (gl->IsANGLE() && data.Length() > UINT32_MAX)
++ return ErrorOutOfMemory("bufferData: size too large");
++
+ InvalidateBufferFetching();
+ MakeContextCurrent();
+
+ GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
+ if (error) {
+ GenerateWarning("bufferData generated error %s", ErrorName(error));
+ return;
+ }
+
diff --git a/gnu/packages/patches/libarchive-bsdtar-test.patch b/gnu/packages/patches/libarchive-bsdtar-test.patch
new file mode 100644
index 0000000000..6a533a9a07
--- /dev/null
+++ b/gnu/packages/patches/libarchive-bsdtar-test.patch
@@ -0,0 +1,74 @@
+commit b539b2e597b566fe3c4b49cb61c9eef83e5e052d
+Author: Pavel Raiskup <[email protected]>
+Date: Thu Jun 27 16:01:30 2013 +0200
+
+ Use ustar format in the test_option_b test
+
+ .. because the ustar archive does not store SELinux context. As the default
+ format for bsdtar is "restricted pax" (trying to store xattrs and other
+ things by default), the test failed on Fedora because our files have by
+ default SELinux context set. This results in additional data in tested
+ archive ~> and the test failed because the archive was unexpectedly big:
+
+ tar/test/test_option_b.c:41: File archive1.tar has size 3072, expected 2048
+
+ Reviewed by Konrad Kleine <[email protected]>
+
+diff --git a/tar/test/test_option_b.c b/tar/test/test_option_b.c
+index be2ae65..6fea474 100644
+--- a/tar/test/test_option_b.c
++++ b/tar/test/test_option_b.c
+@@ -25,8 +25,14 @@
+ #include "test.h"
+ __FBSDID("$FreeBSD$");
+
++#define USTAR_OPT " --format=ustar"
++
+ DEFINE_TEST(test_option_b)
+ {
++ char *testprog_ustar = malloc(strlen(testprog) + sizeof(USTAR_OPT) + 1);
++ strcpy(testprog_ustar, testprog);
++ strcat(testprog_ustar, USTAR_OPT);
++
+ assertMakeFile("file1", 0644, "file1");
+ if (systemf("cat file1 > test_cat.out 2> test_cat.err") != 0) {
+ skipping("Platform doesn't have cat");
+@@ -36,7 +42,7 @@ DEFINE_TEST(test_option_b)
+ /*
+ * Bsdtar does not pad if the output is going directly to a disk file.
+ */
+- assertEqualInt(0, systemf("%s -cf archive1.tar file1 >test1.out 2>test1.err", testprog));
++ assertEqualInt(0, systemf("%s -cf archive1.tar file1 >test1.out 2>test1.err", testprog_ustar));
+ failure("bsdtar does not pad archives written directly to regular files");
+ assertFileSize("archive1.tar", 2048);
+ assertEmptyFile("test1.out");
+@@ -46,24 +52,24 @@ DEFINE_TEST(test_option_b)
+ * Bsdtar does pad to the block size if the output is going to a socket.
+ */
+ /* Default is -b 20 */
+- assertEqualInt(0, systemf("%s -cf - file1 2>test2.err | cat >archive2.tar ", testprog));
++ assertEqualInt(0, systemf("%s -cf - file1 2>test2.err | cat >archive2.tar ", testprog_ustar));
+ failure("bsdtar does pad archives written to pipes");
+ assertFileSize("archive2.tar", 10240);
+ assertEmptyFile("test2.err");
+
+- assertEqualInt(0, systemf("%s -cf - -b 20 file1 2>test3.err | cat >archive3.tar ", testprog));
++ assertEqualInt(0, systemf("%s -cf - -b 20 file1 2>test3.err | cat >archive3.tar ", testprog_ustar));
+ assertFileSize("archive3.tar", 10240);
+ assertEmptyFile("test3.err");
+
+- assertEqualInt(0, systemf("%s -cf - -b 10 file1 2>test4.err | cat >archive4.tar ", testprog));
++ assertEqualInt(0, systemf("%s -cf - -b 10 file1 2>test4.err | cat >archive4.tar ", testprog_ustar));
+ assertFileSize("archive4.tar", 5120);
+ assertEmptyFile("test4.err");
+
+- assertEqualInt(0, systemf("%s -cf - -b 1 file1 2>test5.err | cat >archive5.tar ", testprog));
++ assertEqualInt(0, systemf("%s -cf - -b 1 file1 2>test5.err | cat >archive5.tar ", testprog_ustar));
+ assertFileSize("archive5.tar", 2048);
+ assertEmptyFile("test5.err");
+
+- assertEqualInt(0, systemf("%s -cf - -b 8192 file1 2>test6.err | cat >archive6.tar ", testprog));
++ assertEqualInt(0, systemf("%s -cf - -b 8192 file1 2>test6.err | cat >archive6.tar ", testprog_ustar));
+ assertFileSize("archive6.tar", 4194304);
+ assertEmptyFile("test6.err");
+
diff --git a/gnu/packages/patches/librsvg-tests.patch b/gnu/packages/patches/librsvg-tests.patch
deleted file mode 100644
index dc5b94e185..0000000000
--- a/gnu/packages/patches/librsvg-tests.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From e06fc71a57156123e4e50a39957100a651ab632b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=E5=AE=8B=E6=96=87=E6=AD=A6?= <[email protected]>
-Date: Sat, 17 Oct 2015 10:20:33 +0800
-Subject: [PATCH] tests/styles: Don't duplicate test names.
-
----
- tests/styles.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tests/styles.c b/tests/styles.c
-index d09b1f2..a938835 100644
---- a/tests/styles.c
-+++ b/tests/styles.c
-@@ -97,8 +97,8 @@ static const FixtureData fixtures[] =
- {"/styles/selectors/2 or more selectors (stroke)", "592207", "styles/bug592207.svg", "#target", "stroke", .expected.color = 0xff0000ff},
- {"/styles/svg-element-style", "615701", "styles/svg-class.svg", "#svg", "fill", .expected.color = 0xff0000ff},
- {"/styles/presentation attribute in svg element", "620693", "styles/bug620693.svg", "#svg", "stroke", .expected.color = 0xffff0000},
-- {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */},
-- {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}},
-+ {"/styles/!important/1", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */},
-+ {"/styles/!important/2", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}},
- {"/styles/!important/class", "614606", "styles/bug614606.svg", "#path6306", "fill", .expected.color = 0xffff0000 /* red */ },
- {"/styles/!important/element", "614606", "styles/bug614606.svg", "#path6308", "fill", .expected.color = 0xff000000},
- {"/styles/!important/#id prior than class", NULL, "styles/important.svg", "#red", "fill", .expected.color = 0xffff0000 },
---
-2.5.0
-
diff --git a/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch b/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch
new file mode 100644
index 0000000000..811516dbe9
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch
@@ -0,0 +1,107 @@
+2015-12-26 Even Rouault <even.rouault at spatialys.com>
+
+ * libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage
+ interface in case of unsupported values of SamplesPerPixel/ExtraSamples
+ for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in
+ TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and
+ CVE-2015-8683 reported by zzf of Alibaba.
+
+diff -u -r1.93 -r1.94
+--- libtiff/libtiff/tif_getimage.c 22 Nov 2015 15:31:03 -0000 1.93
++++ libtiff/libtiff/tif_getimage.c 26 Dec 2015 17:32:03 -0000 1.94
+@@ -182,20 +182,22 @@
+ "Planarconfiguration", td->td_planarconfig);
+ return (0);
+ }
+- if( td->td_samplesperpixel != 3 )
++ if( td->td_samplesperpixel != 3 || colorchannels != 3 )
+ {
+ sprintf(emsg,
+- "Sorry, can not handle image with %s=%d",
+- "Samples/pixel", td->td_samplesperpixel);
++ "Sorry, can not handle image with %s=%d, %s=%d",
++ "Samples/pixel", td->td_samplesperpixel,
++ "colorchannels", colorchannels);
+ return 0;
+ }
+ break;
+ case PHOTOMETRIC_CIELAB:
+- if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
++ if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
+ {
+ sprintf(emsg,
+- "Sorry, can not handle image with %s=%d and %s=%d",
++ "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
+ "Samples/pixel", td->td_samplesperpixel,
++ "colorchannels", colorchannels,
+ "Bits/sample", td->td_bitspersample);
+ return 0;
+ }
+@@ -255,6 +257,9 @@
+ int colorchannels;
+ uint16 *red_orig, *green_orig, *blue_orig;
+ int n_color;
++
++ if( !TIFFRGBAImageOK(tif, emsg) )
++ return 0;
+
+ /* Initialize to normal values */
+ img->row_offset = 0;
+@@ -2509,29 +2514,33 @@
+ case PHOTOMETRIC_RGB:
+ switch (img->bitspersample) {
+ case 8:
+- if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
++ if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
++ img->samplesperpixel >= 4)
+ img->put.contig = putRGBAAcontig8bittile;
+- else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
++ else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
++ img->samplesperpixel >= 4)
+ {
+ if (BuildMapUaToAa(img))
+ img->put.contig = putRGBUAcontig8bittile;
+ }
+- else
++ else if( img->samplesperpixel >= 3 )
+ img->put.contig = putRGBcontig8bittile;
+ break;
+ case 16:
+- if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
++ if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
++ img->samplesperpixel >=4 )
+ {
+ if (BuildMapBitdepth16To8(img))
+ img->put.contig = putRGBAAcontig16bittile;
+ }
+- else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
++ else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
++ img->samplesperpixel >=4 )
+ {
+ if (BuildMapBitdepth16To8(img) &&
+ BuildMapUaToAa(img))
+ img->put.contig = putRGBUAcontig16bittile;
+ }
+- else
++ else if( img->samplesperpixel >=3 )
+ {
+ if (BuildMapBitdepth16To8(img))
+ img->put.contig = putRGBcontig16bittile;
+@@ -2540,7 +2549,7 @@
+ }
+ break;
+ case PHOTOMETRIC_SEPARATED:
+- if (buildMap(img)) {
++ if (img->samplesperpixel >=4 && buildMap(img)) {
+ if (img->bitspersample == 8) {
+ if (!img->Map)
+ img->put.contig = putRGBcontig8bitCMYKtile;
+@@ -2636,7 +2645,7 @@
+ }
+ break;
+ case PHOTOMETRIC_CIELAB:
+- if (buildMap(img)) {
++ if (img->samplesperpixel == 3 && buildMap(img)) {
+ if (img->bitspersample == 8)
+ img->put.contig = initCIELabConversion(img);
+ break;
diff --git a/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch b/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch
new file mode 100644
index 0000000000..3fea745056
--- /dev/null
+++ b/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch
@@ -0,0 +1,171 @@
+2015-12-27 Even Rouault <even.rouault at spatialys.com>
+
+ * libtiff/tif_luv.c: fix potential out-of-bound writes in decode
+ functions in non debug builds by replacing assert()s by regular if
+ checks (bugzilla #2522).
+ Fix potential out-of-bound reads in case of short input data.
+
+diff -u -r1.40 -r1.41
+--- libtiff/libtiff/tif_luv.c 21 Jun 2015 01:09:09 -0000 1.40
++++ libtiff/libtiff/tif_luv.c 27 Dec 2015 16:25:11 -0000 1.41
+@@ -1,4 +1,4 @@
+-/* $Id: tif_luv.c,v 1.40 2015-06-21 01:09:09 bfriesen Exp $ */
++/* $Id: tif_luv.c,v 1.41 2015-12-27 16:25:11 erouault Exp $ */
+
+ /*
+ * Copyright (c) 1997 Greg Ward Larson
+@@ -202,7 +202,11 @@
+ if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
+ tp = (int16*) op;
+ else {
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ tp = (int16*) sp->tbuf;
+ }
+ _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
+@@ -211,9 +215,11 @@
+ cc = tif->tif_rawcc;
+ /* get each byte string */
+ for (shft = 2*8; (shft -= 8) >= 0; ) {
+- for (i = 0; i < npixels && cc > 0; )
++ for (i = 0; i < npixels && cc > 0; ) {
+ if (*bp >= 128) { /* run */
+- rc = *bp++ + (2-128); /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
++ if( cc < 2 )
++ break;
++ rc = *bp++ + (2-128);
+ b = (int16)(*bp++ << shft);
+ cc -= 2;
+ while (rc-- && i < npixels)
+@@ -223,6 +229,7 @@
+ while (--cc && rc-- && i < npixels)
+ tp[i++] |= (int16)*bp++ << shft;
+ }
++ }
+ if (i != npixels) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ TIFFErrorExt(tif->tif_clientdata, module,
+@@ -268,13 +275,17 @@
+ if (sp->user_datafmt == SGILOGDATAFMT_RAW)
+ tp = (uint32 *)op;
+ else {
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ tp = (uint32 *) sp->tbuf;
+ }
+ /* copy to array of uint32 */
+ bp = (unsigned char*) tif->tif_rawcp;
+ cc = tif->tif_rawcc;
+- for (i = 0; i < npixels && cc > 0; i++) {
++ for (i = 0; i < npixels && cc >= 3; i++) {
+ tp[i] = bp[0] << 16 | bp[1] << 8 | bp[2];
+ bp += 3;
+ cc -= 3;
+@@ -325,7 +336,11 @@
+ if (sp->user_datafmt == SGILOGDATAFMT_RAW)
+ tp = (uint32*) op;
+ else {
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ tp = (uint32*) sp->tbuf;
+ }
+ _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
+@@ -334,11 +349,13 @@
+ cc = tif->tif_rawcc;
+ /* get each byte string */
+ for (shft = 4*8; (shft -= 8) >= 0; ) {
+- for (i = 0; i < npixels && cc > 0; )
++ for (i = 0; i < npixels && cc > 0; ) {
+ if (*bp >= 128) { /* run */
++ if( cc < 2 )
++ break;
+ rc = *bp++ + (2-128);
+ b = (uint32)*bp++ << shft;
+- cc -= 2; /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
++ cc -= 2;
+ while (rc-- && i < npixels)
+ tp[i++] |= b;
+ } else { /* non-run */
+@@ -346,6 +363,7 @@
+ while (--cc && rc-- && i < npixels)
+ tp[i++] |= (uint32)*bp++ << shft;
+ }
++ }
+ if (i != npixels) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ TIFFErrorExt(tif->tif_clientdata, module,
+@@ -413,6 +431,7 @@
+ static int
+ LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ {
++ static const char module[] = "LogL16Encode";
+ LogLuvState* sp = EncoderState(tif);
+ int shft;
+ tmsize_t i;
+@@ -433,7 +452,11 @@
+ tp = (int16*) bp;
+ else {
+ tp = (int16*) sp->tbuf;
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ (*sp->tfunc)(sp, bp, npixels);
+ }
+ /* compress each byte string */
+@@ -506,6 +529,7 @@
+ static int
+ LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ {
++ static const char module[] = "LogLuvEncode24";
+ LogLuvState* sp = EncoderState(tif);
+ tmsize_t i;
+ tmsize_t npixels;
+@@ -521,7 +545,11 @@
+ tp = (uint32*) bp;
+ else {
+ tp = (uint32*) sp->tbuf;
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ (*sp->tfunc)(sp, bp, npixels);
+ }
+ /* write out encoded pixels */
+@@ -553,6 +581,7 @@
+ static int
+ LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
+ {
++ static const char module[] = "LogLuvEncode32";
+ LogLuvState* sp = EncoderState(tif);
+ int shft;
+ tmsize_t i;
+@@ -574,7 +603,11 @@
+ tp = (uint32*) bp;
+ else {
+ tp = (uint32*) sp->tbuf;
+- assert(sp->tbuflen >= npixels);
++ if(sp->tbuflen < npixels) {
++ TIFFErrorExt(tif->tif_clientdata, module,
++ "Translation buffer too short");
++ return (0);
++ }
+ (*sp->tfunc)(sp, bp, npixels);
+ }
+ /* compress each byte string */
diff --git a/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch b/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch
new file mode 100644
index 0000000000..50657b667c
--- /dev/null
+++ b/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch
@@ -0,0 +1,49 @@
+2015-12-27 Even Rouault <even.rouault at spatialys.com>
+
+ * libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
+ triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
+ (bugzilla #2508)
+
+diff -u -r1.16 -r1.18
+--- libtiff/libtiff/tif_next.c 29 Dec 2014 12:09:11 -0000 1.16
++++ libtiff/libtiff/tif_next.c 27 Dec 2015 17:14:52 -0000 1.18
+@@ -1,4 +1,4 @@
+-/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */
++/* $Id: tif_next.c,v 1.18 2015-12-27 17:14:52 erouault Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -37,7 +37,7 @@
+ case 0: op[0] = (unsigned char) ((v) << 6); break; \
+ case 1: op[0] |= (v) << 4; break; \
+ case 2: op[0] |= (v) << 2; break; \
+- case 3: *op++ |= (v); break; \
++ case 3: *op++ |= (v); op_offset++; break; \
+ } \
+ }
+
+@@ -103,6 +103,7 @@
+ }
+ default: {
+ uint32 npixels = 0, grey;
++ tmsize_t op_offset = 0;
+ uint32 imagewidth = tif->tif_dir.td_imagewidth;
+ if( isTiled(tif) )
+ imagewidth = tif->tif_dir.td_tilewidth;
+@@ -122,10 +123,15 @@
+ * bounds, potentially resulting in a security
+ * issue.
+ */
+- while (n-- > 0 && npixels < imagewidth)
++ while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
+ SETPIXEL(op, grey);
+ if (npixels >= imagewidth)
+ break;
++ if (op_offset >= scanline ) {
++ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
++ (long) tif->tif_row);
++ return (0);
++ }
+ if (cc == 0)
+ goto bad;
+ n = *bp++, cc--;
diff --git a/gnu/packages/patches/perl-CVE-2015-8607.patch b/gnu/packages/patches/perl-CVE-2015-8607.patch
new file mode 100644
index 0000000000..4c25d41740
--- /dev/null
+++ b/gnu/packages/patches/perl-CVE-2015-8607.patch
@@ -0,0 +1,68 @@
+From 3a629609084d147838368262171b923f0770e564 Mon Sep 17 00:00:00 2001
+From: Tony Cook <[email protected]>
+Date: Tue, 15 Dec 2015 10:56:54 +1100
+Subject: ensure File::Spec::canonpath() preserves taint
+
+Previously the unix specific XS implementation of canonpath() would
+return an untainted path when supplied a tainted path.
+
+For the empty string case, newSVpvs() already sets taint as needed on
+its result.
+
+This issue was assigned CVE-2015-8607.
+
+Bug: https://rt.perl.org/Ticket/Display.html?id=126862
+Bug-Debian: https://bugs.debian.org/810719
+Origin: upstream
+Patch-Name: fixes/CVE-2015-8607_file_spec_taint_fix.diff
+---
+ dist/PathTools/Cwd.xs | 1 +
+ dist/PathTools/t/taint.t | 19 ++++++++++++++++++-
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/dist/PathTools/Cwd.xs b/dist/PathTools/Cwd.xs
+index 9d4dcf0..3d018dc 100644
+--- a/dist/PathTools/Cwd.xs
++++ b/dist/PathTools/Cwd.xs
+@@ -535,6 +535,7 @@ THX_unix_canonpath(pTHX_ SV *path)
+ *o = 0;
+ SvPOK_on(retval);
+ SvCUR_set(retval, o - SvPVX(retval));
++ SvTAINT(retval);
+ return retval;
+ }
+
+diff --git a/dist/PathTools/t/taint.t b/dist/PathTools/t/taint.t
+index 309b3e5..48f8c5b 100644
+--- a/dist/PathTools/t/taint.t
++++ b/dist/PathTools/t/taint.t
+@@ -12,7 +12,7 @@ use Test::More;
+ BEGIN {
+ plan(
+ ${^TAINT}
+- ? (tests => 17)
++ ? (tests => 21)
+ : (skip_all => "A perl without taint support")
+ );
+ }
+@@ -34,3 +34,20 @@ foreach my $func (@Functions) {
+
+ # Previous versions of Cwd tainted $^O
+ is !tainted($^O), 1, "\$^O should not be tainted";
++
++{
++ # [perl #126862] canonpath() loses taint
++ my $tainted = substr($ENV{PATH}, 0, 0);
++ # yes, getcwd()'s result should be tainted, and is tested above
++ # but be sure
++ ok tainted(File::Spec->canonpath($tainted . Cwd::getcwd)),
++ "canonpath() keeps taint on non-empty string";
++ ok tainted(File::Spec->canonpath($tainted)),
++ "canonpath() keeps taint on empty string";
++
++ (Cwd::getcwd() =~ /^(.*)/);
++ my $untainted = $1;
++ ok !tainted($untainted), "make sure our untainted value is untainted";
++ ok !tainted(File::Spec->canonpath($untainted)),
++ "canonpath() doesn't add taint to untainted string";
++}
diff --git a/gnu/packages/patches/perl-deterministic-ordering.patch b/gnu/packages/patches/perl-deterministic-ordering.patch
new file mode 100644
index 0000000000..92e33ef135
--- /dev/null
+++ b/gnu/packages/patches/perl-deterministic-ordering.patch
@@ -0,0 +1,29 @@
+From <https://bugs.debian.org/801523>.
+
+From c01f602d1926b0671fd2c8d91f7e52c4e4c9fb24 Mon Sep 17 00:00:00 2001
+From: Niko Tyni <[email protected]>
+Date: Sun, 11 Oct 2015 19:27:56 +0300
+Subject: [PATCH] Sort the list of XS code files when generating RealPPPort.xs
+
+all_files_in_dir() uses readdir() ordering to make the list of
+input files. This can vary between build systems, breaking build
+reproducibility.
+---
+ cpan/Devel-PPPort/PPPort_xs.PL | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cpan/Devel-PPPort/PPPort_xs.PL b/cpan/Devel-PPPort/PPPort_xs.PL
+index 5f18940..149f2fe 100644
+--- a/cpan/Devel-PPPort/PPPort_xs.PL
++++ b/cpan/Devel-PPPort/PPPort_xs.PL
+@@ -38,7 +38,7 @@ END
+ my $file;
+ my $sec;
+
+-for $file (all_files_in_dir('parts/inc')) {
++for $file (sort(all_files_in_dir('parts/inc'))) {
+ my $spec = parse_partspec($file);
+
+ my $msg = 0;
+--
+2.5.1
diff --git a/gnu/packages/patches/perl-module-pluggable-search.patch b/gnu/packages/patches/perl-module-pluggable-search.patch
index bb2a57f7e5..ec51abc35d 100644..100755
--- a/gnu/packages/patches/perl-module-pluggable-search.patch
+++ b/gnu/packages/patches/perl-module-pluggable-search.patch
@@ -1,19 +1,19 @@
-Fix core Perl module Module::Pluggable such that it can find plugins that live
-in symlinked directories.
+Fix Perl module Module::Pluggable such that it can find plugins that live in
+symlinked directories.
Patch borrowed/adapted from Nixpkgs.
---- perl-5.16.1/cpan/Module-Pluggable/lib/Module/Pluggable/Object.pm 2015-04-08 23:28:48.120164135 -0500
-+++ perl-5.16.1/cpan/Module-Pluggable/lib/Module/Pluggable/Object.pm 2015-04-08 23:30:27.032166704 -0500
+--- Module-Pluggable-5.2/lib/Module/Pluggable/Object.pm 2015-04-08 23:28:48.120164135 -0500
++++ Module-Pluggable-5.2/lib/Module/Pluggable/Object.pm 2015-04-08 23:30:27.032166704 -0500
@@ -164,7 +164,7 @@
my $sp = catdir($dir, (split /::/, $searchpath));
-
+
# if it doesn't exist or it's not a dir then skip it
- next unless ( -e $sp && -d _ ); # Use the cached stat the second time
+ next unless ( -e $sp );
-
+
my @files = $self->find_files($sp);
-
+
@@ -279,7 +279,7 @@
(my $path = $File::Find::name) =~ s#^\\./##;
push @files, $path;
@@ -22,4 +22,4 @@ Patch borrowed/adapted from Nixpkgs.
+ }, "$search_path/." );
}
#chdir $cwd;
- return @files;
+ return @files; \ No newline at end of file
diff --git a/gnu/packages/patches/perl-no-build-time.patch b/gnu/packages/patches/perl-no-build-time.patch
new file mode 100644
index 0000000000..5d78e8f462
--- /dev/null
+++ b/gnu/packages/patches/perl-no-build-time.patch
@@ -0,0 +1,26 @@
+Do not record the configuration and build time so that builds can be
+reproduced bit-for-bit.
+
+--- perl-5.22.0/Configure 1970-01-01 01:00:00.000000000 +0100
++++ perl-5.22.0/Configure 2015-12-13 00:14:43.148165080 +0100
+@@ -3834,6 +3817,7 @@ esac
+
+ : who configured the system
+ cf_time=`LC_ALL=C; LANGUAGE=C; export LC_ALL; export LANGUAGE; $date 2>&1`
++cf_time='Thu Jan 1 00:00:01 UTC 1970'
+ case "$cf_by" in
+ "")
+ cf_by=`(logname) 2>/dev/null`
+
+--- perl-5.22.0/perl.c 2015-12-13 00:25:30.269156627 +0100
++++ perl-5.22.0/perl.c 2015-12-13 00:25:38.265218175 +0100
+@@ -1795,7 +1795,7 @@ S_Internals_V(pTHX_ CV *cv)
+ PUSHs(Perl_newSVpvn_flags(aTHX_ non_bincompat_options,
+ sizeof(non_bincompat_options) - 1, SVs_TEMP));
+
+-#ifdef __DATE__
++#if 0
+ # ifdef __TIME__
+ PUSHs(Perl_newSVpvn_flags(aTHX_
+ STR_WITH_LEN("Compiled at " __DATE__ " " __TIME__),
+
diff --git a/gnu/packages/patches/perl-no-sys-dirs.patch b/gnu/packages/patches/perl-no-sys-dirs.patch
index 3aba4d7529..da91fef3b4 100644
--- a/gnu/packages/patches/perl-no-sys-dirs.patch
+++ b/gnu/packages/patches/perl-no-sys-dirs.patch
@@ -1,10 +1,10 @@
-Don't long for headers and libraries in "traditional" locations.
+Don't look for headers and libraries in "traditional" locations.
Patch from Nixpkgs by Eelco Dolstra <[email protected]>.
-diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
---- perl-5.14.2-orig/Configure 2011-09-26 11:44:34.000000000 +0200
-+++ perl-5.14.2/Configure 2012-01-20 17:05:23.089223129 +0100
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/Configure perl-5.20.0/Configure
+--- perl-5.20.0-orig/Configure 2014-05-26 15:34:18.000000000 +0200
++++ perl-5.20.0/Configure 2014-06-25 10:43:35.368285986 +0200
@@ -106,15 +106,7 @@
fi
@@ -22,7 +22,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
for p in $paths
do
-@@ -1311,8 +1303,7 @@
+@@ -1337,8 +1329,7 @@
archname=''
: Possible local include directories to search.
: Set locincpth to "" in a hint file to defeat local include searches.
@@ -32,8 +32,8 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
:
: no include file wanted by default
inclwanted=''
-@@ -1328,17 +1319,12 @@
- archobjs=''
+@@ -1349,17 +1340,12 @@
+
libnames=''
: change the next line if compiling for Xenix/286 on Xenix/386
-xlibpth='/usr/lib/386 /lib/386'
@@ -53,7 +53,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
: Private path used by Configure to find libraries. Its value
: is prepended to libpth. This variable takes care of special
-@@ -1371,8 +1357,6 @@
+@@ -1391,8 +1377,6 @@
libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
: We probably want to search /usr/shlib before most other libraries.
: This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
@@ -62,27 +62,27 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
: Do not use vfork unless overridden by a hint file.
usevfork=false
-@@ -2380,7 +2364,6 @@
+@@ -2446,7 +2430,6 @@
zip
"
pth=`echo $PATH | sed -e "s/$p_/ /g"`
--pth="$pth /lib /usr/lib"
+-pth="$pth $sysroot/lib $sysroot/usr/lib"
for file in $loclist; do
eval xxx=\$$file
case "$xxx" in
-@@ -4785,7 +4768,7 @@
+@@ -4936,7 +4919,7 @@
: Set private lib path
case "$plibpth" in
'') if ./mips; then
-- plibpth="$incpath/usr/lib /usr/local/lib /usr/ccs/lib"
-+ plibpth="$incpath/usr/lib"
- fi;;
+- plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib"
++ plibpth="$incpath/usr/lib"
+ fi;;
esac
case "$libpth" in
-@@ -8390,13 +8373,8 @@
+@@ -8600,13 +8583,8 @@
echo " "
case "$sysman" in
- '')
+ '')
- syspath='/usr/share/man/man1 /usr/man/man1'
- syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1"
- syspath="$syspath /usr/man/u_man/man1"
@@ -95,7 +95,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
;;
esac
if $test -d "$sysman"; then
-@@ -19721,9 +19699,10 @@
+@@ -19900,9 +19878,10 @@
case "$full_ar" in
'') full_ar=$ar ;;
esac
@@ -107,10 +107,11 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
: see what type gids are declared as in the kernel
echo " "
-diff -ru -x '*~' perl-5.14.2-orig/ext/Errno/Errno_pm.PL perl-5.14.2/ext/Errno/Errno_pm.PL
---- perl-5.14.2-orig/ext/Errno/Errno_pm.PL 2011-09-26 11:44:34.000000000 +0200
-+++ perl-5.14.2/ext/Errno/Errno_pm.PL 2012-01-20 17:02:07.938138311 +0100
-@@ -137,11 +137,7 @@
+Only in perl-5.20.0/: Configure.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/ext/Errno/Errno_pm.PL perl-5.20.0/ext/Errno/Errno_pm.PL
+--- perl-5.20.0-orig/ext/Errno/Errno_pm.PL 2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/ext/Errno/Errno_pm.PL 2014-06-25 10:31:24.317970047 +0200
+@@ -126,11 +126,7 @@
if ($dep =~ /(\S+errno\.h)/) {
$file{$1} = 1;
}
@@ -120,13 +121,14 @@ diff -ru -x '*~' perl-5.14.2-orig/ext/Errno/Errno_pm.PL perl-5.14.2/ext/Errno/Er
- # might be using, say, Intel's icc
- ) {
+ } elsif (0) {
+ # When cross-compiling we may store a path for gcc's "sysroot" option:
+ my $sysroot = $Config{sysroot} || '';
# Some Linuxes have weird errno.hs which generate
- # no #file or #line directives
- my $linux_errno_h = -e '/usr/include/errno.h' ?
-diff -ru -x '*~' perl-5.14.2-orig/hints/freebsd.sh perl-5.14.2/hints/freebsd.sh
---- perl-5.14.2-orig/hints/freebsd.sh 2011-09-19 15:18:22.000000000 +0200
-+++ perl-5.14.2/hints/freebsd.sh 2012-01-20 17:10:37.267924044 +0100
-@@ -118,21 +118,21 @@
+Only in perl-5.20.0/ext/Errno: Errno_pm.PL.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/freebsd.sh perl-5.20.0/hints/freebsd.sh
+--- perl-5.20.0-orig/hints/freebsd.sh 2014-01-31 22:55:51.000000000 +0100
++++ perl-5.20.0/hints/freebsd.sh 2014-06-25 10:25:53.263964680 +0200
+@@ -119,21 +119,21 @@
objformat=`/usr/bin/objformat`
if [ x$objformat = xaout ]; then
if [ -e /usr/lib/aout ]; then
@@ -154,3 +156,99 @@ diff -ru -x '*~' perl-5.14.2-orig/hints/freebsd.sh perl-5.14.2/hints/freebsd.sh
ldflags="-Wl,-E "
lddlflags="-shared "
cccdlflags='-DPIC -fPIC'
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/linux.sh perl-5.20.0/hints/linux.sh
+--- perl-5.20.0-orig/hints/linux.sh 2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/hints/linux.sh 2014-06-25 10:33:47.354883843 +0200
+@@ -150,25 +150,6 @@
+ ;;
+ esac
+
+-# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries
+-# (such as -lm) in /lib or /usr/lib. So we have to ask gcc to tell us
+-# where to look. We don't want gcc's own libraries, however, so we
+-# filter those out.
+-# This could be conditional on Unbuntu, but other distributions may
+-# follow suit, and this scheme seems to work even on rather old gcc's.
+-# This unconditionally uses gcc because even if the user is using another
+-# compiler, we still need to find the math library and friends, and I don't
+-# know how other compilers will cope with that situation.
+-# Morever, if the user has their own gcc earlier in $PATH than the system gcc,
+-# we don't want its libraries. So we try to prefer the system gcc
+-# Still, as an escape hatch, allow Configure command line overrides to
+-# plibpth to bypass this check.
+-if [ -x /usr/bin/gcc ] ; then
+- gcc=/usr/bin/gcc
+-else
+- gcc=gcc
+-fi
+-
+ case "$plibpth" in
+ '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries |
+ cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'`
+@@ -178,32 +159,6 @@
+ ;;
+ esac
+
+-case "$libc" in
+-'')
+-# If you have glibc, then report the version for ./myconfig bug reporting.
+-# (Configure doesn't need to know the specific version since it just uses
+-# gcc to load the library for all tests.)
+-# We don't use __GLIBC__ and __GLIBC_MINOR__ because they
+-# are insufficiently precise to distinguish things like
+-# libc-2.0.6 and libc-2.0.7.
+- for p in $plibpth
+- do
+- for trylib in libc.so.6 libc.so
+- do
+- if $test -e $p/$trylib; then
+- libc=`ls -l $p/$trylib | awk '{print $NF}'`
+- if $test "X$libc" != X; then
+- break
+- fi
+- fi
+- done
+- if $test "X$libc" != X; then
+- break
+- fi
+- done
+- ;;
+-esac
+-
+ # Are we using ELF? Thanks to Kenneth Albanowski <[email protected]>
+ # for this test.
+ cat >try.c <<'EOM'
+@@ -367,33 +322,6 @@
+ ;;
+ esac
+
+-# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than
+-# true libraries. The scripts cause binding against static
+-# version of -lgdbm which is a bad idea. So if we have 'nm'
+-# make sure it can read the file
+-# NI-S 2003/08/07
+-case "$nm" in
+- '') ;;
+- *)
+- for p in $plibpth
+- do
+- if $test -r $p/libndbm.so; then
+- if $nm $p/libndbm.so >/dev/null 2>&1 ; then
+- echo 'Your shared -lndbm seems to be a real library.'
+- _libndbm_real=1
+- break
+- fi
+- fi
+- done
+- if $test "X$_libndbm_real" = X; then
+- echo 'Your shared -lndbm is not a real library.'
+- set `echo X "$libswanted "| sed -e 's/ ndbm / /'`
+- shift
+- libswanted="$*"
+- fi
+- ;;
+-esac
+-
+ # Linux on Synology.
+ if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then
+ # Tested on Synology DS213 and DS413
diff --git a/gnu/packages/patches/perl-source-date-epoch.patch b/gnu/packages/patches/perl-source-date-epoch.patch
new file mode 100644
index 0000000000..37330c9537
--- /dev/null
+++ b/gnu/packages/patches/perl-source-date-epoch.patch
@@ -0,0 +1,19 @@
+Adapted from <https://bugs.debian.org/801621>.
+Make Pod::Man honor the SOURCE_DATE_EPOCH environment variable.
+
+--- perl-5.22.0/cpan/podlators/lib/Pod/Man.pm 2015-12-12 22:33:03.321787590 +0100
++++ perl-5.22.0/cpan/podlators/lib/Pod/Man.pm 2015-12-12 22:36:33.367361338 +0100
+@@ -884,7 +884,12 @@ sub devise_date {
+ my ($self) = @_;
+ my $input = $self->source_filename;
+ my $time;
+- if ($input) {
++
++ if (defined($ENV{SOURCE_DATE_EPOCH}) &&
++ $ENV{SOURCE_DATE_EPOCH} !~ /\D/) {
++ $time = $ENV{SOURCE_DATE_EPOCH};
++ }
++ elsif ($input) {
+ $time = (stat $input)[9] || time;
+ } else {
+ $time = time;
diff --git a/gnu/packages/patches/procps-make-3.82.patch b/gnu/packages/patches/procps-make-3.82.patch
deleted file mode 100644
index 7bf53e2ccc..0000000000
--- a/gnu/packages/patches/procps-make-3.82.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-Fix compilation with GNU Make 3.82 (patch from Nixpkgs).
-
-diff --git a/Makefile b/Makefile
-index 09fb3ed..59eba16 100644
---- a/Makefile
-+++ b/Makefile
-@@ -174,7 +174,7 @@ INSTALL := $(BINFILES) $(MANFILES)
- # want this rule first, use := on ALL, and ALL not filled in yet
- all: do_all
-
---include */module.mk
-+-include proc/module.mk ps/module.mk
-
- do_all: $(ALL)
diff --git a/gnu/packages/patches/python-2.7-search-paths.patch b/gnu/packages/patches/python-2.7-search-paths.patch
index 6e5339f3a6..ba7235df27 100644
--- a/gnu/packages/patches/python-2.7-search-paths.patch
+++ b/gnu/packages/patches/python-2.7-search-paths.patch
@@ -1,5 +1,5 @@
-Make sure the build system honors CPATH and LIBRARY_PATH when looking for
-headers and libraries.
+Make sure the build system honors C_INCLUDE_PATH and LIBRARY_PATH when
+looking for headers and libraries.
--- Python-2.7.10/setup.py 2015-10-07 18:33:18.125153186 +0200
+++ Python-2.7.10/setup.py 2015-10-07 18:33:47.497347552 +0200
@@ -9,7 +9,7 @@ headers and libraries.
+ # Always honor these variables.
+ lib_dirs += os.getenv('LIBRARY_PATH', '').split(os.pathsep)
-+ inc_dirs += os.getenv('CPATH', '').split(os.pathsep)
++ inc_dirs += os.getenv('C_INCLUDE_PATH', '').split(os.pathsep)
+
# OSF/1 and Unixware have some stuff in /usr/ccs/lib (like -ldb)
if host_platform in ['osf1', 'unixware7', 'openunix8']:
diff --git a/gnu/packages/patches/python-3-search-paths.patch b/gnu/packages/patches/python-3-search-paths.patch
index 547feae1b9..7feddb8e30 100644
--- a/gnu/packages/patches/python-3-search-paths.patch
+++ b/gnu/packages/patches/python-3-search-paths.patch
@@ -1,5 +1,5 @@
-Make sure the build system honors CPATH and LIBRARY_PATH when looking for
-headers and libraries.
+Make sure the build system honors C_INCLUDE_PATH and LIBRARY_PATH when
+looking for headers and libraries.
--- setup.py 2015-10-07 23:32:58.891329173 +0200
+++ setup.py 2015-10-07 23:46:29.653349924 +0200
@@ -13,7 +13,7 @@ headers and libraries.
- ]
- inc_dirs = self.compiler.include_dirs + ['/usr/include']
+ lib_dirs = os.getenv('LIBRARY_PATH', '').split(os.pathsep)
-+ inc_dirs = os.getenv('CPATH', '').split(os.pathsep)
++ inc_dirs = os.getenv('C_INCLUDE_PATH', '').split(os.pathsep)
else:
lib_dirs = self.compiler.library_dirs[:]
inc_dirs = self.compiler.include_dirs[:]