gentoo resync : 14.07.2018

8 files changed, 802 insertions, 0 deletions

diff --git a/app-arch/p7zip/Manifest b/app-arch/p7zip/Manifest
new file mode 100644
index 000000000000..6b5cd4db1ce3
--- /dev/null
+++ b/app-arch/p7zip/Manifest
@@ -0,0 +1,8 @@
+AUX CVE-2016-9296.patch 495 BLAKE2B 34aad92d8a22b05119242e57effb85648acaa0c0b89a68c8ff03faa8c455ba4e95185732c2f26a462728d872f268d4a716cb14a703c05a1cb157c23dcc24cb86 SHA512 7a7fddf4122c3f5d4632640149a94c285a18515f38510388709c2fb9ecd450f9f34ae2e5fe4926c1c68507567b0affa2c8e9194c732673171dd5ee625192b194
+AUX CVE-2017-17969.patch 804 BLAKE2B 1b3d12f6d81d3b3a934088020509435c07a8bfe5ab2003e7369aa9b775808711915b1a0ede48ab6b8b24f37b55f2b84eefff020c34ec171002d9d714bac96f57 SHA512 fb97f6cccedda5b53492afffd65e9933055ffb3dba1419799bb5bf069d066f1172424a7913e0661fbe5937d23c94c062499968ddd09b7310f5d2c8003274340a
+AUX CVE-2018-10115.patch 8946 BLAKE2B 21fc8367ec1c811119bd43b5ca8ac1399748d4fe0c4a9c2cc98b9c3d48a806ccb8416905f18c2b740fd76dad0f9f469c2105d8a7986c11eb123caf48b6c0d31e SHA512 757d0f50ccce2a21dce81f165a9f408a71ea53c226ef29b4d3843f30b2fc518d06cd784e2de644904813cd16a87f24387c5cc35c2499b1df9d86377057be032a
+AUX CVE-2018-5996.patch 6427 BLAKE2B a60d4c51470d9a1ee58afc4ced5190dc589c78604dfd8cefdb5f4caca74d73f175722f777c4c13839951178b394c44b69577c8b5125f45581890dfaf1325d47d SHA512 7962a03430b94aec7c93d6dabee340f4f5915d728ba4df0dcaae483ab9c29115818e5e944572a3fd910addad8799c6a1e3911f6a0a02b661f804eea11c3a0f40
+AUX p7zip-16.02-darwin.patch 2134 BLAKE2B f8890b8b3e0a3ade007f162e5d3b7fdc9925e8960c6e22463a5ebc474e4ebb2577f0cc0312fda6c129bd1a02dc3ac6d3de17f2c551ee710ab36d0658acfaec52 SHA512 ed8689e39e5bd55eb9cc74c02c94782ac893fc30079492dbde459f24d07037ca63c91526ea428934814febbfbcd1f80c0683cd40d48eab055a3f856b1d78fb37
+DIST p7zip_16.02_src_all.tar.bz2 4239909 BLAKE2B 075356fba5284cbb124e30c36364a910ae5a7ac6bee8a8fb682c5a7ce2f1870ef83d3160c84f8dabad1d616c13d642cba1f19fb9384160d21590cf678dd8f1a6 SHA512 d2c4d53817f96bb4c7683f42045198d4cd509cfc9c3e2cb85c8d9dc4ab6dfa7496449edeac4e300ecf986a9cbbc90bd8f8feef8156895d94617c04e507add55f
+EBUILD p7zip-16.02-r4.ebuild 4641 BLAKE2B 65ec0c3f7c87ac30a5c14d04f9df48344de917a8e03a85bc2362d0dc615fcbb88da85970bd6ad26a5ef54240adc17621c06daf5aee49812b24f480b61634365e SHA512 76570b6c97ba50cbff41445031938eeccbb56af112995842d4543c1deffbe6492bbac5b4e8434e6bf7b5130c1d0d6a26c6a9d106d33e665dc114797dc474f9ff
+MISC metadata.xml 393 BLAKE2B 6ab87f3e2f35dded47136efbf8f93c7a899a5918b4a8e3ab6658a427da8085e8eb0e6ce2aec09fd0ea5fb14909081600b79027878b7e5b8ef9d476def057e52f SHA512 50eb24c1e60e0be2c02d8054a5039c5e2b11ac82aea3f90c0a37c21e68b01135de88878b1079ec46eeb8d1f8ab52fb8c9f58f88a498feb38ae5743adb7519176
diff --git a/app-arch/p7zip/files/CVE-2016-9296.patch b/app-arch/p7zip/files/CVE-2016-9296.patch
new file mode 100644
index 000000000000..773f92a46e0e
--- /dev/null
+++ b/app-arch/p7zip/files/CVE-2016-9296.patch
@@ -0,0 +1,12 @@
+--- ./CPP/7zip/Archive/7z/7zIn.cpp.orig	2016-11-21 01:42:29.460901230 +0000
++++ ./CPP/7zip/Archive/7z/7zIn.cpp	2016-11-21 01:42:57.481197725 +0000
+@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedS
+       if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
+         ThrowIncorrect();
+   }
+-  HeadersSize += folders.PackPositions[folders.NumPackStreams];
++  if (folders.PackPositions)
++      HeadersSize += folders.PackPositions[folders.NumPackStreams];
+   return S_OK;
+ }
+ 
diff --git a/app-arch/p7zip/files/CVE-2017-17969.patch b/app-arch/p7zip/files/CVE-2017-17969.patch
new file mode 100644
index 000000000000..9a820af73067
--- /dev/null
+++ b/app-arch/p7zip/files/CVE-2017-17969.patch
@@ -0,0 +1,26 @@
+From: =?utf-8?q?Antoine_Beaupr=C3=A9?= <anarcat@debian.org>
+Date: Sun, 28 Jan 2018 21:19:50 +0100
+Subject: backport of the CVE-2017-17969 fix from 7zip 18.00-beta
+
+---
+ CPP/7zip/Compress/ShrinkDecoder.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/CPP/7zip/Compress/ShrinkDecoder.cpp b/CPP/7zip/Compress/ShrinkDecoder.cpp
+index 80b7e67..4acdce5 100644
+--- a/CPP/7zip/Compress/ShrinkDecoder.cpp
++++ b/CPP/7zip/Compress/ShrinkDecoder.cpp
+@@ -121,7 +121,12 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+     {
+       _stack[i++] = _suffixes[cur];
+       cur = _parents[cur];
+-    }
++      if (i >= kNumItems)
++        break;
++     }
++
++    if (i >= kNumItems)
++      break;
+     
+     _stack[i++] = (Byte)cur;
+     lastChar2 = (Byte)cur;
diff --git a/app-arch/p7zip/files/CVE-2018-10115.patch b/app-arch/p7zip/files/CVE-2018-10115.patch
new file mode 100644
index 000000000000..7d9c4bf81f00
--- /dev/null
+++ b/app-arch/p7zip/files/CVE-2018-10115.patch
@@ -0,0 +1,311 @@
+From: Robert Luberda <robert@debian.org>
+Date: Tue, 29 May 2018 23:59:09 +0200
+Subject: Fix CVE-2018-10115
+
+Apply "patch" taken from https://landave.io/files/patch_7zip_CVE-2018-10115.txt
+
+
+Bugs-Debian: https://bugs.debian.org/897674
+---
+ CPP/7zip/Compress/Rar1Decoder.cpp | 16 +++++++++++-----
+ CPP/7zip/Compress/Rar1Decoder.h   |  3 ++-
+ CPP/7zip/Compress/Rar2Decoder.cpp | 17 +++++++++++++----
+ CPP/7zip/Compress/Rar2Decoder.h   |  3 ++-
+ CPP/7zip/Compress/Rar3Decoder.cpp | 19 +++++++++++++++----
+ CPP/7zip/Compress/Rar3Decoder.h   |  3 ++-
+ CPP/7zip/Compress/Rar5Decoder.cpp |  8 ++++++++
+ CPP/7zip/Compress/Rar5Decoder.h   |  1 +
+ 8 files changed, 54 insertions(+), 16 deletions(-)
+
+diff --git a/CPP/7zip/Compress/Rar1Decoder.cpp b/CPP/7zip/Compress/Rar1Decoder.cpp
+index 68030c7..8c890c8 100644
+--- a/CPP/7zip/Compress/Rar1Decoder.cpp
++++ b/CPP/7zip/Compress/Rar1Decoder.cpp
+@@ -29,7 +29,7 @@ public:
+ };
+ */
+ 
+-CDecoder::CDecoder(): m_IsSolid(false), _errorMode(false) { }
++CDecoder::CDecoder(): _isSolid(false), _solidAllowed(false), _errorMode(false) { }
+ 
+ void CDecoder::InitStructures()
+ {
+@@ -345,7 +345,7 @@ void CDecoder::GetFlagsBuf()
+ 
+ void CDecoder::InitData()
+ {
+-  if (!m_IsSolid)
++  if (!_isSolid)
+   {
+     AvrPlcB = AvrLn1 = AvrLn2 = AvrLn3 = NumHuf = Buf60 = 0;
+     AvrPlc = 0x3500;
+@@ -391,6 +391,11 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+   if (inSize == NULL || outSize == NULL)
+     return E_INVALIDARG;
+ 
++  if (_isSolid && !_solidAllowed)
++    return S_FALSE;
++
++  _solidAllowed = false;
++
+   if (!m_OutWindowStream.Create(kHistorySize))
+     return E_OUTOFMEMORY;
+   if (!m_InBitStream.Create(1 << 20))
+@@ -398,13 +403,13 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+ 
+   m_UnpackSize = (Int64)*outSize;
+   m_OutWindowStream.SetStream(outStream);
+-  m_OutWindowStream.Init(m_IsSolid);
++  m_OutWindowStream.Init(_isSolid);
+   m_InBitStream.SetStream(inStream);
+   m_InBitStream.Init();
+ 
+   // CCoderReleaser coderReleaser(this);
+   InitData();
+-  if (!m_IsSolid)
++  if (!_isSolid)
+   {
+     _errorMode = false;
+     InitStructures();
+@@ -475,6 +480,7 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+   }
+   if (m_UnpackSize < 0)
+     return S_FALSE;
++  _solidAllowed = true;
+   return m_OutWindowStream.Flush();
+ }
+ 
+@@ -491,7 +497,7 @@ STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
+ {
+   if (size < 1)
+     return E_INVALIDARG;
+-  m_IsSolid = ((data[0] & 1) != 0);
++  _isSolid = ((data[0] & 1) != 0);
+   return S_OK;
+ }
+ 
+diff --git a/CPP/7zip/Compress/Rar1Decoder.h b/CPP/7zip/Compress/Rar1Decoder.h
+index 01b606b..8abb3a3 100644
+--- a/CPP/7zip/Compress/Rar1Decoder.h
++++ b/CPP/7zip/Compress/Rar1Decoder.h
+@@ -38,7 +38,8 @@ public:
+   UInt32 LastLength;
+ 
+   Int64 m_UnpackSize;
+-  bool m_IsSolid;
++  bool _isSolid;
++  bool _solidAllowed;
+   bool _errorMode;
+ 
+   UInt32 ReadBits(int numBits);
+diff --git a/CPP/7zip/Compress/Rar2Decoder.cpp b/CPP/7zip/Compress/Rar2Decoder.cpp
+index 0580c8d..be8d842 100644
+--- a/CPP/7zip/Compress/Rar2Decoder.cpp
++++ b/CPP/7zip/Compress/Rar2Decoder.cpp
+@@ -80,7 +80,8 @@ static const UInt32 kHistorySize = 1 << 20;
+ static const UInt32 kWindowReservSize = (1 << 22) + 256;
+ 
+ CDecoder::CDecoder():
+-  m_IsSolid(false),
++  _isSolid(false),
++  _solidAllowed(false),
+   m_TablesOK(false)
+ {
+ }
+@@ -320,6 +321,10 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+   if (inSize == NULL || outSize == NULL)
+     return E_INVALIDARG;
+ 
++  if (_isSolid && !_solidAllowed)
++    return S_FALSE;
++  _solidAllowed = false;
++
+   if (!m_OutWindowStream.Create(kHistorySize))
+     return E_OUTOFMEMORY;
+   if (!m_InBitStream.Create(1 << 20))
+@@ -330,12 +335,12 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+   UInt64 pos = 0, unPackSize = *outSize;
+   
+   m_OutWindowStream.SetStream(outStream);
+-  m_OutWindowStream.Init(m_IsSolid);
++  m_OutWindowStream.Init(_isSolid);
+   m_InBitStream.SetStream(inStream);
+   m_InBitStream.Init();
+ 
+   // CCoderReleaser coderReleaser(this);
+-  if (!m_IsSolid)
++  if (!_isSolid)
+   {
+     InitStructures();
+     if (unPackSize == 0)
+@@ -343,6 +348,7 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+       if (m_InBitStream.GetProcessedSize() + 2 <= m_PackSize) // test it: probably incorrect;
+         if (!ReadTables())
+           return S_FALSE;
++      _solidAllowed = true;
+       return S_OK;
+     }
+     if (!ReadTables())
+@@ -386,6 +392,9 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+ 
+   if (!ReadLastTables())
+     return S_FALSE;
++
++  _solidAllowed = true;
++
+   return m_OutWindowStream.Flush();
+ }
+ 
+@@ -402,7 +411,7 @@ STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
+ {
+   if (size < 1)
+     return E_INVALIDARG;
+-  m_IsSolid = ((data[0] & 1) != 0);
++  _isSolid = ((data[0] & 1) != 0);
+   return S_OK;
+ }
+ 
+diff --git a/CPP/7zip/Compress/Rar2Decoder.h b/CPP/7zip/Compress/Rar2Decoder.h
+index 0e9005f..370bce2 100644
+--- a/CPP/7zip/Compress/Rar2Decoder.h
++++ b/CPP/7zip/Compress/Rar2Decoder.h
+@@ -138,7 +138,8 @@ class CDecoder :
+   Byte m_LastLevels[kMaxTableSize];
+ 
+   UInt64 m_PackSize;
+-  bool m_IsSolid;
++  bool _isSolid;
++  bool _solidAllowed;
+   bool m_TablesOK;
+ 
+   void InitStructures();
+diff --git a/CPP/7zip/Compress/Rar3Decoder.cpp b/CPP/7zip/Compress/Rar3Decoder.cpp
+index 6cb8a6a..7b85833 100644
+--- a/CPP/7zip/Compress/Rar3Decoder.cpp
++++ b/CPP/7zip/Compress/Rar3Decoder.cpp
+@@ -92,7 +92,8 @@ CDecoder::CDecoder():
+   _writtenFileSize(0),
+   _vmData(0),
+   _vmCode(0),
+-  m_IsSolid(false),
++  _isSolid(false),
++  _solidAllowed(false),
+   _errorMode(false)
+ {
+   Ppmd7_Construct(&_ppmd);
+@@ -821,7 +822,7 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
+ {
+   _writtenFileSize = 0;
+   _unsupportedFilter = false;
+-  if (!m_IsSolid)
++  if (!_isSolid)
+   {
+     _lzSize = 0;
+     _winPos = 0;
+@@ -840,12 +841,15 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
+   if (_errorMode)
+     return S_FALSE;
+ 
+-  if (!m_IsSolid || !TablesRead)
++  if (!_isSolid || !TablesRead)
+   {
+     bool keepDecompressing;
+     RINOK(ReadTables(keepDecompressing));
+     if (!keepDecompressing)
++    {
++      _solidAllowed = true;
+       return S_OK;
++    }
+   }
+ 
+   for (;;)
+@@ -870,6 +874,9 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
+     if (!keepDecompressing)
+       break;
+   }
++
++  _solidAllowed = true;
++
+   RINOK(WriteBuf());
+   UInt64 packSize = m_InBitStream.BitDecoder.GetProcessedSize();
+   RINOK(progress->SetRatioInfo(&packSize, &_writtenFileSize));
+@@ -890,6 +897,10 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
+     if (!inSize)
+       return E_INVALIDARG;
+ 
++    if (_isSolid && !_solidAllowed)
++      return S_FALSE;
++    _solidAllowed = false;
++
+     if (!_vmData)
+     {
+       _vmData = (Byte *)::MidAlloc(kVmDataSizeMax + kVmCodeSizeMax);
+@@ -928,7 +939,7 @@ STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
+ {
+   if (size < 1)
+     return E_INVALIDARG;
+-  m_IsSolid = ((data[0] & 1) != 0);
++  _isSolid = ((data[0] & 1) != 0);
+   return S_OK;
+ }
+ 
+diff --git a/CPP/7zip/Compress/Rar3Decoder.h b/CPP/7zip/Compress/Rar3Decoder.h
+index 2f72d7d..32c8943 100644
+--- a/CPP/7zip/Compress/Rar3Decoder.h
++++ b/CPP/7zip/Compress/Rar3Decoder.h
+@@ -191,7 +191,8 @@ class CDecoder:
+   CRecordVector<CTempFilter *>  _tempFilters;
+   UInt32 _lastFilter;
+ 
+-  bool m_IsSolid;
++  bool _isSolid;
++  bool _solidAllowed;
+   bool _errorMode;
+ 
+   bool _lzMode;
+diff --git a/CPP/7zip/Compress/Rar5Decoder.cpp b/CPP/7zip/Compress/Rar5Decoder.cpp
+index dc8830f..a826d5a 100644
+--- a/CPP/7zip/Compress/Rar5Decoder.cpp
++++ b/CPP/7zip/Compress/Rar5Decoder.cpp
+@@ -72,6 +72,7 @@ CDecoder::CDecoder():
+     _writtenFileSize(0),
+     _dictSizeLog(0),
+     _isSolid(false),
++    _solidAllowed(false),
+     _wasInit(false),
+     _inputBuf(NULL)
+ {
+@@ -801,7 +802,10 @@ HRESULT CDecoder::CodeReal()
+   */
+ 
+   if (res == S_OK)
++  {
++    _solidAllowed = true;
+     res = res2;
++  }
+      
+   if (res == S_OK && _unpackSize_Defined && _writtenFileSize != _unpackSize)
+     return S_FALSE;
+@@ -821,6 +825,10 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
+ {
+   try
+   {
++    if (_isSolid && !_solidAllowed)
++      return S_FALSE;
++    _solidAllowed = false;
++
+     if (_dictSizeLog >= sizeof(size_t) * 8)
+       return E_NOTIMPL;
+ 
+diff --git a/CPP/7zip/Compress/Rar5Decoder.h b/CPP/7zip/Compress/Rar5Decoder.h
+index b0a4dd1..3db5018 100644
+--- a/CPP/7zip/Compress/Rar5Decoder.h
++++ b/CPP/7zip/Compress/Rar5Decoder.h
+@@ -271,6 +271,7 @@ class CDecoder:
+   Byte _dictSizeLog;
+   bool _tableWasFilled;
+   bool _isSolid;
++  bool _solidAllowed;
+   bool _wasInit;
+ 
+   UInt32 _reps[kNumReps];
diff --git a/app-arch/p7zip/files/CVE-2018-5996.patch b/app-arch/p7zip/files/CVE-2018-5996.patch
new file mode 100644
index 000000000000..6733bff91895
--- /dev/null
+++ b/app-arch/p7zip/files/CVE-2018-5996.patch
@@ -0,0 +1,221 @@
+From: Robert Luberda <robert@debian.org>
+Date: Sun, 28 Jan 2018 23:47:40 +0100
+Subject: CVE-2018-5996
+
+Hopefully fix Memory Corruptions via RAR PPMd (CVE-2018-5996) by
+applying a few changes from 7Zip 18.00-beta.
+
+Bug-Debian: https://bugs.debian.org/#888314
+---
+ CPP/7zip/Compress/Rar1Decoder.cpp | 13 +++++++++----
+ CPP/7zip/Compress/Rar1Decoder.h   |  1 +
+ CPP/7zip/Compress/Rar2Decoder.cpp | 10 +++++++++-
+ CPP/7zip/Compress/Rar2Decoder.h   |  1 +
+ CPP/7zip/Compress/Rar3Decoder.cpp | 23 ++++++++++++++++++++---
+ CPP/7zip/Compress/Rar3Decoder.h   |  2 ++
+ 6 files changed, 42 insertions(+), 8 deletions(-)
+
+diff --git a/CPP/7zip/Compress/Rar1Decoder.cpp b/CPP/7zip/Compress/Rar1Decoder.cpp
+index 1aaedcc..68030c7 100644
+--- a/CPP/7zip/Compress/Rar1Decoder.cpp
++++ b/CPP/7zip/Compress/Rar1Decoder.cpp
+@@ -29,7 +29,7 @@ public:
+ };
+ */
+ 
+-CDecoder::CDecoder(): m_IsSolid(false) { }
++CDecoder::CDecoder(): m_IsSolid(false), _errorMode(false) { }
+ 
+ void CDecoder::InitStructures()
+ {
+@@ -406,9 +406,14 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+   InitData();
+   if (!m_IsSolid)
+   {
++    _errorMode = false;
+     InitStructures();
+     InitHuff();
+   }
++
++  if (_errorMode)
++    return S_FALSE;
++
+   if (m_UnpackSize > 0)
+   {
+     GetFlagsBuf();
+@@ -477,9 +482,9 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
+     const UInt64 *inSize, const UInt64 *outSize, ICompressProgressInfo *progress)
+ {
+   try { return CodeReal(inStream, outStream, inSize, outSize, progress); }
+-  catch(const CInBufferException &e) { return e.ErrorCode; }
+-  catch(const CLzOutWindowException &e) { return e.ErrorCode; }
+-  catch(...) { return S_FALSE; }
++  catch(const CInBufferException &e) { _errorMode = true; return e.ErrorCode; }
++  catch(const CLzOutWindowException &e) { _errorMode = true; return e.ErrorCode; }
++  catch(...) { _errorMode = true; return S_FALSE; }
+ }
+ 
+ STDMETHODIMP CDecoder::SetDecoderProperties2(const Byte *data, UInt32 size)
+diff --git a/CPP/7zip/Compress/Rar1Decoder.h b/CPP/7zip/Compress/Rar1Decoder.h
+index 630f089..01b606b 100644
+--- a/CPP/7zip/Compress/Rar1Decoder.h
++++ b/CPP/7zip/Compress/Rar1Decoder.h
+@@ -39,6 +39,7 @@ public:
+ 
+   Int64 m_UnpackSize;
+   bool m_IsSolid;
++  bool _errorMode;
+ 
+   UInt32 ReadBits(int numBits);
+   HRESULT CopyBlock(UInt32 distance, UInt32 len);
+diff --git a/CPP/7zip/Compress/Rar2Decoder.cpp b/CPP/7zip/Compress/Rar2Decoder.cpp
+index b3f2b4b..0580c8d 100644
+--- a/CPP/7zip/Compress/Rar2Decoder.cpp
++++ b/CPP/7zip/Compress/Rar2Decoder.cpp
+@@ -80,7 +80,8 @@ static const UInt32 kHistorySize = 1 << 20;
+ static const UInt32 kWindowReservSize = (1 << 22) + 256;
+ 
+ CDecoder::CDecoder():
+-  m_IsSolid(false)
++  m_IsSolid(false),
++  m_TablesOK(false)
+ {
+ }
+ 
+@@ -100,6 +101,8 @@ UInt32 CDecoder::ReadBits(unsigned numBits) { return m_InBitStream.ReadBits(numB
+ 
+ bool CDecoder::ReadTables(void)
+ {
++  m_TablesOK = false;
++
+   Byte levelLevels[kLevelTableSize];
+   Byte newLevels[kMaxTableSize];
+   m_AudioMode = (ReadBits(1) == 1);
+@@ -170,6 +173,8 @@ bool CDecoder::ReadTables(void)
+   }
+   
+   memcpy(m_LastLevels, newLevels, kMaxTableSize);
++  m_TablesOK = true;
++
+   return true;
+ }
+ 
+@@ -344,6 +349,9 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
+       return S_FALSE;
+   }
+ 
++  if (!m_TablesOK)
++    return S_FALSE;
++
+   UInt64 startPos = m_OutWindowStream.GetProcessedSize();
+   while (pos < unPackSize)
+   {
+diff --git a/CPP/7zip/Compress/Rar2Decoder.h b/CPP/7zip/Compress/Rar2Decoder.h
+index 3a0535c..0e9005f 100644
+--- a/CPP/7zip/Compress/Rar2Decoder.h
++++ b/CPP/7zip/Compress/Rar2Decoder.h
+@@ -139,6 +139,7 @@ class CDecoder :
+ 
+   UInt64 m_PackSize;
+   bool m_IsSolid;
++  bool m_TablesOK;
+ 
+   void InitStructures();
+   UInt32 ReadBits(unsigned numBits);
+diff --git a/CPP/7zip/Compress/Rar3Decoder.cpp b/CPP/7zip/Compress/Rar3Decoder.cpp
+index 3bf2513..6cb8a6a 100644
+--- a/CPP/7zip/Compress/Rar3Decoder.cpp
++++ b/CPP/7zip/Compress/Rar3Decoder.cpp
+@@ -92,7 +92,8 @@ CDecoder::CDecoder():
+   _writtenFileSize(0),
+   _vmData(0),
+   _vmCode(0),
+-  m_IsSolid(false)
++  m_IsSolid(false),
++  _errorMode(false)
+ {
+   Ppmd7_Construct(&_ppmd);
+ }
+@@ -545,6 +546,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
+     return InitPPM();
+   }
+ 
++  TablesRead = false;
++  TablesOK = false;
++
+   _lzMode = true;
+   PrevAlignBits = 0;
+   PrevAlignCount = 0;
+@@ -606,6 +610,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
+       }
+     }
+   }
++  if (InputEofError())
++    return S_FALSE;
++
+   TablesRead = true;
+ 
+   // original code has check here:
+@@ -623,6 +630,9 @@ HRESULT CDecoder::ReadTables(bool &keepDecompressing)
+   RIF(m_LenDecoder.Build(&newLevels[kMainTableSize + kDistTableSize + kAlignTableSize]));
+ 
+   memcpy(m_LastLevels, newLevels, kTablesSizesSum);
++
++  TablesOK = true;
++
+   return S_OK;
+ }
+ 
+@@ -824,7 +834,12 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
+     PpmEscChar = 2;
+     PpmError = true;
+     InitFilters();
++    _errorMode = false;
+   }
++
++  if (_errorMode)
++    return S_FALSE;
++
+   if (!m_IsSolid || !TablesRead)
+   {
+     bool keepDecompressing;
+@@ -838,6 +853,8 @@ HRESULT CDecoder::CodeReal(ICompressProgressInfo *progress)
+     bool keepDecompressing;
+     if (_lzMode)
+     {
++      if (!TablesOK)
++        return S_FALSE;
+       RINOK(DecodeLZ(keepDecompressing))
+     }
+     else
+@@ -901,8 +918,8 @@ STDMETHODIMP CDecoder::Code(ISequentialInStream *inStream, ISequentialOutStream
+     _unpackSize = outSize ? *outSize : (UInt64)(Int64)-1;
+     return CodeReal(progress);
+   }
+-  catch(const CInBufferException &e)  { return e.ErrorCode; }
+-  catch(...) { return S_FALSE; }
++  catch(const CInBufferException &e)  { _errorMode = true; return e.ErrorCode; }
++  catch(...) { _errorMode = true; return S_FALSE; }
+   // CNewException is possible here. But probably CNewException is caused
+   // by error in data stream.
+ }
+diff --git a/CPP/7zip/Compress/Rar3Decoder.h b/CPP/7zip/Compress/Rar3Decoder.h
+index c130cec..2f72d7d 100644
+--- a/CPP/7zip/Compress/Rar3Decoder.h
++++ b/CPP/7zip/Compress/Rar3Decoder.h
+@@ -192,6 +192,7 @@ class CDecoder:
+   UInt32 _lastFilter;
+ 
+   bool m_IsSolid;
++  bool _errorMode;
+ 
+   bool _lzMode;
+   bool _unsupportedFilter;
+@@ -200,6 +201,7 @@ class CDecoder:
+   UInt32 PrevAlignCount;
+ 
+   bool TablesRead;
++  bool TablesOK;
+ 
+   CPpmd7 _ppmd;
+   int PpmEscChar;
diff --git a/app-arch/p7zip/files/p7zip-16.02-darwin.patch b/app-arch/p7zip/files/p7zip-16.02-darwin.patch
new file mode 100644
index 000000000000..1c3899f30a53
--- /dev/null
+++ b/app-arch/p7zip/files/p7zip-16.02-darwin.patch
@@ -0,0 +1,46 @@
+--- a/CPP/myWindows/StdAfx.h
++++ b/CPP/myWindows/StdAfx.h
+@@ -32,7 +32,7 @@
+ #include <errno.h>
+ #include <math.h>
+ 
+-#ifdef __NETWARE__
++#if defined(__NETWARE__) || defined(__MACH__)
+ #include <sys/types.h>
+ #endif
+ 
+
+https://svnweb.freebsd.org/ports/head/archivers/p7zip/files/patch-CPP_Windows_ErrorMsg.cpp?view=markup&pathrev=458172
+This fixes the build with Clang 6.0:
+
+ ../../../../CPP/Windows/ErrorMsg.cpp:24:10: error: case value evaluates to -2147024809, which cannot be narrowed to type 'DWORD' (aka  'unsigned int') [-Wc++11-narrowing]
+     case E_INVALIDARG          : txt = "E_INVALIDARG"; break ;
+          ^
+ ../../../../CPP/Common/MyWindows.h:89:22: note: expanded from macro 'E_INVALIDARG'
+ #define E_INVALIDARG ((HRESULT)0x80070057L)
+                      ^
+
+The HRESULT cast in the macro causes the value to be read as signed int.
+--- a/CPP/Windows/ErrorMsg.cpp
++++ b/CPP/Windows/ErrorMsg.cpp
+@@ -15,13 +15,13 @@ UString MyFormatMessage(DWORD errorCode)
+ 
+   switch(errorCode) {
+     case ERROR_NO_MORE_FILES   : txt = "No more files"; break ;
+-    case E_NOTIMPL             : txt = "E_NOTIMPL"; break ;
+-    case E_NOINTERFACE         : txt = "E_NOINTERFACE"; break ;
+-    case E_ABORT               : txt = "E_ABORT"; break ;
+-    case E_FAIL                : txt = "E_FAIL"; break ;
+-    case STG_E_INVALIDFUNCTION : txt = "STG_E_INVALIDFUNCTION"; break ;
+-    case E_OUTOFMEMORY         : txt = "E_OUTOFMEMORY"; break ;
+-    case E_INVALIDARG          : txt = "E_INVALIDARG"; break ;
++    case (DWORD)(E_NOTIMPL)             : txt = "E_NOTIMPL"; break ;
++    case (DWORD)(E_NOINTERFACE)         : txt = "E_NOINTERFACE"; break ;
++    case (DWORD)(E_ABORT)               : txt = "E_ABORT"; break ;
++    case (DWORD)(E_FAIL)                : txt = "E_FAIL"; break ;
++    case (DWORD)(STG_E_INVALIDFUNCTION) : txt = "STG_E_INVALIDFUNCTION"; break ;
++    case (DWORD)(E_OUTOFMEMORY)         : txt = "E_OUTOFMEMORY"; break ;
++    case (DWORD)(E_INVALIDARG)          : txt = "E_INVALIDARG"; break ;
+     case ERROR_DIRECTORY          : txt = "Error Directory"; break ;
+     default:
+       txt = strerror(errorCode);
diff --git a/app-arch/p7zip/metadata.xml b/app-arch/p7zip/metadata.xml
new file mode 100644
index 000000000000..17c1bda0021e
--- /dev/null
+++ b/app-arch/p7zip/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>prometheanfire@gentoo.org</email>
+  </maintainer>
+  <use>
+    <flag name="rar">Enable support for non-free rar decoder</flag>
+  </use>
+  <upstream>
+    <remote-id type="sourceforge">p7zip</remote-id>
+  </upstream>
+</pkgmetadata>
diff --git a/app-arch/p7zip/p7zip-16.02-r4.ebuild b/app-arch/p7zip/p7zip-16.02-r4.ebuild
new file mode 100644
index 000000000000..dc858bf58b87
--- /dev/null
+++ b/app-arch/p7zip/p7zip-16.02-r4.ebuild
@@ -0,0 +1,165 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+WX_GTK_VER="3.0"
+
+inherit toolchain-funcs wxwidgets
+
+DESCRIPTION="Port of 7-Zip archiver for Unix"
+HOMEPAGE="http://p7zip.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${PN}_${PV}_src_all.tar.bz2"
+
+LICENSE="LGPL-2.1 rar? ( unRAR )"
+SLOT="0"
+KEYWORDS="alpha amd64 ~arm ~arm64 hppa ia64 ppc ppc64 ~s390 sparc x86 ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris"
+IUSE="abi_x86_x32 doc kde +pch rar static wxwidgets"
+
+REQUIRED_USE="kde? ( wxwidgets )"
+
+RDEPEND="wxwidgets? ( x11-libs/wxGTK:${WX_GTK_VER}[X] )"
+DEPEND="${RDEPEND}
+	abi_x86_x32? ( >=dev-lang/yasm-1.2.0-r1 )
+	amd64? ( dev-lang/yasm )
+	x86? ( dev-lang/nasm )"
+
+S=${WORKDIR}/${PN}_${PV}
+
+DOCS=( ChangeLog README TODO )
+
+PATCHES=(
+	"${FILESDIR}"/${P}-darwin.patch
+	"${FILESDIR}"/CVE-2016-9296.patch
+	"${FILESDIR}"/CVE-2017-17969.patch
+	"${FILESDIR}"/CVE-2018-5996.patch
+	"${FILESDIR}"/CVE-2018-10115.patch
+)
+
+src_prepare() {
+	default
+
+	if ! use pch; then
+		sed "s:PRE_COMPILED_HEADER=StdAfx.h.gch:PRE_COMPILED_HEADER=:g" -i makefile.* || die
+	fi
+
+	sed \
+		-e 's:-m32 ::g' \
+		-e 's:-m64 ::g' \
+		-e 's:-pipe::g' \
+		-e '/ALLFLAGS/s:-s ::' \
+		-e "/OPTFLAGS=/s:=.*:=${CXXFLAGS}:" \
+		-i makefile* || die
+
+	# remove non-free RAR codec
+	if use rar; then
+		ewarn "Enabling nonfree RAR decompressor"
+	else
+		sed \
+			-e '/Rar/d' \
+			-e '/RAR/d' \
+			-i makefile* CPP/7zip/Bundles/Format7zFree/makefile || die
+		rm -rf CPP/7zip/Compress/Rar || die
+	fi
+
+	if use abi_x86_x32; then
+		sed -i -e "/^ASM=/s:amd64:x32:" makefile* || die
+		cp -f makefile.linux_amd64_asm makefile.machine || die
+	elif use amd64; then
+		cp -f makefile.linux_amd64_asm makefile.machine || die
+	elif use x86; then
+		cp -f makefile.linux_x86_asm_gcc_4.X makefile.machine || die
+	elif [[ ${CHOST} == *-darwin* ]] ; then
+		# Mac OS X needs this special makefile, because it has a non-GNU
+		# linker, it doesn't matter so much for bitwidth, for it doesn't
+		# do anything with it
+		cp -f makefile.macosx_llvm_64bits makefile.machine
+		# bundles have extension .bundle but don't die because USE=-rar
+		# removes the Rar directory
+		sed -i -e '/strcpy(name/s/\.so/.bundle/' \
+			CPP/Windows/DLL.cpp || die
+		sed -i -e '/^PROG=/s/\.so/.bundle/' \
+			CPP/7zip/Bundles/Format7zFree/makefile.list \
+			$(use rar && echo CPP/7zip/Compress/Rar/makefile.list) || die
+	elif use x86-fbsd; then
+		# FreeBSD needs this special makefile, because it hasn't -ldl
+		sed -e 's/-lc_r/-pthread/' makefile.freebsd > makefile.machine
+	fi
+
+	if use static; then
+		sed -i -e '/^LOCAL_LIBS=/s/LOCAL_LIBS=/&-static /' makefile.machine || die
+	fi
+
+	if use kde || use wxwidgets; then
+		need-wxwidgets unicode
+		einfo "Preparing dependency list"
+		emake depend
+	fi
+}
+
+src_compile() {
+	emake CC=$(tc-getCC) CXX=$(tc-getCXX) all3
+	if use kde || use wxwidgets; then
+		emake CC=$(tc-getCC) CXX=$(tc-getCXX) -- 7zG
+#		emake -- 7zFM
+	fi
+}
+
+src_test() {
+	emake test test_7z test_7zr
+}
+
+src_install() {
+	# this wrappers can not be symlinks, p7zip should be called with full path
+	make_wrapper 7zr "/usr/$(get_libdir)/${PN}/7zr"
+	make_wrapper 7za "/usr/$(get_libdir)/${PN}/7za"
+	make_wrapper 7z "/usr/$(get_libdir)/${PN}/7z"
+
+	if use kde || use wxwidgets; then
+		make_wrapper 7zG "/usr/$(get_libdir)/${PN}/7zG"
+#		make_wrapper 7zFM "/usr/$(get_libdir)/${PN}/7zFM"
+
+#		make_desktop_entry 7zFM "${PN} FM" ${PN} "GTK;Utility;Archiving;Compression"
+
+		dobin GUI/p7zipForFilemanager
+		exeinto /usr/$(get_libdir)/${PN}
+#		doexe bin/7z{G,FM}
+		doexe bin/7zG
+
+		insinto /usr/$(get_libdir)/${PN}
+		doins -r GUI/Lang
+		doins -r DOC/MANUAL
+
+		insinto /usr/share/icons/hicolor/16x16/apps/
+		newins GUI/p7zip_16_ok.png p7zip.png
+
+		if use kde; then
+			rm GUI/kde4/p7zip_compress.desktop || die
+			insinto /usr/share/kservices5/ServiceMenus
+			doins GUI/kde4/*.desktop
+			dodir /usr/share/kde4/services/ServiceMenus # drop these lines after konqueror:4/krusader:4 are gone
+			for item in "${ED}"usr/share/kservices5/ServiceMenus/*.desktop; do
+				item="$(basename ${item})"
+				dosym "/usr/share/kservices5/ServiceMenus/${item}" "/usr/share/kde4/services/ServiceMenus/${item}"
+			done
+		fi
+	fi
+
+	dobin contrib/gzip-like_CLI_wrapper_for_7z/p7zip
+	doman contrib/gzip-like_CLI_wrapper_for_7z/man1/p7zip.1
+
+	exeinto /usr/$(get_libdir)/${PN}
+	doexe bin/7z bin/7za bin/7zr bin/7zCon.sfx
+	doexe bin/*$(get_modname)
+	if use rar; then
+		exeinto /usr/$(get_libdir)/${PN}/Codecs/
+		doexe bin/Codecs/*$(get_modname)
+	fi
+
+	doman man1/7z.1 man1/7za.1 man1/7zr.1
+
+	if use doc; then
+		dodoc DOC/*.txt
+		dohtml -r DOC/MANUAL/*
+	fi
+}