Index: configure
diff -Nau configure.orig configure
--- configure.orig	2004-06-14 11:18:55 +0200
+++ configure	2004-08-11 16:13:39 +0200
@@ -1783,21 +1783,6 @@
 	    CFG_FREETYPE=yes
 	fi
     fi
-    # add freetype2 include path
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.inc ];then
-	QMAKE_VARS="$QMAKE_VARS \"INCLUDEPATH+=`cat $outpath/config.tests/x11/xft.inc`\""
-    fi
-    rm -f $outpath/config.tests/x11/xft.inc
-    # add Xft specific libraries
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.lib ]; then
-	QMAKE_VARS="$QMAKE_VARS \"QMAKE_LIBS_X11=`cat $outpath/config.tests/x11/xft.lib` \$\$QMAKE_LIBS_X11\""
-    fi
-    rm -f $outpath/config.tests/x11/xft.lib
-    # add Xft specific config options
-    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.cfg ]; then
-	QMAKE_CONFIG="$QMAKE_CONFIG `cat $outpath/config.tests/x11/xft.cfg`"
-    fi
-    rm -f $outpath/config.tests/x11/xft.cfg
     # auto-detect Session Management support
     if [ "$CFG_SM" = "auto" ]; then
 	if $x11tests/sm.test $XQMAKESPEC $OPT_VERBOSE $L_FLAGS $I_FLAGS; then
@@ -2927,6 +2912,21 @@
     if [ "$CFG_XKB" = "yes" ]; then
         QMAKE_CONFIG="$QMAKE_CONFIG xkb"
     fi
+    # add freetype2 include path
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.inc ];then
+	QMAKE_VARS="$QMAKE_VARS \"INCLUDEPATH+=`cat $outpath/config.tests/x11/xft.inc`\""
+    fi
+    rm -f $outpath/config.tests/x11/xft.inc
+    # add Xft specific libraries
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.lib ]; then
+	QMAKE_VARS="$QMAKE_VARS \"QMAKE_LIBS_X11=`cat $outpath/config.tests/x11/xft.lib` \$\$QMAKE_LIBS_X11\""
+    fi
+    rm -f $outpath/config.tests/x11/xft.lib
+    # add Xft specific config options
+    if [ "$CFG_FREETYPE" = "yes" ] && [ -f $outpath/config.tests/x11/xft.cfg ]; then
+	QMAKE_CONFIG="$QMAKE_CONFIG `cat $outpath/config.tests/x11/xft.cfg`"
+    fi
+    rm -f $outpath/config.tests/x11/xft.cfg
 elif [ "$PLATFORM_MAC" = "yes" ]; then
     if [ "$CFG_TABLET" = "yes" ]; then
 	QMAKE_CONFIG="$QMAKE_CONFIG tablet"
Index: config.test/x11/xfreetype.test
diff -Nau config.tests/x11/xfreetype.test.orig config.tests/x11/xfreetype.test
--- config.tests/x11/xfreetype.test.orig	2003-12-08 10:04:06 +0100
+++ config.tests/x11/xfreetype.test	2004-08-11 16:14:43 +0200
@@ -56,7 +56,7 @@
     XFT=no
     [ "$VERBOSE" = "yes" ] && echo "  Could not find Xft lib anywhere in $LIBDIRS"
 fi
-LIBXFT="-l$F -lfreetype"
+LIBXFT="-l$F -lfontconfig -lexpat -lfreetype"
 
 # check for X11/Xft/Xft.h
 XFT_H=
@@ -90,7 +90,7 @@
     [ "$VERBOSE" = "yes" ] && echo "  Found Xft version $XFT_MAJOR.$XFT_MINOR.$XFT_REVISION"
     if [ "$XFT_MAJOR" = "2" ]; then
         XFT2=yes
-	LIBXFT="$LIBXFT -lfontconfig"
+	LIBXFT="$LIBXFT"
     fi
 fi
 
Index: src/3rdparty/libpng/pngconf.h
diff -Nau src/3rdparty/libpng/pngconf.h.orig src/3rdparty/libpng/pngconf.h
--- src/3rdparty/libpng/pngconf.h.orig	2003-05-27 17:19:23 +0200
+++ src/3rdparty/libpng/pngconf.h	2004-08-11 16:18:06 +0200
@@ -251,10 +251,6 @@
 #      define PNG_SAVE_BSD_SOURCE
 #      undef _BSD_SOURCE
 #    endif
-#    ifdef _SETJMP_H
-      __png.h__ already includes setjmp.h;
-      __dont__ include it again.;
-#    endif
 #  endif /* __linux__ */
 
    /* include setjmp.h for error handling */
Index: src/3rdparty/libpng/pngerror.c
diff -Nau src/3rdparty/libpng/pngerror.c.orig src/3rdparty/libpng/pngerror.c
--- src/3rdparty/libpng/pngerror.c.orig	2003-05-27 17:19:23 +0200
+++ src/3rdparty/libpng/pngerror.c	2004-08-11 16:19:27 +0200
@@ -135,10 +135,13 @@
       buffer[iout] = 0;
    else
    {
+      png_size_t len;
+      if ((len = png_strlen(error_message)) > 63)
+          len = 63;
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_strncpy(buffer+iout, error_message, 63);
-      buffer[iout+63] = 0;
+      png_strncpy(buffer+iout, error_message, len);
+      buffer[iout+len] = 0;
    }
 }
 

http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt

> [Problems discovered and fixed by] Chris Evans
> 
> 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c)
> 2) Dangerous code in png_handle_sBIT (pngrutil.c)
CAN-2004-0597

> 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c)
>    this flaw is duplicated in multiple other locations.
CAN-2004-0598

> 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c)
> 5) Integer overflow in png_read_png (pngread.c)
> 6) Integer overflows during progressive reading.
> 7) Other flaws.  [integer overflows]
CAN-2004-0599

http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-overflow.txt
    Use to patch libpng-1.0.9 through 1.2.5
    This fixes the most dangerous of the newly reported vulnerabilities

Index: src/3rdparty/libpng/png.h
diff -Nau src/3rdparty/libpng/png.h.orig src/3rdparty/libpng/png.h
--- src/3rdparty/libpng/png.h.orig	2004-08-11 16:31:06 +0200
+++ src/3rdparty/libpng/png.h	2004-08-11 16:44:14 +0200
@@ -839,6 +839,9 @@
 /* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */
 #define PNG_MAX_UINT PNG_UINT_31_MAX
 
+/* Constraints on width, height, (2 ^ 24) - 1*/
+#define PNG_MAX_DIMENSION 16777215
+
 /* These describe the color_type field in png_info. */
 /* color type masks */
 #define PNG_COLOR_MASK_PALETTE    1
Index: src/3rdparty/libpng/pngrutil.c
diff -Nau src/3rdparty/libpng/pngrutil.c.orig src/3rdparty/libpng/pngrutil.c
--- src/3rdparty/libpng/pngrutil.c.orig	2004-08-11 16:42:31 +0200
+++ src/3rdparty/libpng/pngrutil.c	2004-08-11 16:45:38 +0200
@@ -355,7 +355,11 @@
    png_crc_finish(png_ptr, 0);
 
    width = png_get_uint_32(buf);
+   if (width > PNG_MAX_DIMENSION)
+      png_error(png_ptr, "Width is too large");
    height = png_get_uint_32(buf + 4);
+   if (height > PNG_MAX_DIMENSION)
+      png_error(png_ptr, "Height is too large");
    bit_depth = buf[8];
    color_type = buf[9];
    compression_type = buf[10];
@@ -680,7 +684,7 @@
    else
       truelen = (png_size_t)png_ptr->channels;
 
-   if (length != truelen)
+   if (length != truelen || length > 4)
    {
       png_warning(png_ptr, "Incorrect sBIT chunk length");
       png_crc_finish(png_ptr, length);
@@ -1415,7 +1419,7 @@
 void /* PRIVATE */
 png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
 {
-   int num, i;
+   unsigned int num, i;
    png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
 
    png_debug(1, "in png_handle_hIST\n");
@@ -1441,8 +1445,8 @@
       return;
    }
 
-   num = (int)length / 2 ;
-   if (num != png_ptr->num_palette)
+   num = length / 2 ;
+   if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)
    {
       png_warning(png_ptr, "Incorrect hIST chunk length");
       png_crc_finish(png_ptr, length);
@@ -2883,6 +2887,9 @@
                png_read_data(png_ptr, chunk_length, 4);
                png_ptr->idat_size = png_get_uint_32(chunk_length);
 
+               if (png_ptr->idat_size > PNG_MAX_UINT)
+                  png_error(png_ptr, "Invalid chunk length.");
+
                png_reset_crc(png_ptr);
                png_crc_read(png_ptr, png_ptr->chunk_name, 4);
                if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
Index: src/xml/qxml.cpp
diff -Nau src/xml/qxml.cpp.orig src/xml/qxml.cpp
--- src/xml/qxml.cpp.orig	2005-01-21 18:16:02.000000000 +0100
+++ src/xml/qxml.cpp	2005-05-03 14:48:42.080658900 +0200
@@ -5999,38 +5999,38 @@
 */
 bool QXmlSimpleReader::parseChoiceSeq()
 {
-    const signed char Init             = 0;
-    const signed char Ws1              = 1; // eat whitespace
-    const signed char CS               = 2; // choice or set
-    const signed char Ws2              = 3; // eat whitespace
-    const signed char More             = 4; // more cp to read
-    const signed char Name             = 5; // read name
-    const signed char Done             = 6; //
-
-    const signed char InpWs            = 0; // S
-    const signed char InpOp            = 1; // (
-    const signed char InpCp            = 2; // )
-    const signed char InpQm            = 3; // ?
-    const signed char InpAst           = 4; // *
-    const signed char InpPlus          = 5; // +
-    const signed char InpPipe          = 6; // |
-    const signed char InpComm          = 7; // ,
-    const signed char InpUnknown       = 8;
+    const signed char Qt_Init             = 0;
+    const signed char Qt_Ws1              = 1; // eat whitespace
+    const signed char Qt_CS               = 2; // choice or set
+    const signed char Qt_Ws2              = 3; // eat whitespace
+    const signed char Qt_More             = 4; // more cp to read
+    const signed char Qt_Name             = 5; // read name
+    const signed char Qt_Done             = 6; //
+
+    const signed char Qt_InpWs            = 0; // S
+    const signed char Qt_InpOp            = 1; // (
+    const signed char Qt_InpCp            = 2; // )
+    const signed char Qt_InpQm            = 3; // ?
+    const signed char Qt_InpAst           = 4; // *
+    const signed char Qt_InpPlus          = 5; // +
+    const signed char Qt_InpPipe          = 6; // |
+    const signed char Qt_InpComm          = 7; // ,
+    const signed char Qt_InpUnknown       = 8;
 
     static const signed char table[6][9] = {
      /*  InpWs   InpOp  InpCp  InpQm  InpAst  InpPlus  InpPipe  InpComm  InpUnknown */
-	{ -1,     Ws1,   -1,    -1,    -1,     -1,      -1,      -1,      Name  }, // Init
-	{ -1,     CS,    -1,    -1,    -1,     -1,      -1,      -1,      CS    }, // Ws1
-	{ Ws2,    -1,    Done,  Ws2,   Ws2,    Ws2,     More,    More,    -1    }, // CS
-	{ -1,     -1,    Done,  -1,    -1,     -1,      More,    More,    -1    }, // Ws2
-	{ -1,     Ws1,   -1,    -1,    -1,     -1,      -1,      -1,      Name  }, // More (same as Init)
-	{ Ws2,    -1,    Done,  Ws2,   Ws2,    Ws2,     More,    More,    -1    }  // Name (same as CS)
+	{ -1,     Qt_Ws1,   -1,    -1,    -1,     -1,      -1,      -1,      Qt_Name  }, // Qt_Init
+	{ -1,     Qt_CS,    -1,    -1,    -1,     -1,      -1,      -1,      Qt_CS    }, // Qt_Ws1
+	{ Qt_Ws2,    -1,    Qt_Done,  Qt_Ws2,   Qt_Ws2,    Qt_Ws2,     Qt_More,    Qt_More,    -1    }, // Qt_CS
+	{ -1,     -1,    Qt_Done,  -1,    -1,     -1,      Qt_More,    Qt_More,    -1    }, //    Qt_Ws2
+	{ -1,     Qt_Ws1,   -1,    -1,    -1,     -1,      -1,      -1,      Qt_Name  }, // More (same as Qt_Init)
+	{ Qt_Ws2,    -1,    Qt_Done,  Qt_Ws2,   Qt_Ws2,    Qt_Ws2,     Qt_More,    Qt_More,    -1    }  // Name (same as Qt_CS)
     };
     signed char state;
     signed char input;
 
     if ( d->parseStack==0 || d->parseStack->isEmpty() ) {
-	state = Init;
+	state = Qt_Init;
     } else {
 	state = d->parseStack->pop().state;
 #if defined(QT_QXML_DEBUG)
@@ -6053,7 +6053,7 @@
 
     for (;;) {
 	switch ( state ) {
-	    case Done:
+	    case Qt_Done:
 		return TRUE;
 	    case -1:
 		// Error
@@ -6066,59 +6066,59 @@
 	    return FALSE;
 	}
 	if        ( is_S(c) ) {
-	    input = InpWs;
+	    input = Qt_InpWs;
 	} else if ( c.unicode() == '(' ) {
-	    input = InpOp;
+	    input = Qt_InpOp;
 	} else if ( c.unicode() == ')' ) {
-	    input = InpCp;
+	    input = Qt_InpCp;
 	} else if ( c.unicode() == '?' ) {
-	    input = InpQm;
+	    input = Qt_InpQm;
 	} else if ( c.unicode() == '*' ) {
-	    input = InpAst;
+	    input = Qt_InpAst;
 	} else if ( c.unicode() == '+' ) {
-	    input = InpPlus;
+	    input = Qt_InpPlus;
 	} else if ( c.unicode() == '|' ) {
-	    input = InpPipe;
+	    input = Qt_InpPipe;
 	} else if ( c.unicode() == ',' ) {
-	    input = InpComm;
+	    input = Qt_InpComm;
 	} else {
-	    input = InpUnknown;
+	    input = Qt_InpUnknown;
 	}
 	state = table[state][input];
 
 	switch ( state ) {
-	    case Ws1:
+	    case Qt_Ws1:
 		if ( !next_eat_ws() ) {
 		    parseFailed( &QXmlSimpleReader::parseChoiceSeq, state );
 		    return FALSE;
 		}
 		break;
-	    case CS:
+	    case Qt_CS:
 		if ( !parseChoiceSeq() ) {
 		    parseFailed( &QXmlSimpleReader::parseChoiceSeq, state );
 		    return FALSE;
 		}
 		break;
-	    case Ws2:
+	    case Qt_Ws2:
 		if ( !next_eat_ws() ) {
 		    parseFailed( &QXmlSimpleReader::parseChoiceSeq, state );
 		    return FALSE;
 		}
 		break;
-	    case More:
+	    case Qt_More:
 		if ( !next_eat_ws() ) {
 		    parseFailed( &QXmlSimpleReader::parseChoiceSeq, state );
 		    return FALSE;
 		}
 		break;
-	    case Name:
+	    case Qt_Name:
 		d->parseName_useRef = FALSE;
 		if ( !parseName() ) {
 		    parseFailed( &QXmlSimpleReader::parseChoiceSeq, state );
 		    return FALSE;
 		}
 		break;
-	    case Done:
+	    case Qt_Done:
 		next();
 		break;
 	}
