Fix for CVE-2016-3189; proposed patch from RH

archivers/bzip2/Makefile

@@ -1,10 +1,10 @@
-# $OpenBSD: Makefile,v 1.72 2016/03/10 21:58:51 naddy Exp $
+# $OpenBSD: Makefile,v 1.73 2016/06/28 09:56:23 jasper Exp $
 
 COMMENT=	block-sorting file compressor, unencumbered
 
 VERSION=	1.0.6
 DISTNAME=	bzip2-${VERSION}
-REVISION=	7
+REVISION=	8
 CATEGORIES=	archivers
 MASTER_SITES=	${HOMEPAGE}${VERSION}/
 SHARED_LIBS=	bz2	10.4

archivers/bzip2/patches/patch-bzip2recover_c

@@ -0,0 +1,15 @@
+$OpenBSD: patch-bzip2recover_c,v 1.1 2016/06/28 09:56:23 jasper Exp $
+
+CVE-2016-3189 bzip2: heap use after free in bzip2recover
+Patch from: https://bugzilla.redhat.com/show_bug.cgi?id=1319648
+
+--- bzip2recover.c.orig	Tue Jun 28 11:54:25 2016
++++ bzip2recover.c	Tue Jun 28 11:54:43 2016
+@@ -457,6 +457,7 @@ Int32 main ( Int32 argc, Char** argv )
+             bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 );
+             bsPutUInt32 ( bsWr, blockCRC );
+             bsClose ( bsWr );
++	    outFile = NULL;
+          }
+          if (wrBlock >= rbCtr) break;
+          wrBlock++;