diff --git a/freetype-2.9.1-avoid-invalid-face-index.patch b/freetype-2.9.1-avoid-invalid-face-index.patch new file mode 100644 index 0000000..6d09a00 --- /dev/null +++ b/freetype-2.9.1-avoid-invalid-face-index.patch @@ -0,0 +1,30 @@ +From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Thu, 17 Mar 2022 19:24:16 +0100 +Subject: [PATCH] [sfnt] Avoid invalid face index. + +Fixes #1138. + +* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): +Check `face_index` before decrementing. +--- + src/sfnt/sfobjs.c | 2 +- + src/sfnt/sfwoff2.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c +index f9d4d3858..9771c35df 100644 +--- a/src/sfnt/sfobjs.c ++++ b/src/sfnt/sfobjs.c +@@ -566,7 +566,7 @@ + face_index = FT_ABS( face_instance_index ) & 0xFFFF; + + /* value -(N+1) requests information on index N */ +- if ( face_instance_index < 0 ) ++ if ( face_instance_index < 0 && face_index > 0 ) + face_index--; + + if ( face_index >= face->ttc_header.count ) +-- +2.35.1 + diff --git a/freetype-2.9.1-guard-face-size.patch b/freetype-2.9.1-guard-face-size.patch new file mode 100644 index 0000000..8a447ae --- /dev/null +++ b/freetype-2.9.1-guard-face-size.patch @@ -0,0 +1,27 @@ +From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:37:28 +0100 +Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. + +Fixes #1140. +--- + src/base/ftobjs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 6492a1517..282c9121a 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -3409,6 +3409,9 @@ + if ( !face ) + return FT_THROW( Invalid_Face_Handle ); + ++ if ( !face->size ) ++ return FT_THROW( Invalid_Size_Handle ); ++ + if ( !req || req->width < 0 || req->height < 0 || + req->type >= FT_SIZE_REQUEST_TYPE_MAX ) + return FT_THROW( Invalid_Argument ); +-- +2.35.1 + diff --git a/freetype-2.9.1-properly-guard-face-index.patch b/freetype-2.9.1-properly-guard-face-index.patch new file mode 100644 index 0000000..92ae817 --- /dev/null +++ b/freetype-2.9.1-properly-guard-face-index.patch @@ -0,0 +1,46 @@ +From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 06:40:17 +0100 +Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard + `face_index`. + +We must ensure that the cast to `FT_Int` doesn't change the sign. + +Fixes #1139. +--- + src/base/ftobjs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:30:45 +0100 +Subject: [PATCH 2/2] * src/base/ftobjs.c (ft_open_face_internal): Thinko. + +--- + src/base/ftobjs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 2c0f0e6c9..10952a6c6 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -2527,6 +2527,16 @@ + #endif + + ++ /* only use lower 31 bits together with sign bit */ ++ if ( face_index > 0 ) ++ face_index &= 0x7FFFFFFFL; ++ else ++ { ++ face_index = -face_index; ++ face_index &= 0x7FFFFFFFL; ++ face_index = -face_index; ++ } ++ + #ifdef FT_DEBUG_LEVEL_TRACE + FT_TRACE3(( "FT_Open_Face: " )); + if ( face_index < 0 ) +-- +2.35.1 + diff --git a/freetype-2.9.1-windres.patch b/freetype-2.9.1-windres.patch new file mode 100644 index 0000000..f3a4b0c --- /dev/null +++ b/freetype-2.9.1-windres.patch @@ -0,0 +1,20 @@ +--- freetype-2.9.1/builds/unix/configure ++++ freetype-2.9.1/builds/unix/configure +@@ -11853,6 +11853,8 @@ CC=$lt_save_CC + # Only expand once: + + ++if false ++then : + if test -n "$ac_tool_prefix"; then + # Extract the first word of "${ac_tool_prefix}windres", so it can be a program name with args. + set dummy ${ac_tool_prefix}windres; ac_word=$2 +@@ -12022,6 +12025,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu + CC=$lt_save_CC + CFLAGS=$lt_save_CFLAGS + ++fi ++ + + + # checks for native programs to generate building tool diff --git a/freetype.spec b/freetype.spec index 3c124bf..ba024a6 100644 --- a/freetype.spec +++ b/freetype.spec @@ -3,7 +3,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.9.1 -Release: 4%{?dist}.1 +Release: 9%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -32,6 +32,16 @@ Patch6: freetype-2.9.1-covscan.patch Patch7: freetype-2.9.1-png-bitmap-size.patch Patch8: freetype-2.9.1-png-memory-leak.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2077989 +Patch9: freetype-2.9.1-avoid-invalid-face-index.patch +Patch10: freetype-2.9.1-windres.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=2077991 +Patch11: freetype-2.9.1-properly-guard-face-index.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=2077985 +Patch12: freetype-2.9.1-guard-face-size.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -92,6 +102,10 @@ popd %patch6 -p1 -b .covscan %patch7 -p1 -b .png-bitmap-size %patch8 -p1 -b .png-memory-leak +%patch9 -p1 -b .avoid-invalid-face-index +%patch10 -p1 -b .windres +%patch11 -p1 -b .properly-guard-face-index +%patch12 -p1 -b .guard-face-size %build @@ -204,10 +218,26 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog -* Fri Oct 30 2020 Marek Kasik - 2.9.1-4.el8_3.1 +* Fri May 27 2022 Marek Kasik - 2.9.1-9 +- Guard face->size +- Resolves: #2079279 + +* Thu May 26 2022 Marek Kasik - 2.9.1-8 +- Properly guard "face_index" +- Resolves: #2079261 + +* Thu May 26 2022 Marek Kasik - 2.9.1-7 +- Do not search for windres +- Resolves: #2079270 + +* Wed May 25 2022 Marek Kasik - 2.9.1-6 +- Avoid invalid face index +- Resolves: #2079270 + +* Thu Nov 5 2020 Marek Kasik - 2.9.1-5 - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c -- Resolves: #1891905 +- Resolves: #1891906 * Fri Dec 7 2018 Marek Kasik - 2.9.1-4 - Use pkgconf in freetype-config.in directly (RPMDiff)