diff --git a/.freetype.metadata b/.freetype.metadata deleted file mode 100644 index 8a939b3..0000000 --- a/.freetype.metadata +++ /dev/null @@ -1,3 +0,0 @@ -220c82062171c513e4017c523d196933c9de4a7d SOURCES/freetype-2.9.1.tar.bz2 -bb6c973f9fef972ad4ecc03bc09ed676b8dc0d59 SOURCES/freetype-doc-2.9.1.tar.bz2 -45704d7b75c4f9fdd6a9b3787918e8220b36aa77 SOURCES/ft2demos-2.9.1.tar.bz2 diff --git a/.gitignore b/.gitignore index 8ce7974..f81d6cf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ -SOURCES/freetype-2.9.1.tar.bz2 -SOURCES/freetype-doc-2.9.1.tar.bz2 -SOURCES/ft2demos-2.9.1.tar.bz2 +freetype-2.13.2.tar.xz +freetype-doc-2.13.2.tar.xz +ft2demos-2.13.2.tar.xz diff --git a/SOURCES/freetype-2.9-ftsmooth.patch b/SOURCES/freetype-2.9-ftsmooth.patch deleted file mode 100644 index 2735bd5..0000000 --- a/SOURCES/freetype-2.9-ftsmooth.patch +++ /dev/null @@ -1,101 +0,0 @@ ---- a/src/smooth/ftsmooth.c -+++ b/src/smooth/ftsmooth.c -@@ -232,39 +232,13 @@ - FT_UInt i, j; - - unsigned int height = bitmap->rows; -- unsigned int width = bitmap->width; -+ unsigned int width = bitmap->width / 3; - int pitch = bitmap->pitch; - -- -- /* Render 3 separate monochrome bitmaps, shifting the outline */ -- /* by 1/3 pixel. */ -- width /= 3; -- -- bitmap->buffer += width; -- -- error = render->raster_render( render->raster, ¶ms ); -- if ( error ) -- goto Exit; -- -- FT_Outline_Translate( outline, -21, 0 ); -- x_shift -= 21; -- bitmap->buffer += width; -- - error = render->raster_render( render->raster, ¶ms ); - if ( error ) - goto Exit; - -- FT_Outline_Translate( outline, 42, 0 ); -- x_shift += 42; -- bitmap->buffer -= 2 * width; -- -- error = render->raster_render( render->raster, ¶ms ); -- if ( error ) -- goto Exit; -- -- /* XXX: Rearrange the bytes according to FT_PIXEL_MODE_LCD. */ -- /* XXX: It is more efficient to render every third byte above. */ -- - if ( FT_ALLOC( temp, (FT_ULong)pitch ) ) - goto Exit; - -@@ -272,11 +246,7 @@ - { - line = bitmap->buffer + i * (FT_ULong)pitch; - for ( j = 0; j < width; j++ ) -- { -- temp[3 * j ] = line[j]; -- temp[3 * j + 1] = line[j + width]; -- temp[3 * j + 2] = line[j + width + width]; -- } -+ temp[3 * j] = temp[3 * j + 1] = temp[3 * j + 2] = line[j]; - FT_MEM_COPY( line, temp, pitch ); - } - -@@ -284,35 +254,23 @@ - } - else if ( vmul ) /* lcd_v */ - { -- int pitch = bitmap->pitch; -- -+ FT_Byte* line; -+ FT_UInt i; -+ int original_pitch = bitmap->pitch; - -- /* Render 3 separate monochrome bitmaps, shifting the outline */ -- /* by 1/3 pixel. Triple the pitch to render on each third row. */ - bitmap->pitch *= 3; - bitmap->rows /= 3; - -- bitmap->buffer += pitch; -- -- error = render->raster_render( render->raster, ¶ms ); -- if ( error ) -- goto Exit; -- -- FT_Outline_Translate( outline, 0, 21 ); -- y_shift += 21; -- bitmap->buffer += pitch; -- - error = render->raster_render( render->raster, ¶ms ); - if ( error ) - goto Exit; - -- FT_Outline_Translate( outline, 0, -42 ); -- y_shift -= 42; -- bitmap->buffer -= 2 * pitch; -- -- error = render->raster_render( render->raster, ¶ms ); -- if ( error ) -- goto Exit; -+ for ( i = 0; i < bitmap->rows; i++ ) -+ { -+ line = bitmap->buffer + i * bitmap->pitch; -+ FT_MEM_COPY( line + original_pitch, line, bitmap->width ); -+ FT_MEM_COPY( line + 2 * original_pitch, line, bitmap->width ); -+ } - - bitmap->pitch /= 3; - bitmap->rows *= 3; diff --git a/SOURCES/freetype-2.9.1-avoid-invalid-face-index.patch b/SOURCES/freetype-2.9.1-avoid-invalid-face-index.patch deleted file mode 100644 index 6d09a00..0000000 --- a/SOURCES/freetype-2.9.1-avoid-invalid-face-index.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Thu, 17 Mar 2022 19:24:16 +0100 -Subject: [PATCH] [sfnt] Avoid invalid face index. - -Fixes #1138. - -* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): -Check `face_index` before decrementing. ---- - src/sfnt/sfobjs.c | 2 +- - src/sfnt/sfwoff2.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c -index f9d4d3858..9771c35df 100644 ---- a/src/sfnt/sfobjs.c -+++ b/src/sfnt/sfobjs.c -@@ -566,7 +566,7 @@ - face_index = FT_ABS( face_instance_index ) & 0xFFFF; - - /* value -(N+1) requests information on index N */ -- if ( face_instance_index < 0 ) -+ if ( face_instance_index < 0 && face_index > 0 ) - face_index--; - - if ( face_index >= face->ttc_header.count ) --- -2.35.1 - diff --git a/SOURCES/freetype-2.9.1-covscan.patch b/SOURCES/freetype-2.9.1-covscan.patch deleted file mode 100644 index 49c113a..0000000 --- a/SOURCES/freetype-2.9.1-covscan.patch +++ /dev/null @@ -1,178 +0,0 @@ ---- freetype-2.9.1/builds/unix/freetype-config.in -+++ freetype-2.9.1/builds/unix/freetype-config.in -@@ -32,9 +32,6 @@ cflags=`%PKG_CONFIG% --cflags freetype2` - dynamic_libs=`pkgconf --libs freetype2` - static_libs=`pkgconf --static --libs freetype2` - --orig_prefix=$prefix --orig_exec_prefix=$exec_prefix -- - orig_includedir=$includedir - orig_libdir=$libdir - ---- freetype-2.9.1/ft2demos-2.9.1/src/ftbench.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftbench.c -@@ -749,6 +749,7 @@ - { - fprintf( stderr, - "couldn't allocate memory to pre-load font file\n" ); -+ fclose( file ); - - return 1; - } -@@ -758,9 +759,12 @@ - fprintf( stderr, "read error\n" ); - free( memory_file ); - memory_file = NULL; -+ fclose( file ); - - return 1; - } -+ -+ fclose( file ); - } - - error = FT_New_Memory_Face( lib, ---- freetype-2.9.1/ft2demos-2.9.1/src/ftchkwd.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftchkwd.c -@@ -118,8 +118,8 @@ - FT_Library library; - - int i, file_index; -- char filename[1024 + 4]; -- char alt_filename[1024 + 4]; -+ char filename[1024 + 5]; -+ char alt_filename[1024 + 5]; - char* execname; - char* fname; - -@@ -169,8 +169,8 @@ - #ifndef macintosh - if ( i >= 0 ) - { -- strncpy( filename + strlen( filename ), ".ttf", 4 ); -- strncpy( alt_filename + strlen( alt_filename ), ".ttc", 4 ); -+ strncpy( filename + strlen( filename ), ".ttf", 5 ); -+ strncpy( alt_filename + strlen( alt_filename ), ".ttc", 5 ); - } - #endif - ---- freetype-2.9.1/ft2demos-2.9.1/src/ftcommon.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftcommon.c -@@ -110,7 +110,10 @@ - - if ( mode != gr_pixel_mode_gray && - mode != gr_pixel_mode_rgb24 ) -+ { -+ free( display ); - return NULL; -+ } - - grInitDevices(); - ---- freetype-2.9.1/ft2demos-2.9.1/src/ftdump.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftdump.c -@@ -775,8 +775,8 @@ - char* argv[] ) - { - int i, file; -- char filename[1024 + 4]; -- char alt_filename[1024 + 4]; -+ char filename[1024 + 5]; -+ char alt_filename[1024 + 5]; - char* execname; - int num_faces; - int option; -@@ -872,8 +872,8 @@ - - if ( i >= 0 ) - { -- strncpy( filename + strlen( filename ), ".ttf", 4 ); -- strncpy( alt_filename + strlen( alt_filename ), ".ttc", 4 ); -+ strncpy( filename + strlen( filename ), ".ttf", 5 ); -+ strncpy( alt_filename + strlen( alt_filename ), ".ttc", 5 ); - } - #endif - ---- freetype-2.9.1/ft2demos-2.9.1/src/ftgrid.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftgrid.c -@@ -662,6 +662,7 @@ - break; - - default: -+ free( t ); - return; - } - ---- freetype-2.9.1/ft2demos-2.9.1/src/ftlint.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftlint.c -@@ -62,8 +62,8 @@ - { - int i, file_index; - unsigned int id; -- char filename[1024 + 4]; -- char alt_filename[1024 + 4]; -+ char filename[1024 + 5]; -+ char alt_filename[1024 + 5]; - char* execname; - char* fname; - -@@ -119,8 +119,8 @@ - #ifndef macintosh - if ( i >= 0 ) - { -- strncpy( filename + strlen( filename ), ".ttf", 4 ); -- strncpy( alt_filename + strlen( alt_filename ), ".ttc", 4 ); -+ strncpy( filename + strlen( filename ), ".ttf", 5 ); -+ strncpy( alt_filename + strlen( alt_filename ), ".ttc", 5 ); - } - #endif - i = (int)strlen( filename ); ---- freetype-2.9.1/ft2demos-2.9.1/src/ftmemchk.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/ftmemchk.c -@@ -227,8 +227,8 @@ int main( int argc, char** argv ) - { - int i, file_index; - unsigned int id; -- char filename[1024 + 4]; -- char alt_filename[1024 + 4]; -+ char filename[1024 + 5]; -+ char alt_filename[1024 + 5]; - char* execname; - char* fname; - -@@ -270,8 +270,8 @@ int main( int argc, char** argv ) - #ifndef macintosh - if ( i >= 0 ) - { -- strncpy( filename + strlen( filename ), ".ttf", 4 ); -- strncpy( alt_filename + strlen( alt_filename ), ".ttc", 4 ); -+ strncpy( filename + strlen( filename ), ".ttf", 5 ); -+ strncpy( alt_filename + strlen( alt_filename ), ".ttc", 5 ); - } - #endif - i = strlen( filename ); ---- freetype-2.9.1/ft2demos-2.9.1/src/fttimer.c -+++ freetype-2.9.1/ft2demos-2.9.1/src/fttimer.c -@@ -162,8 +162,8 @@ - char** argv ) - { - int i, total, base, rendered_glyphs; -- char filename[1024 + 4]; -- char alt_filename[1024 + 4]; -+ char filename[1024 + 5]; -+ char alt_filename[1024 + 5]; - - long t, t0, tz0; - -@@ -230,8 +230,8 @@ - - if ( i >= 0 ) - { -- strncpy( filename + strlen( filename ), ".ttf", 4 ); -- strncpy( alt_filename + strlen( alt_filename ), ".ttc", 4 ); -+ strncpy( filename + strlen( filename ), ".ttf", 5 ); -+ strncpy( alt_filename + strlen( alt_filename ), ".ttc", 5 ); - } - - /* Initialize engine */ diff --git a/SOURCES/freetype-2.9.1-cve-2025-27363.patch b/SOURCES/freetype-2.9.1-cve-2025-27363.patch deleted file mode 100644 index 295f716..0000000 --- a/SOURCES/freetype-2.9.1-cve-2025-27363.patch +++ /dev/null @@ -1,27 +0,0 @@ -diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c -index 39d9c3f..d36cbe9 100644 ---- a/src/truetype/ttgload.c -+++ b/src/truetype/ttgload.c -@@ -1840,7 +1840,7 @@ - short i, limit; - FT_SubGlyph subglyph; - -- FT_Outline outline; -+ FT_Outline outline = { 0, 0, NULL, NULL, NULL, 0 }; - FT_Vector* points = NULL; - char* tags = NULL; - short* contours = NULL; -@@ -1848,6 +1848,13 @@ - - limit = (short)gloader->current.num_subglyphs; - -+ /* make sure this isn't negative as we're going to add 4 later */ -+ if ( limit < 0 ) -+ { -+ error = FT_THROW( Invalid_Argument ); -+ goto Exit; -+ } -+ - /* construct an outline structure for */ - /* communication with `TT_Vary_Apply_Glyph_Deltas' */ - outline.n_points = (short)( gloader->current.num_subglyphs + 4 ); diff --git a/SOURCES/freetype-2.9.1-guard-face-size.patch b/SOURCES/freetype-2.9.1-guard-face-size.patch deleted file mode 100644 index 8a447ae..0000000 --- a/SOURCES/freetype-2.9.1-guard-face-size.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 09:37:28 +0100 -Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. - -Fixes #1140. ---- - src/base/ftobjs.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c -index 6492a1517..282c9121a 100644 ---- a/src/base/ftobjs.c -+++ b/src/base/ftobjs.c -@@ -3409,6 +3409,9 @@ - if ( !face ) - return FT_THROW( Invalid_Face_Handle ); - -+ if ( !face->size ) -+ return FT_THROW( Invalid_Size_Handle ); -+ - if ( !req || req->width < 0 || req->height < 0 || - req->type >= FT_SIZE_REQUEST_TYPE_MAX ) - return FT_THROW( Invalid_Argument ); --- -2.35.1 - diff --git a/SOURCES/freetype-2.9.1-png-bitmap-size.patch b/SOURCES/freetype-2.9.1-png-bitmap-size.patch deleted file mode 100644 index bd01ed2..0000000 --- a/SOURCES/freetype-2.9.1-png-bitmap-size.patch +++ /dev/null @@ -1,48 +0,0 @@ -From a3bab162b2ae616074c8877a04556932998aeacd Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Mon, 19 Oct 2020 23:45:28 +0200 -Subject: [PATCH] [sfnt] Fix heap buffer overflow (#59308). - -This is CVE-2020-15999. - -* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier. ---- - ChangeLog | 8 ++++++++ - src/sfnt/pngshim.c | 14 +++++++------- - 2 files changed, 15 insertions(+), 7 deletions(-) - -diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c -index 2e64e5846..f55016122 100644 ---- a/src/sfnt/pngshim.c -+++ b/src/sfnt/pngshim.c -@@ -332,6 +332,13 @@ - - if ( populate_map_and_metrics ) - { -+ /* reject too large bitmaps similarly to the rasterizer */ -+ if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF ) -+ { -+ error = FT_THROW( Array_Too_Large ); -+ goto DestroyExit; -+ } -+ - metrics->width = (FT_UShort)imgWidth; - metrics->height = (FT_UShort)imgHeight; - -@@ -340,13 +347,6 @@ - map->pixel_mode = FT_PIXEL_MODE_BGRA; - map->pitch = (int)( map->width * 4 ); - map->num_grays = 256; -- -- /* reject too large bitmaps similarly to the rasterizer */ -- if ( map->rows > 0x7FFF || map->width > 0x7FFF ) -- { -- error = FT_THROW( Array_Too_Large ); -- goto DestroyExit; -- } - } - - /* convert palette/gray image to rgb */ --- -2.26.2 - diff --git a/SOURCES/freetype-2.9.1-png-memory-leak.patch b/SOURCES/freetype-2.9.1-png-memory-leak.patch deleted file mode 100644 index 66f962f..0000000 --- a/SOURCES/freetype-2.9.1-png-memory-leak.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 007c109b4594c5e63948bd08b4d5011ad76ffb10 Mon Sep 17 00:00:00 2001 -From: Ben Wagner -Date: Fri, 23 Oct 2020 08:29:14 +0200 -Subject: [PATCH] * src/sfnt/pngshim.c (Load_SBit_Png): Fix memory leak - (#59322). - -The issue is that `rows` is allocated but will not be freed in the -event that the call to `png_read_image` fails and calls `longjmp`. ---- - ChangeLog | 7 +++++++ - src/sfnt/pngshim.c | 1 + - 2 files changed, 8 insertions(+) - -diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c -index f55016122..d4e43a9f4 100644 ---- a/src/sfnt/pngshim.c -+++ b/src/sfnt/pngshim.c -@@ -443,6 +443,7 @@ - png_read_end( png, info ); - - DestroyExit: -+ FT_FREE( rows ); - png_destroy_read_struct( &png, &info, NULL ); - FT_Stream_Close( &stream ); - --- -2.26.2 - diff --git a/SOURCES/freetype-2.9.1-properly-guard-face-index.patch b/SOURCES/freetype-2.9.1-properly-guard-face-index.patch deleted file mode 100644 index 92ae817..0000000 --- a/SOURCES/freetype-2.9.1-properly-guard-face-index.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 06:40:17 +0100 -Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard - `face_index`. - -We must ensure that the cast to `FT_Int` doesn't change the sign. - -Fixes #1139. ---- - src/base/ftobjs.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 09:30:45 +0100 -Subject: [PATCH 2/2] * src/base/ftobjs.c (ft_open_face_internal): Thinko. - ---- - src/base/ftobjs.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c -index 2c0f0e6c9..10952a6c6 100644 ---- a/src/base/ftobjs.c -+++ b/src/base/ftobjs.c -@@ -2527,6 +2527,16 @@ - #endif - - -+ /* only use lower 31 bits together with sign bit */ -+ if ( face_index > 0 ) -+ face_index &= 0x7FFFFFFFL; -+ else -+ { -+ face_index = -face_index; -+ face_index &= 0x7FFFFFFFL; -+ face_index = -face_index; -+ } -+ - #ifdef FT_DEBUG_LEVEL_TRACE - FT_TRACE3(( "FT_Open_Face: " )); - if ( face_index < 0 ) --- -2.35.1 - diff --git a/SOURCES/freetype-2.9.1-windres.patch b/SOURCES/freetype-2.9.1-windres.patch deleted file mode 100644 index f3a4b0c..0000000 --- a/SOURCES/freetype-2.9.1-windres.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- freetype-2.9.1/builds/unix/configure -+++ freetype-2.9.1/builds/unix/configure -@@ -11853,6 +11853,8 @@ CC=$lt_save_CC - # Only expand once: - - -+if false -+then : - if test -n "$ac_tool_prefix"; then - # Extract the first word of "${ac_tool_prefix}windres", so it can be a program name with args. - set dummy ${ac_tool_prefix}windres; ac_word=$2 -@@ -12022,6 +12025,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu - CC=$lt_save_CC - CFLAGS=$lt_save_CFLAGS - -+fi -+ - - - # checks for native programs to generate building tool diff --git a/freetype-2.10.0-internal-outline.patch b/freetype-2.10.0-internal-outline.patch new file mode 100644 index 0000000..0f69ff9 --- /dev/null +++ b/freetype-2.10.0-internal-outline.patch @@ -0,0 +1,72 @@ +--- freetype-2.10.0/include/freetype/ftoutln.h ++++ freetype-2.10.0/include/freetype/ftoutln.h +@@ -165,6 +165,15 @@ FT_BEGIN_HEADER + FT_Int numContours, + FT_Outline *anoutline ); + ++ /* ++ * Kept downstream for ABI compatibility only. ++ * It just throws error now. Remove once soname has been bumped. ++ */ ++ FT_EXPORT( FT_Error ) ++ FT_Outline_New_Internal( FT_Memory memory, ++ FT_UInt numPoints, ++ FT_Int numContours, ++ FT_Outline *anoutline ); + + /************************************************************************** + * +@@ -192,6 +201,13 @@ FT_BEGIN_HEADER + FT_Outline_Done( FT_Library library, + FT_Outline* outline ); + ++ /* ++ * Kept downstream for ABI compatibility only. ++ * It just throws error now. Remove once soname has been bumped. ++ */ ++ FT_EXPORT( FT_Error ) ++ FT_Outline_Done_Internal( FT_Memory memory, ++ FT_Outline* outline ); + + /************************************************************************** + * +--- freetype-2.10.0/src/base/ftoutln.c ++++ freetype-2.10.0/src/base/ftoutln.c +@@ -291,6 +291,19 @@ + + /* documentation is in ftoutln.h */ + ++ /* ++ * Kept downstream for ABI compatibility only. ++ * It just throws error now. Remove once soname has been bumped. ++ */ ++ FT_EXPORT_DEF( FT_Error ) ++ FT_Outline_New_Internal( FT_Memory memory, ++ FT_UInt numPoints, ++ FT_Int numContours, ++ FT_Outline *anoutline ) ++ { ++ return FT_THROW( Unimplemented_Feature ); ++ } ++ + FT_EXPORT_DEF( FT_Error ) + FT_Outline_New( FT_Library library, + FT_UInt numPoints, +@@ -423,6 +436,17 @@ + + /* documentation is in ftoutln.h */ + ++ /* ++ * Kept downstream for ABI compatibility only. ++ * It just throws error now. Remove once soname has been bumped. ++ */ ++ FT_EXPORT_DEF( FT_Error ) ++ FT_Outline_Done_Internal( FT_Memory memory, ++ FT_Outline* outline ) ++ { ++ return FT_THROW( Unimplemented_Feature ); ++ } ++ + FT_EXPORT_DEF( FT_Error ) + FT_Outline_Done( FT_Library library, + FT_Outline* outline ) diff --git a/freetype-2.13.2-SAST-findings.patch b/freetype-2.13.2-SAST-findings.patch new file mode 100644 index 0000000..81d28f8 --- /dev/null +++ b/freetype-2.13.2-SAST-findings.patch @@ -0,0 +1,75 @@ +diff --git a/src/autofit/afglobal.c b/src/autofit/afglobal.c +index b7403fa65..1fd5a0be3 100644 +--- a/src/autofit/afglobal.c ++++ b/src/autofit/afglobal.c +@@ -245,6 +245,12 @@ + af_shaper_get_coverage( globals, style_class, gstyles, 0 ); + } + ++ if ( dflt >= sizeof (af_style_classes) / sizeof (AF_StyleClass) ) ++ { ++ error = FT_THROW( Invalid_Offset ); ++ goto Exit; ++ } ++ + /* ... and finally the default OpenType features of the default script */ + af_shaper_get_coverage( globals, af_style_classes[dflt], gstyles, 1 ); + +diff --git a/src/tools/apinames.c b/src/tools/apinames.c +index 5a49b0649..feefb4ee7 100644 +--- a/src/tools/apinames.c ++++ b/src/tools/apinames.c +@@ -182,6 +182,7 @@ names_dump( FILE* out, + case OUTPUT_WATCOM_LBC: + { + const char* dot; ++ char temp[512]; + + + if ( !dll_name ) +@@ -195,7 +196,6 @@ names_dump( FILE* out, + dot = strchr( dll_name, '.' ); + if ( dot ) + { +- char temp[512]; + int len = dot - dll_name; + + +diff --git a/src/ftbench.c b/src/ftbench.c +index ec5c46c..7d96f60 100644 +--- a/ft2demos-2.13.2/src/ftbench.c ++++ b/ft2demos-2.13.2/src/ftbench.c +@@ -907,6 +907,7 @@ + { + fprintf( stderr, + "couldn't allocate memory to pre-load font file\n" ); ++ fclose( file ); + + return 1; + } +@@ -916,9 +917,11 @@ + fprintf( stderr, "read error\n" ); + free( memory_file ); + memory_file = NULL; ++ fclose( file ); + + return 1; + } ++ fclose( file ); + } + + error = FT_New_Memory_Face( lib, +diff --git a/src/ftgrid.c b/src/ftgrid.c +index bae4826..1a8f421 100644 +--- a/ft2demos-2.13.2/src/ftgrid.c ++++ b/ft2demos-2.13.2/src/ftgrid.c +@@ -420,6 +420,9 @@ + if ( !line ) + return; + ++ if (bit->mode == gr_pixel_mode_mono) ++ memset( line, 0, (size_t)( pitch * bit->rows * scale * scale )); ++ + switch( bit->mode ) + { + case gr_pixel_mode_mono: diff --git a/SOURCES/freetype-2.2.1-enable-valid.patch b/freetype-2.2.1-enable-valid.patch similarity index 88% rename from SOURCES/freetype-2.2.1-enable-valid.patch rename to freetype-2.2.1-enable-valid.patch index d924705..e1615aa 100644 --- a/SOURCES/freetype-2.2.1-enable-valid.patch +++ b/freetype-2.2.1-enable-valid.patch @@ -1,18 +1,18 @@ --- freetype-2.2.1/modules.cfg.orig 2006-07-07 21:01:09.000000000 -0400 +++ freetype-2.2.1/modules.cfg 2006-07-07 21:01:54.000000000 -0400 @@ -110,7 +110,7 @@ + # TrueType GX/AAT table validation. Needs `ftgxval.c' below. # - # No FT_CONFIG_OPTION_PIC support. -# AUX_MODULES += gxvalid +AUX_MODULES += gxvalid # Support for streams compressed with gzip (files with suffix .gz). # @@ -124,7 +124,7 @@ + # OpenType table validation. Needs `ftotval.c' below. # - # No FT_CONFIG_OPTION_PIC support. -# AUX_MODULES += otvalid +AUX_MODULES += otvalid diff --git a/SOURCES/freetype-2.3.0-enable-spr.patch b/freetype-2.3.0-enable-spr.patch similarity index 59% rename from SOURCES/freetype-2.3.0-enable-spr.patch rename to freetype-2.3.0-enable-spr.patch index d551000..2c812cd 100644 --- a/SOURCES/freetype-2.3.0-enable-spr.patch +++ b/freetype-2.3.0-enable-spr.patch @@ -1,11 +1,11 @@ --- freetype-2.3.0/include/freetype/config/ftoption.h.spf 2007-01-18 14:27:34.000000000 -0500 +++ freetype-2.3.0/include/freetype/config/ftoption.h 2007-01-18 14:27:48.000000000 -0500 @@ -92,7 +92,7 @@ - /* rendering technology that produces excellent output without LCD */ - /* filtering. */ - /* */ + * When this macro is not defined, FreeType offers alternative LCD + * rendering technology that produces excellent output. + */ -/* #define FT_CONFIG_OPTION_SUBPIXEL_RENDERING */ +#define FT_CONFIG_OPTION_SUBPIXEL_RENDERING - /*************************************************************************/ + /************************************************************************** diff --git a/SOURCES/freetype-2.5.2-more-demos.patch b/freetype-2.5.2-more-demos.patch similarity index 84% rename from SOURCES/freetype-2.5.2-more-demos.patch rename to freetype-2.5.2-more-demos.patch index e737cb7..7e58be7 100644 --- a/SOURCES/freetype-2.5.2-more-demos.patch +++ b/freetype-2.5.2-more-demos.patch @@ -14,4 +14,4 @@ + EXES += fttimer # EXES += testname - exes: $(EXES:%=$(BIN_DIR_2)/%$E) + # Not all demo programs have a man page; we thus check for existence in a diff --git a/SOURCES/freetype-2.6.5-libtool.patch b/freetype-2.6.5-libtool.patch similarity index 100% rename from SOURCES/freetype-2.6.5-libtool.patch rename to freetype-2.6.5-libtool.patch diff --git a/SOURCES/freetype-2.8-multilib.patch b/freetype-2.8-multilib.patch similarity index 100% rename from SOURCES/freetype-2.8-multilib.patch rename to freetype-2.8-multilib.patch diff --git a/SPECS/freetype.spec b/freetype.spec similarity index 82% rename from SPECS/freetype.spec rename to freetype.spec index 34f6931..2ad60dc 100644 --- a/SPECS/freetype.spec +++ b/freetype.spec @@ -1,19 +1,19 @@ %{!?with_xfree86:%define with_xfree86 1} +%bcond_with bootstrap Summary: A free and portable font rendering engine Name: freetype -Version: 2.9.1 -Release: 10%{?dist} -License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement -Group: System Environment/Libraries +Version: 2.13.2 +Release: 8%{?dist} +License: (FTL OR GPL-2.0-or-later) AND BSD-3-Clause AND MIT AND MIT-Modern-Variant AND LicenseRef-Fedora-Public-Domain AND Zlib URL: http://www.freetype.org -Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.bz2 -Source1: http://download.savannah.gnu.org/releases/freetype/freetype-doc-%{version}.tar.bz2 -Source2: http://download.savannah.gnu.org/releases/freetype/ft2demos-%{version}.tar.bz2 +Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.xz +Source1: http://download.savannah.gnu.org/releases/freetype/freetype-doc-%{version}.tar.xz +Source2: http://download.savannah.gnu.org/releases/freetype/ft2demos-%{version}.tar.xz Source3: ftconfig.h +# Enable subpixel rendering (ClearType) Patch0: freetype-2.3.0-enable-spr.patch - # Enable otvalid and gxvalid modules Patch1: freetype-2.2.1-enable-valid.patch # Enable additional demos @@ -23,38 +23,24 @@ Patch3: freetype-2.6.5-libtool.patch Patch4: freetype-2.8-multilib.patch -Patch5: freetype-2.9-ftsmooth.patch +Patch5: freetype-2.10.0-internal-outline.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1602501 -Patch6: freetype-2.9.1-covscan.patch - -# https://bugzilla.redhat.com/show_bug.cgi?id=1890210 -Patch7: freetype-2.9.1-png-bitmap-size.patch -Patch8: freetype-2.9.1-png-memory-leak.patch - -# https://bugzilla.redhat.com/show_bug.cgi?id=2077989 -Patch9: freetype-2.9.1-avoid-invalid-face-index.patch -Patch10: freetype-2.9.1-windres.patch - -# https://bugzilla.redhat.com/show_bug.cgi?id=2077991 -Patch11: freetype-2.9.1-properly-guard-face-index.patch - -# https://bugzilla.redhat.com/show_bug.cgi?id=2077985 -Patch12: freetype-2.9.1-guard-face-size.patch - -# CVE-2025-27363 -# https://access.redhat.com/security/cve/cve-2025-27363 -# Patch by Marc Deslauriers of Canonical -Patch13: freetype-2.9.1-cve-2025-27363.patch +Patch6: freetype-2.13.2-SAST-findings.patch +BuildRequires: gcc BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel BuildRequires: bzip2-devel +BuildRequires: brotli-devel +BuildRequires: make +%if %{without bootstrap} +BuildRequires: harfbuzz-devel +%endif Provides: %{name}-bytecode Provides: %{name}-subpixel -Obsoletes: freetype-freeworld +Obsoletes: freetype-freeworld < 2.9.1-2 %description The FreeType engine is a free and portable font rendering @@ -67,7 +53,6 @@ text-rendering library. %package demos Summary: A collection of FreeType demos -Group: System Environment/Libraries Requires: %{name} = %{version}-%{release} %description demos @@ -79,7 +64,6 @@ small utilities showing various capabilities of the FreeType library. %package devel Summary: FreeType development libraries and header files -Group: Development/Libraries Requires: %{name} = %{version}-%{release} Requires: pkgconf%{?_isa} @@ -94,24 +78,17 @@ FreeType. %prep %setup -q -b 1 -a 2 -%patch0 -p1 -b .enable-spr -%patch1 -p1 -b .enable-valid +%patch 0 -p1 -b .enable-spr +%patch 1 -p1 -b .enable-valid pushd ft2demos-%{version} -%patch2 -p1 -b .more-demos +%patch 2 -p1 -b .more-demos popd -%patch3 -p1 -b .libtool -%patch4 -p1 -b .multilib -%patch5 -p1 -b .ftsmooth -%patch6 -p1 -b .covscan -%patch7 -p1 -b .png-bitmap-size -%patch8 -p1 -b .png-memory-leak -%patch9 -p1 -b .avoid-invalid-face-index -%patch10 -p1 -b .windres -%patch11 -p1 -b .properly-guard-face-index -%patch12 -p1 -b .guard-face-size -%patch13 -p1 -b .cve-2025-27363 +%patch 3 -p1 -b .libtool +%patch 4 -p1 -b .multilib +%patch 5 -p1 -b .internal-outline +%patch 6 -p1 -b .SAST-findings %build @@ -120,10 +97,15 @@ popd --with-bzip2=yes \ --with-png=yes \ --enable-freetype-config \ - --with-harfbuzz=no +%if %{without bootstrap} + --with-harfbuzz=yes \ +%else + --with-harfbuzz=no \ +%endif + --with-brotli=yes sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' builds/unix/libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' builds/unix/libtool -make %{?_smp_mflags} +%make_build %if %{with_xfree86} # Build demos @@ -149,7 +131,7 @@ popd %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale { - for ftdemo in ftbench ftchkwd ftmemchk ftpatchk fttimer ftdump ftlint ftmemchk ftvalid ; do + for ftdemo in ftbench ftchkwd ftmemchk ftpatchk fttimer ftdump ftlint ftvalid ; do builds/unix/libtool --mode=install install -m 755 ft2demos-%{version}/bin/$ftdemo $RPM_BUILD_ROOT/%{_bindir} done } @@ -161,6 +143,20 @@ popd } %endif +# man pages for freetype-demos +{ + for ftdemo in ftbench ftdump ftlint ftvalid ; do + builds/unix/libtool --mode=install install -m 644 ft2demos-%{version}/man/${ftdemo}.1 $RPM_BUILD_ROOT/%{_mandir}/man1 + done +} +%if %{with_xfree86} +{ + for ftdemo in ftdiff ftgamma ftgrid ftmulti ftstring ftview ; do + builds/unix/libtool --mode=install install -m 644 ft2demos-%{version}/man/${ftdemo}.1 $RPM_BUILD_ROOT/%{_mandir}/man1 + done +} +%endif + # fix multilib issues %define wordsize %{__isa_bits} @@ -186,7 +182,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %files %{!?_licensedir:%global license %%doc} -%license docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT +%license LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT %{_libdir}/libfreetype.so.* %doc README @@ -199,6 +195,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_bindir}/ftdump %{_bindir}/ftlint %{_bindir}/ftvalid +%{_mandir}/man1/ftbench.1.gz +%{_mandir}/man1/ftdump.1.gz +%{_mandir}/man1/ftlint.1.gz +%{_mandir}/man1/ftvalid.1.gz %if %{with_xfree86} %{_bindir}/ftdiff %{_bindir}/ftgamma @@ -206,6 +206,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_bindir}/ftmulti %{_bindir}/ftstring %{_bindir}/ftview +%{_mandir}/man1/ftdiff.1.gz +%{_mandir}/man1/ftgamma.1.gz +%{_mandir}/man1/ftgrid.1.gz +%{_mandir}/man1/ftmulti.1.gz +%{_mandir}/man1/ftstring.1.gz +%{_mandir}/man1/ftview.1.gz %endif %doc ChangeLog README @@ -224,47 +230,156 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog -* Fri Mar 14 2025 Jonathan Wright - 2.9.1-10 -- Fix CVE-2025-27363 Out-of-bounds Write -- Resolves: RHEL-83094 +* Tue Oct 29 2024 Troy Dawson - 2.13.2-8 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 -* Fri May 27 2022 Marek Kasik - 2.9.1-9 -- Guard face->size -- Resolves: #2079279 +* Mon Sep 30 2024 Marek Kasik - 2.13.2-7 +- Fix SAST Automation findings +- Resolves: RHEL-44737 -* Thu May 26 2022 Marek Kasik - 2.9.1-8 -- Properly guard "face_index" -- Resolves: #2079261 +* Mon Jun 24 2024 Troy Dawson - 2.13.2-6 +- Bump release for June 2024 mass rebuild -* Thu May 26 2022 Marek Kasik - 2.9.1-7 -- Do not search for windres -- Resolves: #2079270 +* Tue Feb 6 2024 Marek Kasik - 2.13.2-5 +- Migrated to SPDX license -* Wed May 25 2022 Marek Kasik - 2.9.1-6 -- Avoid invalid face index -- Resolves: #2079270 +* Tue Jan 30 2024 Marek Kasik - 2.13.2-4 +- Remove a patch which causes FTBFS +- Resolves: #2261113 -* Thu Nov 5 2020 Marek Kasik - 2.9.1-5 +* Wed Jan 24 2024 Fedora Release Engineering - 2.13.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jan 19 2024 Fedora Release Engineering - 2.13.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Jan 16 2024 Marek Kasik - 2.13.2-1 +- Update to 2.13.2 +- Resolves: #2217137 + +* Wed Jul 19 2023 Fedora Release Engineering - 2.13.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jun 27 2023 Marek Kasik - 2.13.1-1 +- Update to 2.13.1 +- Resolves: #2217137 + +* Sat Feb 25 2023 Marek Kasik - 2.13.0-1 +- Update to 2.13.0 +- Resolves: #2168496 + +* Thu Jan 19 2023 Fedora Release Engineering - 2.12.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Jul 21 2022 Fedora Release Engineering - 2.12.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Fri Jul 8 2022 Marek Kasik - 2.12.1-2 +- Clear correct flags for doc ownership +- Resolves: #2104570 + +* Mon May 2 2022 Marek Kasik - 2.12.1-1 +- Update to 2.12.1 +- Resolves: #2080714 + +* Mon Apr 25 2022 Marek Kasik - 2.12.0-1 +- Update to 2.12.0 +- Resolves: #2070686 + +* Thu Jan 20 2022 Fedora Release Engineering - 2.11.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sat Dec 4 2021 Diego Herrera - 2.11.1-1 +- Update to 2.11.1 + +* Thu Jul 22 2021 Marek Kasik - 2.11.0-1 +- Update to 2.11.0 + +* Wed Jul 21 2021 Fedora Release Engineering - 2.10.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Feb 5 2021 Akira TAGOH - 2.10.4-3 +- Enable HarfBuzz support +- Add bootstrap without HarfBuzz +- Resolves: #1853937 +- Resolves: #1906714 + +* Tue Jan 26 2021 Fedora Release Engineering - 2.10.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Oct 23 2020 Marek Kasik - 2.10.4-1 +- Update to 2.10.4 - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c -- Resolves: #1891906 +- Enable man pages for demos +- Resolves: #1887084, #1890211 -* Fri Dec 7 2018 Marek Kasik - 2.9.1-4 -- Use pkgconf in freetype-config.in directly (RPMDiff) -- Related: #1651252 +* Mon Jul 27 2020 Fedora Release Engineering - 2.10.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild -* Fri Dec 7 2018 Marek Kasik - 2.9.1-3 -- Enable ClearType subpixel rendering -- Resolves: #1651252 +* Tue Jul 21 2020 Tom Stellard - 2.10.2-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro -* Thu Sep 6 2018 Marek Kasik - 2.9.1-2 -- Fix important issues found by covscan -- Resolves: #1602501 +* Wed Jul 15 2020 Marek Kasik - 2.10.2-1 +- Update to 2.10.2 +- Enable support for WOFF2 streams +- Resolves: #1725983 -* Wed Jun 27 2018 Marek Kasik - 2.9.1-1 +* Tue Jan 28 2020 Fedora Release Engineering - 2.10.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sat Oct 12 2019 Michael Kuhn - 2.10.1-1 +- Update to 2.10.1 +- Revert FT_DebugHook_Func ABI/API changes + +* Thu Jul 25 2019 Fedora Release Engineering - 2.10.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jun 11 09:42:57 CEST 2019 Igor Gnatenko - 2.10.0-2 +- Fix handling of undefined glyph [pcf] + +* Tue May 28 2019 Marek Kasik - 2.10.0-1 +- Update to 2.10.0 +- Keep FT_Outline_New_Internal() and FT_Outline_Done_Internal() +- for ABI compatibility but make them just throw +- Unimplemented_Feature error. +- Remove them once soname has been bumped! +- Resolves: #1689117 + +* Mon Apr 8 2019 Marek Kasik - 2.9.1-8 +- Remove freetype-2.9-ftsmooth.patch + +* Thu Jan 31 2019 Fedora Release Engineering - 2.9.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Oct 31 2018 Marek Kasik - 2.9.1-6 +- Obsolete freetype-freeworld +- Resolves: #1644700 + +* Wed Oct 31 2018 Neal Gompa - 2.9.1-5 +- Correctly enable subpixel rendering for ClearType functionality + +* Mon Oct 29 2018 Marek Kasik - 2.9.1-4 +- Enable ClearType code thanks to Microsoft joining OIN + +* Fri Oct 19 2018 Marek Kasik - 2.9.1-3 +- Use 'pkgconf' directly for multilib reasons +- Resolves: #1639379 + +* Fri Jul 13 2018 Fedora Release Engineering - 2.9.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri May 25 2018 Marek Kasik - 2.9.1-1 - Update to 2.9.1 -- Modify/remove/add patches as needed -- Resolves: #1595787 +- Modify/remove patches as needed +- Resolves: #1574125 + +* Tue Mar 20 2018 Marek Kasik - 2.9-1 +- Update to 2.9 +- Add/modify/remove patches as needed +- Resolves: #1492372 * Fri Feb 16 2018 Marek Kasik - 2.8-10 - Avoid NULL reference diff --git a/SOURCES/ftconfig.h b/ftconfig.h similarity index 100% rename from SOURCES/ftconfig.h rename to ftconfig.h diff --git a/sources b/sources new file mode 100644 index 0000000..ab35474 --- /dev/null +++ b/sources @@ -0,0 +1,3 @@ +SHA512 (freetype-2.13.2.tar.xz) = a5917edaa45cb9f75786f8a4f9d12fdf07529247e09dfdb6c0cf7feb08f7588bb24f7b5b11425fb47f8fd62fcb426e731c944658f6d5a59ce4458ad5b0a50194 +SHA512 (freetype-doc-2.13.2.tar.xz) = ca3438dcf6f995af556d8db3cb3cfdcabb81ab5a7dd88464ff757e3e418b3219b0011857cde8a338372e30d8375486ac8e50914da2ea948dc874f70010bce60c +SHA512 (ft2demos-2.13.2.tar.xz) = aa83ba4212ff7c4453b72f036136cb9b04cacf7d196388a3e4752613e000b3bb45a4dcf63d3d1d5b3d6ada10720304b532fb6e33ed6a5b399dcce45c27af9ade