From 91ac31e7dfb232cc55ab19dc330edd8234060c28 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Mon, 30 May 2022 13:13:54 +0200 Subject: [PATCH] Properly guard "face_index" Resolves: #2079262 --- ...ype-2.10.4-properly-guard-face_index.patch | 46 +++++++++++++++++++ freetype.spec | 10 +++- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 freetype-2.10.4-properly-guard-face_index.patch diff --git a/freetype-2.10.4-properly-guard-face_index.patch b/freetype-2.10.4-properly-guard-face_index.patch new file mode 100644 index 0000000..92ae817 --- /dev/null +++ b/freetype-2.10.4-properly-guard-face_index.patch @@ -0,0 +1,46 @@ +From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 06:40:17 +0100 +Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard + `face_index`. + +We must ensure that the cast to `FT_Int` doesn't change the sign. + +Fixes #1139. +--- + src/base/ftobjs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:30:45 +0100 +Subject: [PATCH 2/2] * src/base/ftobjs.c (ft_open_face_internal): Thinko. + +--- + src/base/ftobjs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 2c0f0e6c9..10952a6c6 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -2527,6 +2527,16 @@ + #endif + + ++ /* only use lower 31 bits together with sign bit */ ++ if ( face_index > 0 ) ++ face_index &= 0x7FFFFFFFL; ++ else ++ { ++ face_index = -face_index; ++ face_index &= 0x7FFFFFFFL; ++ face_index = -face_index; ++ } ++ + #ifdef FT_DEBUG_LEVEL_TRACE + FT_TRACE3(( "FT_Open_Face: " )); + if ( face_index < 0 ) +-- +2.35.1 + diff --git a/freetype.spec b/freetype.spec index 2c85176..cde8c81 100644 --- a/freetype.spec +++ b/freetype.spec @@ -4,7 +4,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.10.4 -Release: 7%{?dist} +Release: 8%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.xz @@ -35,6 +35,9 @@ Patch8: freetype-2.10.4-covscan.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2077989 Patch9: freetype-2.10.4-avoid-invalid-face-index.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2077991 +Patch10: freetype-2.10.4-properly-guard-face_index.patch + BuildRequires: gcc BuildRequires: libX11-devel BuildRequires: libpng-devel @@ -100,6 +103,7 @@ popd %patch7 -p1 -b .png-memory-leak %patch8 -p1 -b .covscan %patch9 -p1 -b .avoid-invalid-face-index +%patch10 -p1 -b .properly-guard-face_index %build @@ -241,6 +245,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Mon May 30 2022 Marek Kasik - 2.10.4-8 +- Properly guard "face_index" +- Resolves: #2079262 + * Thu May 26 2022 Marek Kasik - 2.10.4-7 - Avoid invalid face index - Resolves: #2079271