Compare commits

...

No commits in common. "c8" and "c8-beta" have entirely different histories.
c8 ... c8-beta

2 changed files with 1 additions and 38 deletions

View File

@ -1,27 +0,0 @@
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 39d9c3f..d36cbe9 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -1840,7 +1840,7 @@
short i, limit;
FT_SubGlyph subglyph;
- FT_Outline outline;
+ FT_Outline outline = { 0, 0, NULL, NULL, NULL, 0 };
FT_Vector* points = NULL;
char* tags = NULL;
short* contours = NULL;
@@ -1848,6 +1848,13 @@
limit = (short)gloader->current.num_subglyphs;
+ /* make sure this isn't negative as we're going to add 4 later */
+ if ( limit < 0 )
+ {
+ error = FT_THROW( Invalid_Argument );
+ goto Exit;
+ }
+
/* construct an outline structure for */
/* communication with `TT_Vary_Apply_Glyph_Deltas' */
outline.n_points = (short)( gloader->current.num_subglyphs + 4 );

View File

@ -3,7 +3,7 @@
Summary: A free and portable font rendering engine
Name: freetype
Version: 2.9.1
Release: 10%{?dist}
Release: 9%{?dist}
License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement
Group: System Environment/Libraries
URL: http://www.freetype.org
@ -42,11 +42,6 @@ Patch11: freetype-2.9.1-properly-guard-face-index.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2077985
Patch12: freetype-2.9.1-guard-face-size.patch
# CVE-2025-27363
# https://access.redhat.com/security/cve/cve-2025-27363
# Patch by Marc Deslauriers of Canonical
Patch13: freetype-2.9.1-cve-2025-27363.patch
BuildRequires: libX11-devel
BuildRequires: libpng-devel
BuildRequires: zlib-devel
@ -111,7 +106,6 @@ popd
%patch10 -p1 -b .windres
%patch11 -p1 -b .properly-guard-face-index
%patch12 -p1 -b .guard-face-size
%patch13 -p1 -b .cve-2025-27363
%build
@ -224,10 +218,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la}
%{_mandir}/man1/*
%changelog
* Fri Mar 14 2025 Jonathan Wright <jonathan@almalinux.org> - 2.9.1-10
- Fix CVE-2025-27363 Out-of-bounds Write
- Resolves: RHEL-83094
* Fri May 27 2022 Marek Kasik <mkasik@redhat.com> - 2.9.1-9
- Guard face->size
- Resolves: #2079279