Compare commits

...

No commits in common. "c8s" and "c9s" have entirely different histories.
c8s ... c9s

10 changed files with 288 additions and 66 deletions

33
.gitignore vendored
View File

@ -79,3 +79,36 @@
/harfbuzz-1.7.3.tar.bz2
/harfbuzz-1.7.4.tar.bz2
/harfbuzz-1.7.5.tar.bz2
/harfbuzz-1.7.6.tar.bz2
/harfbuzz-1.7.7.tar.bz2
/harfbuzz-1.8.0.tar.bz2
/harfbuzz-1.8.1.tar.bz2
/harfbuzz-1.8.2.tar.bz2
/harfbuzz-1.8.3.tar.bz2
/harfbuzz-1.8.4.tar.bz2
/harfbuzz-1.8.5.tar.bz2
/harfbuzz-1.8.7.tar.bz2
/harfbuzz-1.8.8.tar.bz2
/harfbuzz-2.0.0.tar.bz2
/harfbuzz-2.0.1.tar.bz2
/harfbuzz-2.0.2.tar.bz2
/harfbuzz-2.1.0.tar.bz2
/harfbuzz-2.1.1.tar.bz2
/harfbuzz-2.1.3.tar.bz2
/harfbuzz-2.3.1.tar.bz2
/harfbuzz-2.5.0.tar.xz
/harfbuzz-2.5.1.tar.xz
/harfbuzz-2.5.2.tar.xz
/harfbuzz-2.5.3.tar.xz
/harfbuzz-2.6.0.tar.xz
/harfbuzz-2.6.1.tar.xz
/harfbuzz-2.6.2.tar.xz
/harfbuzz-2.6.3.tar.xz
/harfbuzz-2.6.4.tar.xz
/harfbuzz-2.6.6.tar.xz
/harfbuzz-2.6.7.tar.xz
/harfbuzz-2.6.8.tar.xz
/harfbuzz-2.7.1.tar.xz
/harfbuzz-2.7.2.tar.xz
/harfbuzz-2.7.3.tar.xz
/harfbuzz-2.7.4.tar.xz

View File

@ -0,0 +1,30 @@
From 62e803b36173fd096d7ad460dd1d1db9be542593 Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Wed, 1 Jun 2022 07:38:21 -0600
Subject: [PATCH 001/363] [sbix] Limit glyph extents
Fixes https://github.com/harfbuzz/harfbuzz/issues/3557
---
src/hb-ot-color-sbix-table.hh | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh
index 9741ebd45..6efae43cd 100644
--- a/src/hb-ot-color-sbix-table.hh
+++ b/src/hb-ot-color-sbix-table.hh
@@ -298,6 +298,12 @@ struct sbix
const PNGHeader &png = *blob->as<PNGHeader>();
+ if ((png.IHDR.height >= 65536) | (png.IHDR.width >= 65536))
+ {
+ hb_blob_destroy (blob);
+ return false;
+ }
+
extents->x_bearing = x_offset;
extents->y_bearing = png.IHDR.height + y_offset;
extents->width = png.IHDR.width;
--
2.36.1

View File

@ -1,18 +1,18 @@
diff -urN harfbuzz-1.7.5.old/src/hb-ot-layout-gsubgpos-private.hh harfbuzz-1.7.5/src/hb-ot-layout-gsubgpos-private.hh
--- harfbuzz-1.7.5.old/src/hb-ot-layout-gsubgpos-private.hh 2018-01-27 07:43:07.000000000 +0530
+++ harfbuzz-1.7.5/src/hb-ot-layout-gsubgpos-private.hh 2023-09-25 12:18:00.277228938 +0530
@@ -368,7 +368,15 @@
inline bool prev (void)
diff -urN harfbuzz-2.7.4.old/src/hb-ot-layout-gsubgpos.hh harfbuzz-2.7.4/src/hb-ot-layout-gsubgpos.hh
--- harfbuzz-2.7.4.old/src/hb-ot-layout-gsubgpos.hh 2020-12-27 05:31:18.000000000 +0530
+++ harfbuzz-2.7.4/src/hb-ot-layout-gsubgpos.hh 2023-09-09 18:11:07.014324408 +0530
@@ -468,7 +468,15 @@
bool prev ()
{
assert (num_items > 0);
- while (idx >= num_items)
- while (idx > num_items - 1)
+ unsigned stop = num_items - 1;
+
+ /* When looking back, limit how far we search; this function is mostly
+ * used for looking back for base glyphs when attaching marks. If we
+ * don't limit, we can get O(n^2) behavior where n is the number of
+ * consecutive marks. */
+ stop = (unsigned) ((int) stop >= (int) idx - HB_MAX_CONTEXT_LENGTH ? stop : (int) idx - HB_MAX_CONTEXT_LENGTH);
+ stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);
+
+ while (idx > stop)
{

View File

@ -1,6 +1,6 @@
--- !Policy
product_versions:
- rhel-8
- rhel-9
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

View File

@ -1,22 +1,26 @@
Name: harfbuzz
Version: 1.7.5
Release: 4%{?dist}
Version: 2.7.4
Release: 10%{?dist}
Summary: Text shaping library
License: MIT
URL: http://freedesktop.org/wiki/Software/HarfBuzz
Source0: http://www.freedesktop.org/software/harfbuzz/release/harfbuzz-%{version}.tar.bz2
URL: https://harfbuzz.github.io/
Source0: https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz
# https://github.com/harfbuzz/harfbuzz/issues/4147#issuecomment-1707674277
# Upstream patch https://github.com/harfbuzz/harfbuzz/issues/3557
Patch0: CVE-2022-33068-sbix-Limit-glyph-extents.patch
# Upstream https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc#commitcomment-101335712
Patch1: CVE-2023-25193-Limit_how_far_we_skip_when_looking_back.patch
BuildRequires: cairo-devel
BuildRequires: freetype-devel
BuildRequires: glib2-devel
BuildRequires: gobject-introspection-devel
BuildRequires: libicu-devel
BuildRequires: graphite2-devel
BuildRequires: gtk-doc
BuildRequires: gcc-c++
BuildRequires: make
%description
HarfBuzz is an implementation of the OpenType Layout engine.
@ -43,50 +47,227 @@ This package contains Harfbuzz ICU support library.
# rpminspect complained about invalid unicode characters like 0x202B and 0x202C
rm -f test/shaping/texts/in-house/shaper-arabic/script-arabic/language-persian/mehran.txt
%build
%configure --disable-static --with-graphite2
# Remove lib64 rpath
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
make %{?_smp_mflags} V=1
%configure --disable-static --with-graphite2 --with-gobject --enable-introspection
%{make_build}
%install
make install DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
%{make_install}
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig
%ldconfig_scriptlets
%post icu -p /sbin/ldconfig
%postun icu -p /sbin/ldconfig
%ldconfig_scriptlets icu
%files
%license COPYING
%doc NEWS AUTHORS README
%{_libdir}/libharfbuzz.so.*
%{_libdir}/libharfbuzz.so.0*
%{_libdir}/libharfbuzz-gobject.so.0*
%{_libdir}/libharfbuzz-subset.so.0*
%dir %{_libdir}/girepository-1.0
%{_libdir}/girepository-1.0/HarfBuzz-0.0.typelib
%files devel
%doc %{_datadir}/gtk-doc
%{_bindir}/hb-view
%{_bindir}/hb-ot-shape-closure
%{_bindir}/hb-shape
%{_bindir}/hb-subset
%{_includedir}/harfbuzz/
%{_libdir}/libharfbuzz.so
%{_libdir}/pkgconfig/harfbuzz.pc
%{_libdir}/libharfbuzz-gobject.so
%{_libdir}/libharfbuzz-icu.so
%{_libdir}/libharfbuzz-subset.so
%{_libdir}/pkgconfig/harfbuzz.pc
%{_libdir}/pkgconfig/harfbuzz-gobject.pc
%{_libdir}/pkgconfig/harfbuzz-icu.pc
%{_libdir}/pkgconfig/harfbuzz-subset.pc
%{_libdir}/cmake/harfbuzz/
%dir %{_datadir}/gir-1.0
%{_datadir}/gir-1.0/HarfBuzz-0.0.gir
%files icu
%{_libdir}/libharfbuzz-icu.so.*
%changelog
* Mon Sep 25 2023 Parag Nemade <pnemade AT redhat DOT com> - 1.7.5-4
- Resolves:RHEL-8400 allows attackers to trigger O(n^2) growth via consecutive marks
* Mon Sep 18 2023 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-10
- Resolves:RHEL-2268 Fix CI tests results
* Sat Sep 09 2023 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-9
- Resolves:RHEL-2268 CVE-2023-25193
* Mon Jul 18 2022 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-8
- Resolves:rh#2103849
- Update tests.yaml
* Mon Jul 18 2022 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
- Resolves:rh#2103849 CVE-2022-33068
- Fix Covscan compiler warning for inclusion of parenthesis
- Update tests.yaml
* Fri Jul 15 2022 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
- Resolves:rh#2103849 CVE-2022-33068
harfbuzz: integer overflow in the component hb-ot-shape-fallback.c
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.7.4-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.7.4-4
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Fri Feb 5 2021 Marek Kasik <mkasik@redhat.com> - 2.7.4-3
- Build HarfBuzz with bootstrapped freetype
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Sun Dec 27 20:48:11 IST 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-1
- Update to 2.7.4 version (#1911046)
* Fri Dec 25 14:01:50 IST 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.7.3-1
- Update to 2.7.3 version (#1910482)
* Sat Aug 29 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.7.2-1
- Update to 2.7.2 version (#1873689)
* Thu Aug 20 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.7.1-1
- Update to 2.7.1 version (#1860607)
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jun 23 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.6.8-1
- Update to 2.6.8 version (#1849805)
* Thu Jun 04 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.6.7-1
- Update to 2.6.7 version (#1843592)
* Fri May 15 2020 Pete Walter <pwalter@fedoraproject.org> - 2.6.6-2
- Rebuild for ICU 67
* Tue May 12 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.6.6-1
- Update to 2.6.6 version (#1834887)
* Wed Mar 18 2020 Parag Nemade <pnemade AT redhat DOT com> - 2.6.4-4
- Use make_build and make_install macros
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Nov 01 2019 Pete Walter <pwalter@fedoraproject.org> - 2.6.4-2
- Rebuild for ICU 65
* Wed Oct 30 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.6.4-1
- Update to 2.6.4 version (#1766762)
* Tue Oct 29 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.6.3-1
- Update to 2.6.3 version (#1766396)
* Tue Oct 01 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.6.2-1
- Update to 2.6.2 version (#1757207)
* Wed Sep 18 2019 Kalev Lember <klember@redhat.com> - 2.6.1-2
- Build with --with-gobject --enable-introspection (#1737186)
- Tighten soname globs
* Fri Aug 23 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.6.1-1
- Update to 2.6.1 version (#1744835)
* Sat Aug 17 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.6.0-1
- Update to 2.6.0 version (#1742730)
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri Jul 12 2019 Adam Williamson <awilliam@redhat.com> - 2.5.3-2
- Revert the offending commit to avoid RHBZ #1689037
* Thu Jun 27 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.5.3-1
- Update to 2.5.3 version (#1724317)
* Fri Jun 21 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.5.2-1
- Update to 2.5.2 version (#1722623)
* Sat Jun 01 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.5.1-1
- Update to 2.5.1 version (#1716024)
* Sun May 26 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.5.0-1
- Update to 2.5.0 version (#1713797)
* Fri Apr 12 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.4.0-1
- Update to 2.4.0 version (#1693940)
* Thu Jan 31 2019 Parag Nemade <pnemade AT redhat DOT com> - 2.3.1-1
- Update to 2.3.1 version (#1671165)
* Wed Jan 23 2019 Pete Walter <pwalter@fedoraproject.org> - 2.1.3-2
- Rebuild for ICU 63
* Fri Nov 23 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.1.3-1
- Update to 2.1.3 version
* Thu Nov 08 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.1.1-1
- Update to 2.1.1 version
* Sun Nov 04 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.1.0-1
- Update to 2.1.0 version
* Thu Nov 01 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.0.2-1
- Update to 2.0.2 version
* Sun Oct 28 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.0.1-1
- Update to 2.0.1 version
* Sat Oct 27 2018 Parag Nemade <pnemade AT redhat DOT com> - 2.0.0-1
- Update to 2.0.0 version
* Fri Sep 07 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.8-1
- Update to 1.8.8 version
* Thu Aug 09 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.7-1
- Update to 1.8.7 version (#1613591)
* Thu Aug 02 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.5-1
- Update to 1.8.5 version (#1611028)
* Wed Jul 18 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.4-1
- Update to 1.8.4 version (#1601890)
* Fri Jul 13 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.3-1
- Update to 1.8.3 version (#1600306)
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jul 10 2018 Pete Walter <pwalter@fedoraproject.org> - 1.8.2-2
- Rebuild for ICU 62
* Tue Jul 03 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.2-1
- Update to 1.8.2 version (#1597679)
* Thu Jun 14 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.1-1
- Update to 1.8.1 version (#1590575)
* Wed Jun 06 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.8.0-1
- Update to 1.8.0 version (#1587987)
* Wed Jun 06 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.7.7-1
- Update to 1.7.7 version (#1552962)
* Mon Apr 30 2018 Pete Walter <pwalter@fedoraproject.org> - 1.7.6-2
- Rebuild for ICU 61.1
* Thu Mar 08 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.7.6-1
- Update to 1.7.6 version (#1552962)
- Added new lib libharfbuzz-subset by upstream
- Added harfbuzz cmake file
- Added hb-subset binary file
* Mon Feb 19 2018 Parag Nemade <pnemade AT redhat DOT com> - 1.7.5-3
- Add BuildRequires: gcc-c++ as per packaging guidelines

View File

@ -1 +1 @@
SHA512 (harfbuzz-1.7.5.tar.bz2) = c2c13fc97bb74f0f13092b07804f7087e948bce49793f48b62c2c24a5792523acc0002840bebf21829172bb2e7c3df9f9625250aec6c786a55489667dd04d6a0
SHA512 (harfbuzz-2.7.4.tar.xz) = d2af6a768c397c664f654cf36140e7b5696b3b983f637454604570c348247f7ffea135048d9b02cf6593cbde728567e31bf82a39df5ff38d680c78dff24d4cf0

View File

@ -1,28 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFz3zvsBEADJOIIWllGudxnpvJnkxQz2CtoWI7godVnoclrdl83kVjqSQp+2
dgxuG5mUiADUfYHaRQzxKw8efuQnwxzU9kZ70ngCxtmbQWGmUmfSThiapOz00018
+eo5MFabd2vdiGo1y+51m2sRDpN8qdCaqXko65cyMuLXrojJHIuvRA/x7iqOrRfy
a8x3OxC4PEgl5pgDnP8pVK0lLYncDEQCN76D9ubhZQWhISF/zJI+e806V71hzfyL
/Mt3mQm/li+lRKU25Usk9dWaf4NH/wZHMIPAkVJ4uD4H/uS49wqWnyiTYGT7hUbi
ecF7crhLCmlRzvJR8mkRP6/4T/F3tNDPWZeDNEDVFUkTFHNU6/h2+O398MNY/fOh
yKaNK3nnE0g6QJ1dOH31lXHARlpFOtWt3VmZU0JnWLeYdvap4Eff9qTWZJhI7Cq0
Wm8DgLUpXgNlkmquvE7P2W5EAr2E5AqKQoDbfw/GiWdRvHWKeNGMRLnGI3QuoX3U
pAlXD7v13VdZxNydvpeypbf/AfRyrHRKhkUj3cU1pYkM3DNZE77C5JUe6/0nxbt4
ETUZBTgLgYJGP8c7PbkVnO6I/KgL1jw+7MW6Az8Ox+RXZLyGMVmbW/TMc8haJfKL
MoUo3TVk8nPiUhoOC0/kI7j9ilFrBxBU5dUtF4ITAWc8xnG6jJs/IsvRpQARAQAB
tChGZWRvcmEgRVBFTCAoOCkgPGVwZWxAZmVkb3JhcHJvamVjdC5vcmc+iQI4BBMB
AgAiBQJc9877AhsPBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAh6kWrL4bW
oWagD/4xnLWws34GByVDQkjprk0fX7Iyhpm/U7BsIHKspHLL+Y46vAAGY/9vMvdE
0fcr9Ek2Zp7zE1RWmSCzzzUgTG6BFoTG1H4Fho/7Z8BXK/jybowXSZfqXnTOfhSF
alwDdwlSJvfYNV9MbyvbxN8qZRU1z7PEWZrIzFDDToFRk0R71zHpnPTNIJ5/YXTw
NqU9OxII8hMQj4ufF11040AJQZ7br3rzerlyBOB+Jd1zSPVrAPpeMyJppWFHSDAI
WK6x+am13VIInXtqB/Cz4GBHLFK5d2/IYspVw47Solj8jiFEtnAq6+1Aq5WH3iB4
bE2e6z00DSF93frwOyWN7WmPIoc2QsNRJhgfJC+isGQAwwq8xAbHEBeuyMG8GZjz
xohg0H4bOSEujVLTjH1xbAG4DnhWO/1VXLX+LXELycO8ZQTcjj/4AQKuo4wvMPrv
9A169oETG+VwQlNd74VBPGCvhnzwGXNbTK/KH1+WRH0YSb+41flB3NKhMSU6dGI0
SGtIxDSHhVVNmx2/6XiT9U/znrZsG5Kw8nIbbFz+9MGUUWgJMsd1Zl9R8gz7V9fp
n7L7y5LhJ8HOCMsY/Z7/7HUs+t/A1MI4g7Q5g5UuSZdgi0zxukiWuCkLeAiAP4y7
zKK4OjJ644NDcWCHa36znwVmkz3ixL8Q0auR15Oqq2BjR/fyog==
=84m8
-----END PGP PUBLIC KEY BLOCK-----

View File

@ -1,6 +0,0 @@
[epel]
name=Extra Packages for Enterprise Linux $releasever - $basearch
baseurl=https://dl.fedoraproject.org/pub/epel/$releasever/Everything/$basearch/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8

View File

@ -1,4 +1,5 @@
#!/bin/bash
set -e
cd ../source
echo "---Start autogen.sh---"
@ -6,4 +7,15 @@ NOCONFIGURE=1 ./autogen.sh
echo "---End autogen.sh---"
echo "--------------------"
find . -type f -exec sed -i 's/env python/python3/g' {} \; && ./configure --disable-static --with-graphite2 && echo "--------------------"; echo "---Start make check---"; make check; echo "---End make check---"
./configure --disable-static --with-graphite2 --with-gobject --enable-introspection
echo "--------------------"
echo "---Start make check---"
make check
retval=$?
echo $retval
if [ $retval -ne 0 ]; then
echo "make check failed"
else
echo "make check completed sucessfully"
fi
echo "---End make check---"

View File

@ -4,7 +4,7 @@
- classic
roles:
- role: standard-test-source
- hosts: localhost
tags:
- classic