Backport upstream commit 668fea81 to fix CVE-2026-59679, an
out-of-bounds read/write vulnerability in fs_read_glyphs().
The fix validates that num_chars from the FS_QueryXBitmaps16
reply does not exceed the encoding array size allocated during
FS_QueryXExtents16 handling, preventing exploitation by a
malicious font server. A regression test is included.
CVE: CVE-2026-59679
Upstream patches:
- 668fea81f4.patch
Resolves: RHEL-221956
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
