Backport upstream commit 668fea81f40bcb48 to fix CVE-2026-59679.
The patch adds num_chars validation against the encoding array
size in fs_read_glyphs() to prevent out-of-bounds access from
a malicious font server reply, along with a regression test.
CVE: CVE-2026-59679
Upstream patches:
- 668fea81f4.patch
Resolves: RHEL-221952
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit c2d222bb22c6 to fix a heap overflow
vulnerability (CVE-2026-44950) in fs_read_glyphs() in the font
server client code. A malicious font server could send
overlapping source offsets causing cumulative writes to exceed
the destination buffer allocation. The fix adds a cumulative
bounds check to reject such overflow before writing out of
bounds.
CVE: CVE-2026-44950
Upstream patches:
- https://cgit.freedesktop.org/xorg/lib/libXfont/patch/?id=c2d222bb22c623d8a40f3275077fc7e6617f2c8a
Resolves: RHEL-222027
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
