Backport upstream commit c2d222bb22c6 to fix a heap overflow
vulnerability (CVE-2026-44950) in fs_read_glyphs() in the font
server client code. A malicious font server could send
overlapping source offsets causing cumulative writes to exceed
the destination buffer allocation. The fix adds a cumulative
bounds check to reject such overflow before writing out of
bounds.
CVE: CVE-2026-44950
Upstream patches:
- https://cgit.freedesktop.org/xorg/lib/libXfont/patch/?id=c2d222bb22c623d8a40f3275077fc7e6617f2c8a
Resolves: RHEL-222027
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
