rpms/libXfont2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

base: rpms:c10
Branches Tags
rpms:c8s
rpms:c9
rpms:c10
rpms:c9s
rpms:c8
rpms:c10s
rpms:c9-beta
rpms:c8-beta
rpms:imports/c9/libXfont2-2.0.3-12.el9_8.3
rpms:imports/c10/libXfont2-2.0.6-5.el10_2.3
rpms:imports/c8/libXfont2-2.0.3-2.el8_10.3
rpms:imports/c9/libXfont2-2.0.3-12.el9_8.1
rpms:imports/c10/libXfont2-2.0.6-5.el10_2.1
rpms:imports/c8/libXfont2-2.0.3-2.el8_10.1
rpms:imports/c10s/libXfont2-2.0.6-6.el10
rpms:imports/c10s/libXfont2-2.0.6-5.el10
rpms:imports/c10s/libXfont2-2.0.6-4.el10
rpms:imports/c9/libXfont2-2.0.3-12.el9
rpms:imports/c9-beta/libXfont2-2.0.3-12.el9
rpms:imports/c8-beta/libXfont2-2.0.3-2.el8
rpms:imports/c8/libXfont2-2.0.3-2.el8
rpms:imports/c8s/libXfont2-2.0.3-2.el8
..
compare: rpms:c8s
Branches Tags
rpms:c9
rpms:c10
rpms:c9s
rpms:c8
rpms:c8s
rpms:c10s
rpms:c9-beta
rpms:c8-beta
rpms:imports/c9/libXfont2-2.0.3-12.el9_8.3
rpms:imports/c10/libXfont2-2.0.6-5.el10_2.3
rpms:imports/c8/libXfont2-2.0.3-2.el8_10.3
rpms:imports/c9/libXfont2-2.0.3-12.el9_8.1
rpms:imports/c10/libXfont2-2.0.6-5.el10_2.1
rpms:imports/c8/libXfont2-2.0.3-2.el8_10.1
rpms:imports/c10s/libXfont2-2.0.6-6.el10
rpms:imports/c10s/libXfont2-2.0.6-5.el10
rpms:imports/c10s/libXfont2-2.0.6-4.el10
rpms:imports/c9/libXfont2-2.0.3-12.el9
rpms:imports/c9-beta/libXfont2-2.0.3-12.el9
rpms:imports/c8-beta/libXfont2-2.0.3-2.el8
rpms:imports/c8/libXfont2-2.0.3-2.el8
rpms:imports/c8s/libXfont2-2.0.3-2.el8

2 Commits
c10 ... c8s

Author SHA1 Message Date
RHEL Packaging Agent
651c992437 Fix CVE-2026-59679: validate num_chars in fs_read_glyphs 
Backport upstream commit 668fea81 to fix CVE-2026-59679, an
out-of-bounds read/write vulnerability in fs_read_glyphs().
The fix validates that num_chars from the FS_QueryXBitmaps16
reply does not exceed the encoding array size allocated during
FS_QueryXExtents16 handling, preventing exploitation by a
malicious font server. A regression test is included.

CVE: CVE-2026-59679
Upstream patches:
 - 668fea81f4.patch
Resolves: RHEL-221956

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
 2026-08-06 10:55:27 +00:00
RHEL Packaging Agent
7505ca59ac Fix CVE-2026-44950: heap buffer overflow in fs_read_glyphs() 
Backport upstream fix for CVE-2026-44950 to libXfont2 2.0.3.
The fix adds a bounds-check for cumulative glyph data writes
in fs_read_glyphs() to prevent heap overflow from overlapping
source offsets sent by a malicious font server. A new regression
test (test-fserve-read-glyphs.c) is included to verify the fix.

CVE: CVE-2026-44950
Upstream patches:
 - c2d222bb22.patch
Resolves: RHEL-222015

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
 2026-08-06 10:48:36 +00:00
6 changed files with 52 additions and 98 deletions
Show Stats Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1 +1,2 @@
libXfont2-2.0.6.tar.xz SOURCES/libXfont2-2.0.3.tar.bz2
/libXfont2-2.0.3.tar.bz2

28
libXfont2-2.0.6-CVE-2026-59679.patch → 0004-fserve-validate-num_chars-against-encoding-array-siz.patch
View File

@ -1,4 +1,4 @@
From aa98f78ea17762d0bb0900715f07bb4e144dc432 Mon Sep 17 00:00:00 2001 From 76a453c43a7fb74f1e6258d452b3d3df51b97af4 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net> From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 13 Jul 2026 15:48:06 +1000 Date: Mon, 13 Jul 2026 15:48:06 +1000
Subject: [PATCH] fserve: validate num_chars against encoding array size in Subject: [PATCH] fserve: validate num_chars against encoding array size in
@ -21,18 +21,18 @@ Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
--- ---
Makefile.am | 15 +++++++++++++++ Makefile.am | 16 ++++++++++++++++
src/fc/fserve.c | 22 ++++++++++++++++++++++ src/fc/fserve.c | 22 ++++++++++++++++++++++
src/fc/fservestr.h | 1 + src/fc/fservestr.h | 1 +
3 files changed, 38 insertions(+) 3 files changed, 39 insertions(+)
diff --git a/Makefile.am b/Makefile.am diff --git a/Makefile.am b/Makefile.am
index 62ac7e2..34a6abf 100644 index c1a3db2..ef9bc40 100644
--- a/Makefile.am --- a/Makefile.am
+++ b/Makefile.am +++ b/Makefile.am
@@ -168,6 +168,21 @@ noinst_PROGRAMS = lsfontdir @@ -157,6 +157,22 @@ endif
lsfontdir_SOURCES = test/utils/lsfontdir.c $(TEST_UTIL_SRCS)
lsfontdir_LDADD = libXfont2.la $(LTLIBOBJS) EXTRA_DIST = src/builtins/buildfont
+# Security regression tests +# Security regression tests
+TESTS = +TESTS =
@ -44,16 +44,17 @@ index 62ac7e2..34a6abf 100644
+ +
+# The test #includes fserve.c directly to access static functions so +# The test #includes fserve.c directly to access static functions so
+# we statically link against libXfont2.a. +# we statically link against libXfont2.a.
+test_fserve_read_glyphs_SOURCES = test/test-fserve-read-glyphs.c $(TEST_UTIL_SRCS) +test_fserve_read_glyphs_SOURCES = test/test-fserve-read-glyphs.c
+test_fserve_read_glyphs_CFLAGS = $(AM_CFLAGS) -I$(top_srcdir)/include -I$(top_srcdir)/src/fc +test_fserve_read_glyphs_CFLAGS = $(AM_CFLAGS) -I$(top_srcdir)/include -I$(top_srcdir)/src/fc
+test_fserve_read_glyphs_LDFLAGS = -static +test_fserve_read_glyphs_LDFLAGS = -static
+test_fserve_read_glyphs_LDADD = libXfont2.la $(LTLIBOBJS) +test_fserve_read_glyphs_LDADD = libXfont2.la $(LTLIBOBJS)
+endif XFONT_FC +endif XFONT_FC
+
MAINTAINERCLEANFILES = ChangeLog INSTALL MAINTAINERCLEANFILES = ChangeLog INSTALL
.PHONY: ChangeLog INSTALL
diff --git a/src/fc/fserve.c b/src/fc/fserve.c diff --git a/src/fc/fserve.c b/src/fc/fserve.c
index c676234..027f71d 100644 index 708fc35..4141c3c 100644
--- a/src/fc/fserve.c --- a/src/fc/fserve.c
+++ b/src/fc/fserve.c +++ b/src/fc/fserve.c
@@ -1097,6 +1097,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -1097,6 +1097,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
@ -64,7 +65,7 @@ index c676234..027f71d 100644
if (haveInk) if (haveInk)
fsfont->inkMetrics = pCI + numExtents; fsfont->inkMetrics = pCI + numExtents;
else else
@@ -2003,6 +2004,17 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -2004,6 +2005,17 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
{ {
minchar = 0; minchar = 0;
maxchar = rep->num_chars; maxchar = rep->num_chars;
@ -82,7 +83,7 @@ index c676234..027f71d 100644
} }
off_adr = (char *)ppbits; off_adr = (char *)ppbits;
@@ -2024,6 +2036,16 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -2025,6 +2037,16 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
for (i = 0; i < rep->num_chars; i++) for (i = 0; i < rep->num_chars; i++)
{ {
memcpy(&local_off, off_adr, SIZEOF(fsOffset32)); /* align it */ memcpy(&local_off, off_adr, SIZEOF(fsOffset32)); /* align it */
@ -111,3 +112,6 @@ index 29ae46e..da95e41 100644
CharInfoPtr inkMetrics; CharInfoPtr inkMetrics;
FSGlyphPtr glyphs; FSGlyphPtr glyphs;
} FSFontRec, *FSFontPtr; } FSFontRec, *FSFontPtr;
--
2.39.5

6
gating.yaml Normal file
View File

@ -0,0 +1,6 @@
--- !Policy
product_versions:
- rhel-8
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

12
0004-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch → libXfont2-2.0.3-CVE-2026-44950.patch
View File

@ -1,4 +1,4 @@
From 3fa8bcc79c168c12430802ded944131ebe7de8c6 Mon Sep 17 00:00:00 2001 From fa38750d94ec161fc57d3f53d44a00bb1dfc3d89 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net> From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 13 Jul 2026 15:50:09 +1000 Date: Mon, 13 Jul 2026 15:50:09 +1000
Subject: [PATCH] fserve: bounds-check cumulative glyph data writes in Subject: [PATCH] fserve: bounds-check cumulative glyph data writes in
@ -36,10 +36,10 @@ Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
create mode 100644 test/test-fserve-read-glyphs.c create mode 100644 test/test-fserve-read-glyphs.c
diff --git a/src/fc/fserve.c b/src/fc/fserve.c diff --git a/src/fc/fserve.c b/src/fc/fserve.c
index c676234..97436cd 100644 index 708fc35..f17cffa 100644
--- a/src/fc/fserve.c --- a/src/fc/fserve.c
+++ b/src/fc/fserve.c +++ b/src/fc/fserve.c
@@ -1922,10 +1922,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -1923,10 +1923,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
fsOffset32 local_off; fsOffset32 local_off;
char *off_adr; char *off_adr;
pointer pbitmaps; pointer pbitmaps;
@ -51,7 +51,7 @@ index c676234..97436cd 100644
int i, int i,
err; err;
int nranges = 0; int nranges = 0;
@@ -2015,8 +2012,8 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -2016,8 +2013,8 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
goto bail; goto bail;
} }
@ -61,7 +61,7 @@ index c676234..97436cd 100644
fprintf (stderr, "Reading %d glyphs in %d bytes for %s\n", fprintf (stderr, "Reading %d glyphs in %d bytes for %s\n",
(int) rep->num_chars, (int) rep->nbytes, fsd->name); (int) rep->num_chars, (int) rep->nbytes, fsd->name);
#endif #endif
@@ -2037,6 +2034,18 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -2038,6 +2035,18 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
(local_off.position < rep->nbytes) && (local_off.position < rep->nbytes) &&
(local_off.length <= (rep->nbytes - local_off.position))) (local_off.length <= (rep->nbytes - local_off.position)))
{ {
@ -80,7 +80,7 @@ index c676234..97436cd 100644
bits = allbits; bits = allbits;
allbits += local_off.length; allbits += local_off.length;
memcpy(bits, (char *)pbitmaps + local_off.position, memcpy(bits, (char *)pbitmaps + local_off.position,
@@ -2064,10 +2073,6 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) @@ -2065,10 +2074,6 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
} }
off_adr += SIZEOF(fsOffset32); off_adr += SIZEOF(fsOffset32);
} }

99
libXfont2.spec
View File

@ -1,13 +1,13 @@
Summary: X.Org X11 libXfont2 runtime library Summary: X.Org X11 libXfont2 runtime library
Name: libXfont2 Name: libXfont2
Version: 2.0.6 Version: 2.0.3
Release: 5%{?dist}.3 Release: 2%{?dist}.3
License: BSD-2-Clause AND BSD-4-Clause-UC AND HPND-sell-variant AND MIT-open-group AND SMLNJ AND X11 License: MIT
Group: System Environment/Libraries
URL: http://www.x.org URL: http://www.x.org
Source0: http://www.x.org/pub/individual/lib/%{name}-%{version}.tar.xz Source0: http://www.x.org/pub/individual/lib/%{name}-%{version}.tar.bz2
BuildRequires: make
BuildRequires: autoconf automake libtool BuildRequires: autoconf automake libtool
BuildRequires: pkgconfig(fontsproto) BuildRequires: pkgconfig(fontsproto)
BuildRequires: xorg-x11-util-macros BuildRequires: xorg-x11-util-macros
@ -15,20 +15,21 @@ BuildRequires: xorg-x11-xtrans-devel >= 1.0.3-3
BuildRequires: libfontenc-devel BuildRequires: libfontenc-devel
BuildRequires: freetype-devel BuildRequires: freetype-devel
Patch: 0001-bitscale-fix-integer-overflow-in-BitmapScaleBitmaps-.patch Patch1: 0001-bitscale-fix-integer-overflow-in-BitmapScaleBitmaps-.patch
Patch: 0002-pcfread-validate-bitmap-sizes-and-offsets-against-pe.patch Patch2: 0002-pcfread-validate-bitmap-sizes-and-offsets-against-pe.patch
Patch: 0003-bitscale-add-bounds-check-to-computeProps-for-proper.patch Patch3: 0003-bitscale-add-bounds-check-to-computeProps-for-proper.patch
# https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/c2d222bb22c623d8a40f3275077fc7e6617f2c8a # https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/c2d222bb22c623d8a40f3275077fc7e6617f2c8a
Patch: 0004-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch Patch4: libXfont2-2.0.3-CVE-2026-44950.patch
# https://redhat.atlassian.net/browse/RHEL-221949
# https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290 # https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290
Patch: libXfont2-2.0.6-CVE-2026-59679.patch Patch5: 0004-fserve-validate-num_chars-against-encoding-array-siz.patch
%description %description
X.Org X11 libXfont2 runtime library X.Org X11 libXfont2 runtime library
%package devel %package devel
Summary: X.Org X11 libXfont2 development package Summary: X.Org X11 libXfont2 development package
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release} Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: libfontenc-devel%{?_isa} Requires: libfontenc-devel%{?_isa}
@ -55,7 +56,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%files %files
%license COPYING %license COPYING
%doc AUTHORS README.md ChangeLog %doc AUTHORS README ChangeLog
%{_libdir}/libXfont2.so.2* %{_libdir}/libXfont2.so.2*
%files devel %files devel
@ -64,77 +65,19 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%{_libdir}/pkgconfig/xfont2.pc %{_libdir}/pkgconfig/xfont2.pc
%changelog %changelog
* Thu Aug 06 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.0.6-5.3 * Thu Aug 06 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.0.3-2.3
- CVE fix for: CVE-2026-59679 - CVE fix for: CVE-2026-59679
Resolves: https://redhat.atlassian.net/browse/RHEL-221949 Resolves: https://redhat.atlassian.net/browse/RHEL-221956
* Thu Aug 06 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.0.6-5.2 * Thu Aug 06 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.0.3-2.2
- CVE fix for: CVE-2026-44950 - CVE fix for: CVE-2026-44950
Resolves: https://redhat.atlassian.net/browse/RHEL-222024 Resolves: https://redhat.atlassian.net/browse/RHEL-222015
* Wed Jul 08 2026 Olivier Fourdan <ofourdan@redhat.com> - 2.0.6-5.1 * Wed Jul 08 2026 Olivier Fourdan <ofourdan@redhat.com> - 2.0.3-2.1
- CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003
Resolves: https://redhat.atlassian.net/browse/RHEL-191882 Resolves: https://redhat.atlassian.net/browse/RHEL-191877
Resolves: https://redhat.atlassian.net/browse/RHEL-191930 Resolves: https://redhat.atlassian.net/browse/RHEL-191928
Resolves: https://redhat.atlassian.net/browse/RHEL-191949 Resolves: https://redhat.atlassian.net/browse/RHEL-191948
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.0.6-5
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2.0.6-4
- Bump release for June 2024 mass rebuild
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Thu Oct 05 2023 José Expósito <jexposit@redhat.com> - 2.0.6-1
- libXfont2 2.0.6
* Thu Sep 07 2023 José Expósito <jexposit@redhat.com> - 2.0.3-16
- SPDX Migration
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Thu Nov 5 11:25:30 AEST 2020 Peter Hutterer <peter.hutterer@redhat.com> - 2.0.3-9
- Add BuildRequires for make
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Mar 21 2019 Adam Jackson <ajax@redhat.com> - 2.0.3-5
- Rebuild for xtrans 1.4.0
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Jun 29 2018 Adam Jackson <ajax@redhat.com> - 2.0.3-2 * Fri Jun 29 2018 Adam Jackson <ajax@redhat.com> - 2.0.3-2
- Use ldconfig scriptlet macros - Use ldconfig scriptlet macros

2
sources
View File

@ -1 +1 @@
SHA512 (libXfont2-2.0.6.tar.xz) = 24d6baeef8dc2ca2730925c6b790a97f4a3f46ea7b4d908555e7df29cee6e27b63d638b50c88dd30c853cecff7d9b079402cb617f4498f96410c5770b8815cbd SHA512 (libXfont2-2.0.3.tar.bz2) = 648b664e2aa58cbc7366a1b05873aa06bd4a38060f64085783043388244af8ceced77b29a22c3ac8b6d34cd226e093bbbcc785ea1748ea65720fe7ea05b4b44b