From 982ad7a615c88e2683aaedfd20f85e0d9b1b88f3 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Nov 03 2016 06:07:24 +0000 Subject: import fontconfig-2.10.95-10.el7 --- diff --git a/SOURCES/fontconfig-offset-in-elts.patch b/SOURCES/fontconfig-offset-in-elts.patch new file mode 100644 index 0000000..48f7c27 --- /dev/null +++ b/SOURCES/fontconfig-offset-in-elts.patch @@ -0,0 +1,35 @@ +diff --git a/src/fccache.c b/src/fccache.c +index 02ec301..6f3c68a 100644 +--- a/src/fccache.c ++++ b/src/fccache.c +@@ -640,6 +640,7 @@ FcCacheOffsetsValid (FcCache *cache) + FcPattern *font = FcFontSetFont (fs, i); + FcPatternElt *e; + FcValueListPtr l; ++ char *last_offset; + + if ((char *) font < base || + (char *) font > end - sizeof (FcFontSet) || +@@ -653,11 +654,17 @@ FcCacheOffsetsValid (FcCache *cache) + if (e->values != 0 && !FcIsEncodedOffset(e->values)) + return FcFalse; + +- for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l)) +- if (l->next != NULL && !FcIsEncodedOffset(l->next)) +- break; +- if (j < 0) +- return FcFalse; ++ for (j = 0; j < font->num; j++) ++ { ++ last_offset = (char *) font + font->elts_offset; ++ for (l = FcPatternEltValues(&e[j]); l; l = FcValueListNext(l)) ++ { ++ if ((char *) l < last_offset || (char *) l > end - sizeof (*l) || ++ (l->next != NULL && !FcIsEncodedOffset(l->next))) ++ return FcFalse; ++ last_offset = (char *) l + 1; ++ } ++ } + } + } + diff --git a/SOURCES/fontconfig-update-45-latin.patch b/SOURCES/fontconfig-update-45-latin.patch new file mode 100644 index 0000000..53b6613 --- /dev/null +++ b/SOURCES/fontconfig-update-45-latin.patch @@ -0,0 +1,293 @@ +diff --git a/conf.d/45-latin.conf b/conf.d/45-latin.conf +index aa62ed4..5228945 100644 +--- a/conf.d/45-latin.conf ++++ b/conf.d/45-latin.conf +@@ -14,23 +14,31 @@ + serif + + ++ Cambria ++ serif ++ ++ ++ Constantia ++ serif ++ ++ + DejaVu Serif + serif + + +- Liberation Serif ++ Elephant + serif + + +- Times New Roman ++ Garamond + serif + + +- Times ++ Georgia + serif + + +- Nimbus Roman No9 L ++ Liberation Serif + serif + + +@@ -38,42 +46,50 @@ + serif + + +- Thorndale AMT ++ MS Serif + serif + + +- Thorndale ++ Nimbus Roman No9 L + serif + + +- Georgia ++ Nimbus Roman + serif + + +- Garamond ++ Palatino Linotype + serif + + +- Palatino Linotype ++ Thorndale AMT + serif + + +- Trebuchet MS ++ Thorndale ++ serif ++ ++ ++ Times New Roman ++ serif ++ ++ ++ Times + serif + + + +- Bitstream Vera Sans ++ Albany AMT + sans-serif + + +- DejaVu Sans ++ Albany + sans-serif + + +- Liberation Sans ++ Arial Unicode MS + sans-serif + + +@@ -81,19 +97,47 @@ + sans-serif + + ++ Bitstream Vera Sans ++ sans-serif ++ ++ ++ Britannic ++ sans-serif ++ ++ ++ Calibri ++ sans-serif ++ ++ ++ Candara ++ sans-serif ++ ++ ++ Century Gothic ++ sans-serif ++ ++ ++ Corbel ++ sans-serif ++ ++ ++ DejaVu Sans ++ sans-serif ++ ++ + Helvetica + sans-serif + + +- Verdana ++ Haettenschweiler + sans-serif + + +- Albany AMT ++ Liberation Sans + sans-serif + + +- Albany ++ MS Sans Serif + sans-serif + + +@@ -101,88 +145,124 @@ + sans-serif + + ++ Nimbus Sans ++ sans-serif ++ ++ + Luxi Sans + sans-serif + ++ ++ Tahoma ++ sans-serif ++ ++ ++ Trebuchet MS ++ sans-serif ++ ++ ++ Twentieth Century ++ sans-serif ++ ++ ++ Verdana ++ sans-serif ++ + ++ ++ Andale Mono ++ monospace ++ + + Bitstream Vera Sans Mono + monospace + + +- DejaVu Sans Mono ++ Consolas + monospace + + +- Liberation Mono ++ Courier New + monospace + + +- Inconsolata ++ Courier + monospace + + +- Courier New ++ Cumberland AMT + monospace + + +- Courier ++ Cumberland + monospace + + +- Andale Mono ++ DejaVu Sans Mono + monospace + + +- Luxi Mono ++ Fixedsys + monospace + + +- Cumberland AMT ++ Inconsolata + monospace + + +- Cumberland ++ Liberation Mono ++ monospace ++ ++ ++ Luxi Mono + monospace + + + Nimbus Mono L + monospace + ++ ++ Nimbus Mono ++ monospace ++ ++ ++ Terminal ++ monospace ++ + +- +- Impact ++ ++ Bauhaus Std + fantasy + + +- Copperplate Gothic Std ++ Cooper Std + fantasy + + +- Cooper Std ++ Copperplate Gothic Std + fantasy + + +- Bauhaus Std ++ Impact + fantasy + + + +- ITC Zapf Chancery Std ++ Comic Sans MS + cursive + + +- Zapfino ++ ITC Zapf Chancery Std + cursive + + +- Comic Sans MS ++ Zapfino + cursive + + diff --git a/SOURCES/fontconfig-validate-offset-in-cache.patch b/SOURCES/fontconfig-validate-offset-in-cache.patch new file mode 100644 index 0000000..9009ffd --- /dev/null +++ b/SOURCES/fontconfig-validate-offset-in-cache.patch @@ -0,0 +1,112 @@ +diff -pruN fontconfig-2.10.95.orig/src/fccache.c fontconfig-2.10.95/src/fccache.c +--- fontconfig-2.10.95.orig/src/fccache.c 2013-08-26 11:49:32.000000000 +0900 ++++ fontconfig-2.10.95/src/fccache.c 2016-08-05 18:01:48.040872110 +0900 +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + #include + #if defined(HAVE_MMAP) || defined(__CYGWIN__) +@@ -547,6 +548,82 @@ FcCacheTimeValid (FcCache *cache, struct + return cache->checksum == (int) dir_stat->st_mtime; + } + ++static FcBool ++FcCacheOffsetsValid (FcCache *cache) ++{ ++ char *base = (char *)cache; ++ char *end = base + cache->size; ++ intptr_t *dirs; ++ FcFontSet *fs; ++ int i, j; ++ ++ if (cache->dir < 0 || cache->dir > cache->size - sizeof (intptr_t) || ++ memchr (base + cache->dir, '\0', cache->size - cache->dir) == NULL) ++ return FcFalse; ++ ++ if (cache->dirs < 0 || cache->dirs >= cache->size || ++ cache->dirs_count < 0 || ++ cache->dirs_count > (cache->size - cache->dirs) / sizeof (intptr_t)) ++ return FcFalse; ++ ++ dirs = FcCacheDirs (cache); ++ if (dirs) ++ { ++ for (i = 0; i < cache->dirs_count; i++) ++ { ++ FcChar8 *dir; ++ ++ if (dirs[i] < 0 || ++ dirs[i] > end - (char *) dirs - sizeof (intptr_t)) ++ return FcFalse; ++ ++ dir = FcOffsetToPtr (dirs, dirs[i], FcChar8); ++ if (memchr (dir, '\0', end - (char *) dir) == NULL) ++ return FcFalse; ++ } ++ } ++ ++ if (cache->set < 0 || cache->set > cache->size - sizeof (FcFontSet)) ++ return FcFalse; ++ ++ fs = FcCacheSet (cache); ++ if (fs) ++ { ++ if (fs->nfont > (end - (char *) fs) / sizeof (FcPattern)) ++ return FcFalse; ++ ++ if (fs->fonts != 0 && !FcIsEncodedOffset(fs->fonts)) ++ return FcFalse; ++ ++ for (i = 0; i < fs->nfont; i++) ++ { ++ FcPattern *font = FcFontSetFont (fs, i); ++ FcPatternElt *e; ++ FcValueListPtr l; ++ ++ if ((char *) font < base || ++ (char *) font > end - sizeof (FcFontSet) || ++ font->elts_offset < 0 || ++ font->elts_offset > end - (char *) font || ++ font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt)) ++ return FcFalse; ++ ++ ++ e = FcPatternElts(font); ++ if (e->values != 0 && !FcIsEncodedOffset(e->values)) ++ return FcFalse; ++ ++ for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l)) ++ if (l->next != NULL && !FcIsEncodedOffset(l->next)) ++ break; ++ if (j < 0) ++ return FcFalse; ++ } ++ } ++ ++ return FcTrue; ++} ++ + /* + * Map a cache file into memory + */ +@@ -556,7 +633,8 @@ FcDirCacheMapFd (int fd, struct stat *fd + FcCache *cache; + FcBool allocated = FcFalse; + +- if (fd_stat->st_size < (int) sizeof (FcCache)) ++ if (fd_stat->st_size > INTPTR_MAX || ++ fd_stat->st_size < (int) sizeof (FcCache)) + return NULL; + cache = FcCacheFindByStat (fd_stat); + if (cache) +@@ -612,6 +690,7 @@ FcDirCacheMapFd (int fd, struct stat *fd + if (cache->magic != FC_CACHE_MAGIC_MMAP || + cache->version < FC_CACHE_CONTENT_VERSION || + cache->size != (intptr_t) fd_stat->st_size || ++ !FcCacheOffsetsValid (cache) || + !FcCacheTimeValid (cache, dir_stat) || + !FcCacheInsert (cache, fd_stat)) + { diff --git a/SPECS/fontconfig.spec b/SPECS/fontconfig.spec index 878e553..de7aff2 100644 --- a/SPECS/fontconfig.spec +++ b/SPECS/fontconfig.spec @@ -3,7 +3,7 @@ Summary: Font configuration and customization library Name: fontconfig Version: 2.10.95 -Release: 7%{?dist} +Release: 10%{?dist} # src/ftglue.[ch] is in Public Domain # src/fccache.c contains Public Domain code # fc-case/CaseFolding.txt is in the UCD @@ -22,6 +22,9 @@ Patch2: fontconfig-fix-memleak.patch Patch3: fontconfig-copy-all-value.patch Patch4: fontconfig-fix-crash-on-fcfontsort.patch Patch5: fontconfig-fix-race-condition.patch +Patch6: fontconfig-update-45-latin.patch +Patch7: fontconfig-validate-offset-in-cache.patch +Patch8: fontconfig-offset-in-elts.patch BuildRequires: expat-devel BuildRequires: freetype-devel >= %{freetype_version} @@ -68,6 +71,9 @@ which is useful for developing applications that uses fontconfig. %patch3 -p1 -b .copy-all %patch4 -p1 -b .fix-crash %patch5 -p1 -b .fix-race +%patch6 -p1 -b .update-45-latin +%patch7 -p1 -b .validate-offset +%patch8 -p1 -b .offset-elts cp %{SOURCE2} doc/ %build @@ -145,6 +151,15 @@ fi %doc fontconfig-devel.txt fontconfig-devel %changelog +* Fri Sep 23 2016 Akira TAGOH - 2.10.95-10 +- Fix a regression in the previous change. (#1355930) + +* Fri Aug 5 2016 Akira TAGOH - 2.10.95-9 +- CVE-2016-5384: Validate offsets in cache files properly. (#1355930) + +* Fri Jun 10 2016 Akira TAGOH - 2.10.95-8 +- Update 45-latin.conf to add some hints to fall back for Windows fonts (#1073460) + * Fri Jan 24 2014 Daniel Mach - 2.10.95-7 - Mass rebuild 2014-01-24