diff --git a/SOURCES/fontconfig-offset-in-elts.patch b/SOURCES/fontconfig-offset-in-elts.patch
new file mode 100644
index 0000000..48f7c27
--- /dev/null
+++ b/SOURCES/fontconfig-offset-in-elts.patch
@@ -0,0 +1,35 @@
+diff --git a/src/fccache.c b/src/fccache.c
+index 02ec301..6f3c68a 100644
+--- a/src/fccache.c
++++ b/src/fccache.c
+@@ -640,6 +640,7 @@ FcCacheOffsetsValid (FcCache *cache)
+ FcPattern *font = FcFontSetFont (fs, i);
+ FcPatternElt *e;
+ FcValueListPtr l;
++ char *last_offset;
+
+ if ((char *) font < base ||
+ (char *) font > end - sizeof (FcFontSet) ||
+@@ -653,11 +654,17 @@ FcCacheOffsetsValid (FcCache *cache)
+ if (e->values != 0 && !FcIsEncodedOffset(e->values))
+ return FcFalse;
+
+- for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l))
+- if (l->next != NULL && !FcIsEncodedOffset(l->next))
+- break;
+- if (j < 0)
+- return FcFalse;
++ for (j = 0; j < font->num; j++)
++ {
++ last_offset = (char *) font + font->elts_offset;
++ for (l = FcPatternEltValues(&e[j]); l; l = FcValueListNext(l))
++ {
++ if ((char *) l < last_offset || (char *) l > end - sizeof (*l) ||
++ (l->next != NULL && !FcIsEncodedOffset(l->next)))
++ return FcFalse;
++ last_offset = (char *) l + 1;
++ }
++ }
+ }
+ }
+
diff --git a/SOURCES/fontconfig-update-45-latin.patch b/SOURCES/fontconfig-update-45-latin.patch
new file mode 100644
index 0000000..53b6613
--- /dev/null
+++ b/SOURCES/fontconfig-update-45-latin.patch
@@ -0,0 +1,293 @@
+diff --git a/conf.d/45-latin.conf b/conf.d/45-latin.conf
+index aa62ed4..5228945 100644
+--- a/conf.d/45-latin.conf
++++ b/conf.d/45-latin.conf
+@@ -14,23 +14,31 @@
+ serif
+
+
++ Cambria
++ serif
++
++
++ Constantia
++ serif
++
++
+ DejaVu Serif
+ serif
+
+
+- Liberation Serif
++ Elephant
+ serif
+
+
+- Times New Roman
++ Garamond
+ serif
+
+
+- Times
++ Georgia
+ serif
+
+
+- Nimbus Roman No9 L
++ Liberation Serif
+ serif
+
+
+@@ -38,42 +46,50 @@
+ serif
+
+
+- Thorndale AMT
++ MS Serif
+ serif
+
+
+- Thorndale
++ Nimbus Roman No9 L
+ serif
+
+
+- Georgia
++ Nimbus Roman
+ serif
+
+
+- Garamond
++ Palatino Linotype
+ serif
+
+
+- Palatino Linotype
++ Thorndale AMT
+ serif
+
+
+- Trebuchet MS
++ Thorndale
++ serif
++
++
++ Times New Roman
++ serif
++
++
++ Times
+ serif
+
+
+
+- Bitstream Vera Sans
++ Albany AMT
+ sans-serif
+
+
+- DejaVu Sans
++ Albany
+ sans-serif
+
+
+- Liberation Sans
++ Arial Unicode MS
+ sans-serif
+
+
+@@ -81,19 +97,47 @@
+ sans-serif
+
+
++ Bitstream Vera Sans
++ sans-serif
++
++
++ Britannic
++ sans-serif
++
++
++ Calibri
++ sans-serif
++
++
++ Candara
++ sans-serif
++
++
++ Century Gothic
++ sans-serif
++
++
++ Corbel
++ sans-serif
++
++
++ DejaVu Sans
++ sans-serif
++
++
+ Helvetica
+ sans-serif
+
+
+- Verdana
++ Haettenschweiler
+ sans-serif
+
+
+- Albany AMT
++ Liberation Sans
+ sans-serif
+
+
+- Albany
++ MS Sans Serif
+ sans-serif
+
+
+@@ -101,88 +145,124 @@
+ sans-serif
+
+
++ Nimbus Sans
++ sans-serif
++
++
+ Luxi Sans
+ sans-serif
+
++
++ Tahoma
++ sans-serif
++
++
++ Trebuchet MS
++ sans-serif
++
++
++ Twentieth Century
++ sans-serif
++
++
++ Verdana
++ sans-serif
++
+
++
++ Andale Mono
++ monospace
++
+
+ Bitstream Vera Sans Mono
+ monospace
+
+
+- DejaVu Sans Mono
++ Consolas
+ monospace
+
+
+- Liberation Mono
++ Courier New
+ monospace
+
+
+- Inconsolata
++ Courier
+ monospace
+
+
+- Courier New
++ Cumberland AMT
+ monospace
+
+
+- Courier
++ Cumberland
+ monospace
+
+
+- Andale Mono
++ DejaVu Sans Mono
+ monospace
+
+
+- Luxi Mono
++ Fixedsys
+ monospace
+
+
+- Cumberland AMT
++ Inconsolata
+ monospace
+
+
+- Cumberland
++ Liberation Mono
++ monospace
++
++
++ Luxi Mono
+ monospace
+
+
+ Nimbus Mono L
+ monospace
+
++
++ Nimbus Mono
++ monospace
++
++
++ Terminal
++ monospace
++
+
+-
+- Impact
++
++ Bauhaus Std
+ fantasy
+
+
+- Copperplate Gothic Std
++ Cooper Std
+ fantasy
+
+
+- Cooper Std
++ Copperplate Gothic Std
+ fantasy
+
+
+- Bauhaus Std
++ Impact
+ fantasy
+
+
+
+- ITC Zapf Chancery Std
++ Comic Sans MS
+ cursive
+
+
+- Zapfino
++ ITC Zapf Chancery Std
+ cursive
+
+
+- Comic Sans MS
++ Zapfino
+ cursive
+
+
diff --git a/SOURCES/fontconfig-validate-offset-in-cache.patch b/SOURCES/fontconfig-validate-offset-in-cache.patch
new file mode 100644
index 0000000..9009ffd
--- /dev/null
+++ b/SOURCES/fontconfig-validate-offset-in-cache.patch
@@ -0,0 +1,112 @@
+diff -pruN fontconfig-2.10.95.orig/src/fccache.c fontconfig-2.10.95/src/fccache.c
+--- fontconfig-2.10.95.orig/src/fccache.c 2013-08-26 11:49:32.000000000 +0900
++++ fontconfig-2.10.95/src/fccache.c 2016-08-05 18:01:48.040872110 +0900
+@@ -30,6 +30,7 @@
+ #include
+ #include
+ #include
++#include
+ #include
+ #include
+ #if defined(HAVE_MMAP) || defined(__CYGWIN__)
+@@ -547,6 +548,82 @@ FcCacheTimeValid (FcCache *cache, struct
+ return cache->checksum == (int) dir_stat->st_mtime;
+ }
+
++static FcBool
++FcCacheOffsetsValid (FcCache *cache)
++{
++ char *base = (char *)cache;
++ char *end = base + cache->size;
++ intptr_t *dirs;
++ FcFontSet *fs;
++ int i, j;
++
++ if (cache->dir < 0 || cache->dir > cache->size - sizeof (intptr_t) ||
++ memchr (base + cache->dir, '\0', cache->size - cache->dir) == NULL)
++ return FcFalse;
++
++ if (cache->dirs < 0 || cache->dirs >= cache->size ||
++ cache->dirs_count < 0 ||
++ cache->dirs_count > (cache->size - cache->dirs) / sizeof (intptr_t))
++ return FcFalse;
++
++ dirs = FcCacheDirs (cache);
++ if (dirs)
++ {
++ for (i = 0; i < cache->dirs_count; i++)
++ {
++ FcChar8 *dir;
++
++ if (dirs[i] < 0 ||
++ dirs[i] > end - (char *) dirs - sizeof (intptr_t))
++ return FcFalse;
++
++ dir = FcOffsetToPtr (dirs, dirs[i], FcChar8);
++ if (memchr (dir, '\0', end - (char *) dir) == NULL)
++ return FcFalse;
++ }
++ }
++
++ if (cache->set < 0 || cache->set > cache->size - sizeof (FcFontSet))
++ return FcFalse;
++
++ fs = FcCacheSet (cache);
++ if (fs)
++ {
++ if (fs->nfont > (end - (char *) fs) / sizeof (FcPattern))
++ return FcFalse;
++
++ if (fs->fonts != 0 && !FcIsEncodedOffset(fs->fonts))
++ return FcFalse;
++
++ for (i = 0; i < fs->nfont; i++)
++ {
++ FcPattern *font = FcFontSetFont (fs, i);
++ FcPatternElt *e;
++ FcValueListPtr l;
++
++ if ((char *) font < base ||
++ (char *) font > end - sizeof (FcFontSet) ||
++ font->elts_offset < 0 ||
++ font->elts_offset > end - (char *) font ||
++ font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt))
++ return FcFalse;
++
++
++ e = FcPatternElts(font);
++ if (e->values != 0 && !FcIsEncodedOffset(e->values))
++ return FcFalse;
++
++ for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l))
++ if (l->next != NULL && !FcIsEncodedOffset(l->next))
++ break;
++ if (j < 0)
++ return FcFalse;
++ }
++ }
++
++ return FcTrue;
++}
++
+ /*
+ * Map a cache file into memory
+ */
+@@ -556,7 +633,8 @@ FcDirCacheMapFd (int fd, struct stat *fd
+ FcCache *cache;
+ FcBool allocated = FcFalse;
+
+- if (fd_stat->st_size < (int) sizeof (FcCache))
++ if (fd_stat->st_size > INTPTR_MAX ||
++ fd_stat->st_size < (int) sizeof (FcCache))
+ return NULL;
+ cache = FcCacheFindByStat (fd_stat);
+ if (cache)
+@@ -612,6 +690,7 @@ FcDirCacheMapFd (int fd, struct stat *fd
+ if (cache->magic != FC_CACHE_MAGIC_MMAP ||
+ cache->version < FC_CACHE_CONTENT_VERSION ||
+ cache->size != (intptr_t) fd_stat->st_size ||
++ !FcCacheOffsetsValid (cache) ||
+ !FcCacheTimeValid (cache, dir_stat) ||
+ !FcCacheInsert (cache, fd_stat))
+ {
diff --git a/SPECS/fontconfig.spec b/SPECS/fontconfig.spec
index 878e553..de7aff2 100644
--- a/SPECS/fontconfig.spec
+++ b/SPECS/fontconfig.spec
@@ -3,7 +3,7 @@
Summary: Font configuration and customization library
Name: fontconfig
Version: 2.10.95
-Release: 7%{?dist}
+Release: 10%{?dist}
# src/ftglue.[ch] is in Public Domain
# src/fccache.c contains Public Domain code
# fc-case/CaseFolding.txt is in the UCD
@@ -22,6 +22,9 @@ Patch2: fontconfig-fix-memleak.patch
Patch3: fontconfig-copy-all-value.patch
Patch4: fontconfig-fix-crash-on-fcfontsort.patch
Patch5: fontconfig-fix-race-condition.patch
+Patch6: fontconfig-update-45-latin.patch
+Patch7: fontconfig-validate-offset-in-cache.patch
+Patch8: fontconfig-offset-in-elts.patch
BuildRequires: expat-devel
BuildRequires: freetype-devel >= %{freetype_version}
@@ -68,6 +71,9 @@ which is useful for developing applications that uses fontconfig.
%patch3 -p1 -b .copy-all
%patch4 -p1 -b .fix-crash
%patch5 -p1 -b .fix-race
+%patch6 -p1 -b .update-45-latin
+%patch7 -p1 -b .validate-offset
+%patch8 -p1 -b .offset-elts
cp %{SOURCE2} doc/
%build
@@ -145,6 +151,15 @@ fi
%doc fontconfig-devel.txt fontconfig-devel
%changelog
+* Fri Sep 23 2016 Akira TAGOH - 2.10.95-10
+- Fix a regression in the previous change. (#1355930)
+
+* Fri Aug 5 2016 Akira TAGOH - 2.10.95-9
+- CVE-2016-5384: Validate offsets in cache files properly. (#1355930)
+
+* Fri Jun 10 2016 Akira TAGOH - 2.10.95-8
+- Update 45-latin.conf to add some hints to fall back for Windows fonts (#1073460)
+
* Fri Jan 24 2014 Daniel Mach - 2.10.95-7
- Mass rebuild 2014-01-24