diff --git a/SOURCES/freetype-2.10.4-avoid-invalid-face-index.patch b/SOURCES/freetype-2.10.4-avoid-invalid-face-index.patch new file mode 100644 index 0000000..55c09bd --- /dev/null +++ b/SOURCES/freetype-2.10.4-avoid-invalid-face-index.patch @@ -0,0 +1,43 @@ +From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Thu, 17 Mar 2022 19:24:16 +0100 +Subject: [PATCH] [sfnt] Avoid invalid face index. + +Fixes #1138. + +* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): +Check `face_index` before decrementing. +--- + src/sfnt/sfobjs.c | 2 +- + src/sfnt/sfwoff2.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c +index f9d4d3858..9771c35df 100644 +--- a/src/sfnt/sfobjs.c ++++ b/src/sfnt/sfobjs.c +@@ -566,7 +566,7 @@ + face_index = FT_ABS( face_instance_index ) & 0xFFFF; + + /* value -(N+1) requests information on index N */ +- if ( face_instance_index < 0 ) ++ if ( face_instance_index < 0 && face_index > 0 ) + face_index--; + + if ( face_index >= face->ttc_header.count ) +diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c +index cb1e0664a..165b875e5 100644 +--- a/src/sfnt/sfwoff2.c ++++ b/src/sfnt/sfwoff2.c +@@ -2085,7 +2085,7 @@ + /* Validate requested face index. */ + *num_faces = woff2.num_fonts; + /* value -(N+1) requests information on index N */ +- if ( *face_instance_index < 0 ) ++ if ( *face_instance_index < 0 && face_index > 0 ) + face_index--; + + if ( face_index >= woff2.num_fonts ) +-- +2.35.1 + diff --git a/SOURCES/freetype-2.10.4-guard-face-size.patch b/SOURCES/freetype-2.10.4-guard-face-size.patch new file mode 100644 index 0000000..8a447ae --- /dev/null +++ b/SOURCES/freetype-2.10.4-guard-face-size.patch @@ -0,0 +1,27 @@ +From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:37:28 +0100 +Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. + +Fixes #1140. +--- + src/base/ftobjs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 6492a1517..282c9121a 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -3409,6 +3409,9 @@ + if ( !face ) + return FT_THROW( Invalid_Face_Handle ); + ++ if ( !face->size ) ++ return FT_THROW( Invalid_Size_Handle ); ++ + if ( !req || req->width < 0 || req->height < 0 || + req->type >= FT_SIZE_REQUEST_TYPE_MAX ) + return FT_THROW( Invalid_Argument ); +-- +2.35.1 + diff --git a/SOURCES/freetype-2.10.4-properly-guard-face_index.patch b/SOURCES/freetype-2.10.4-properly-guard-face_index.patch new file mode 100644 index 0000000..92ae817 --- /dev/null +++ b/SOURCES/freetype-2.10.4-properly-guard-face_index.patch @@ -0,0 +1,46 @@ +From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 06:40:17 +0100 +Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard + `face_index`. + +We must ensure that the cast to `FT_Int` doesn't change the sign. + +Fixes #1139. +--- + src/base/ftobjs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:30:45 +0100 +Subject: [PATCH 2/2] * src/base/ftobjs.c (ft_open_face_internal): Thinko. + +--- + src/base/ftobjs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 2c0f0e6c9..10952a6c6 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -2527,6 +2527,16 @@ + #endif + + ++ /* only use lower 31 bits together with sign bit */ ++ if ( face_index > 0 ) ++ face_index &= 0x7FFFFFFFL; ++ else ++ { ++ face_index = -face_index; ++ face_index &= 0x7FFFFFFFL; ++ face_index = -face_index; ++ } ++ + #ifdef FT_DEBUG_LEVEL_TRACE + FT_TRACE3(( "FT_Open_Face: " )); + if ( face_index < 0 ) +-- +2.35.1 + diff --git a/SPECS/freetype.spec b/SPECS/freetype.spec index bfa3c59..54d9458 100644 --- a/SPECS/freetype.spec +++ b/SPECS/freetype.spec @@ -4,7 +4,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.10.4 -Release: 6%{?dist} +Release: 9%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.xz @@ -32,6 +32,15 @@ Patch7: freetype-2.10.4-png-memory-leak.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1964066 Patch8: freetype-2.10.4-covscan.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2077989 +Patch9: freetype-2.10.4-avoid-invalid-face-index.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=2077991 +Patch10: freetype-2.10.4-properly-guard-face_index.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=2077985 +Patch11: freetype-2.10.4-guard-face-size.patch + BuildRequires: gcc BuildRequires: libX11-devel BuildRequires: libpng-devel @@ -96,6 +105,9 @@ popd %patch6 -p1 -b .debughook %patch7 -p1 -b .png-memory-leak %patch8 -p1 -b .covscan +%patch9 -p1 -b .avoid-invalid-face-index +%patch10 -p1 -b .properly-guard-face_index +%patch11 -p1 -b .guard-face-size %build @@ -237,6 +249,18 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Tue May 31 2022 Marek Kasik - 2.10.4-9 +- Guard face->size +- Resolves: #2079280 + +* Mon May 30 2022 Marek Kasik - 2.10.4-8 +- Properly guard "face_index" +- Resolves: #2079262 + +* Thu May 26 2022 Marek Kasik - 2.10.4-7 +- Avoid invalid face index +- Resolves: #2079271 + * Mon Aug 09 2021 Mohan Boddu - 2.10.4-6 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688