diff --git a/SOURCES/0001-merge-in-fixes-for-libgd-CVE-2019-6978.patch b/SOURCES/0001-merge-in-fixes-for-libgd-CVE-2019-6978.patch
new file mode 100644
index 0000000..51db1b6
--- /dev/null
+++ b/SOURCES/0001-merge-in-fixes-for-libgd-CVE-2019-6978.patch
@@ -0,0 +1,150 @@
+From f58c813f8afcd08acdd630f378cff1a5009655cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 31 Jan 2019 16:02:19 +0000
+Subject: [PATCH] merge in fixes for libgd CVE-2019-6978
+
+---
+ README | 5 +++++
+ configure.ac | 2 +-
+ src/extra/gd/gd_jpeg.c | 21 +++++++++++++++++----
+ src/extra/gd/gd_wbmp.c | 24 ++++++++++++++++++++++--
+ 4 files changed, 45 insertions(+), 7 deletions(-)
+
+diff --git a/src/extra/gd/gd_jpeg.c b/src/extra/gd/gd_jpeg.c
+index 7e6dfbb..b270186 100644
+--- a/src/extra/gd/gd_jpeg.c
++++ b/src/extra/gd/gd_jpeg.c
+@@ -72,6 +72,8 @@ fatal_jpeg_error (j_common_ptr cinfo)
+ exit (99);
+ }
+
++static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);
++
+ /*
+ * Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality
+ * QUALITY. If QUALITY is in the range 0-100, increasing values
+@@ -93,8 +95,12 @@ gdImageJpegPtr (gdImagePtr im, int *size, int quality)
+ {
+ void *rv;
+ gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
+- gdImageJpegCtx (im, out, quality);
+- rv = gdDPExtractData (out, size);
++ if (out == NULL) return NULL;
++ if (!_gdImageJpegCtx(im, out, quality)) {
++ rv = gdDPExtractData(out, size);
++ } else {
++ rv = NULL;
++ }
+ out->free (out);
+ return rv;
+ }
+@@ -103,6 +109,12 @@ static void jpeg_gdIOCtx_dest (j_compress_ptr cinfo, gdIOCtx * outfile);
+
+ void
+ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
++{
++ _gdImageJpegCtx(im, outfile, quality);
++}
++
++/* returns 0 on success, 1 on failure */
++static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
+ {
+ struct jpeg_compress_struct cinfo;
+ struct jpeg_error_mgr jerr;
+@@ -139,7 +151,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
+ /* we're here courtesy of longjmp */
+ if (row)
+ gdFree (row);
+- return;
++ return 1;
+ }
+
+ cinfo.err->error_exit = fatal_jpeg_error;
+@@ -173,7 +185,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
+ fprintf (stderr, "gd-jpeg: error: unable to allocate JPEG row "
+ "structure: gdCalloc returns NULL\n");
+ jpeg_destroy_compress (&cinfo);
+- return;
++ return 1;
+ }
+
+ rowptr[0] = row;
+@@ -254,6 +266,7 @@ error:
+ #endif
+ jpeg_destroy_compress (&cinfo);
+ gdFree (row);
++ return 0;
+ }
+
+ gdImagePtr
+diff --git a/src/extra/gd/gd_wbmp.c b/src/extra/gd/gd_wbmp.c
+index f1258da..4b27043 100644
+--- a/src/extra/gd/gd_wbmp.c
++++ b/src/extra/gd/gd_wbmp.c
+@@ -85,6 +85,7 @@ gd_getin (void *in)
+ return (gdGetC ((gdIOCtx *) in));
+ }
+
++static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);
+
+ /* gdImageWBMPCtx
+ ** --------------
+@@ -97,6 +98,12 @@ gd_getin (void *in)
+ */
+ void
+ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
++{
++ _gdImageWBMPCtx(image, fg, out);
++}
++
++/* returns 0 on success, 1 on failure */
++static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
+ {
+
+ int x, y, pos;
+@@ -105,7 +112,10 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
+
+ /* create the WBMP */
+ if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL)
++ {
+ fprintf (stderr, "Could not create WBMP\n");
++ return 1;
++ }
+
+ /* fill up the WBMP structure */
+ pos = 0;
+@@ -123,9 +133,16 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
+
+ /* write the WBMP to a gd file descriptor */
+ if (writewbmp (wbmp, &gd_putout, out))
++ {
+ fprintf (stderr, "Could not save WBMP\n");
++ freewbmp (wbmp);
++ return 1;
++ }
++
+ /* des submitted this bugfix: gdFree the memory. */
+ freewbmp (wbmp);
++
++ return 0;
+ }
+
+
+@@ -211,8 +228,12 @@ gdImageWBMPPtr (gdImagePtr im, int *size, int fg)
+ {
+ void *rv;
+ gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
+- gdImageWBMPCtx (im, fg, out);
+- rv = gdDPExtractData (out, size);
++ if (out == NULL) return NULL;
++ if (!_gdImageWBMPCtx(im, fg, out)) {
++ rv = gdDPExtractData(out, size);
++ } else {
++ rv = NULL;
++ }
+ out->free (out);
+ return rv;
+ }
+--
+2.20.1
+
diff --git a/SOURCES/libwmf-0.2.8.4.newurwfonts.patch b/SOURCES/libwmf-0.2.8.4.newurwfonts.patch
new file mode 100644
index 0000000..a1c7102
--- /dev/null
+++ b/SOURCES/libwmf-0.2.8.4.newurwfonts.patch
@@ -0,0 +1,83 @@
+diff -ru libwmf-0.2.8.4/fonts/fontmap.in libwmf-0.2.8.4.fixed/fonts/fontmap.in
+--- libwmf-0.2.8.4/fonts/fontmap.in 2001-08-11 15:49:27.000000000 +0100
++++ libwmf-0.2.8.4.fixed/fonts/fontmap.in 2018-08-08 11:45:23.199731396 +0100
+@@ -1,16 +1,16 @@
+ <?xml version="1.0"?>
+ <fontmap>
+- <font format="type1" metrics="@WMF_FONTDIR@/n019003l.afm" glyphs="@WMF_FONTDIR@/n019003l.pfb" name="Helvetica" fullname="Helvetica Regular" familyname="Helvetica" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n019004l.afm" glyphs="@WMF_FONTDIR@/n019004l.pfb" name="Helvetica-Bold" fullname="Helvetica Bold" familyname="Helvetica" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n019023l.afm" glyphs="@WMF_FONTDIR@/n019023l.pfb" name="Helvetica-Oblique" fullname="Helvetica Regular Italic" familyname="Helvetica" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n019024l.afm" glyphs="@WMF_FONTDIR@/n019024l.pfb" name="Helvetica-BoldOblique" fullname="Helvetica Bold Italic" familyname="Helvetica" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n021003l.afm" glyphs="@WMF_FONTDIR@/n021003l.pfb" name="Times-Roman" fullname="Times Regular" familyname="Times" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n021004l.afm" glyphs="@WMF_FONTDIR@/n021004l.pfb" name="Times-Bold" fullname="Times Medium" familyname="Times" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n021023l.afm" glyphs="@WMF_FONTDIR@/n021023l.pfb" name="Times-Italic" fullname="Times Regular Italic" familyname="Times" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n021024l.afm" glyphs="@WMF_FONTDIR@/n021024l.pfb" name="Times-BoldItalic" fullname="Times Medium Italic" familyname="Times" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n022003l.afm" glyphs="@WMF_FONTDIR@/n022003l.pfb" name="Courier" fullname="Courier Regular" familyname="Courier" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n022004l.afm" glyphs="@WMF_FONTDIR@/n022004l.pfb" name="Courier-Bold" fullname="Courier Bold" familyname="Courier" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n022023l.afm" glyphs="@WMF_FONTDIR@/n022023l.pfb" name="Courier-Oblique" fullname="Courier Regular Oblique" familyname="Courier" weight="Regular" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/n022024l.afm" glyphs="@WMF_FONTDIR@/n022024l.pfb" name="Courier-BoldOblique" fullname="Courier Bold Oblique" familyname="Courier" weight="Bold" version="0.1"/>
+- <font format="type1" metrics="@WMF_FONTDIR@/s050000l.afm" glyphs="@WMF_FONTDIR@/s050000l.pfb" name="Symbol" fullname="Symbol" familyname="Symbol" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusSans-Regular.afm" glyphs="@WMF_FONTDIR@/NimbusSans-Regular.t1" name="Helvetica" fullname="Helvetica Regular" familyname="Helvetica" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusSans-Bold.afm" glyphs="@WMF_FONTDIR@/NimbusSans-Bold.t1" name="Helvetica-Bold" fullname="Helvetica Bold" familyname="Helvetica" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusSans-Italic.afm" glyphs="@WMF_FONTDIR@/NimbusSans-Italic.t1" name="Helvetica-Oblique" fullname="Helvetica Regular Italic" familyname="Helvetica" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusSans-BoldItalic.afm" glyphs="@WMF_FONTDIR@/NimbusSans-BoldItalic.t1" name="Helvetica-BoldOblique" fullname="Helvetica Bold Italic" familyname="Helvetica" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusRoman-Regular.afm" glyphs="@WMF_FONTDIR@/NimbusRoman-Regular.t1" name="Times-Roman" fullname="Times Regular" familyname="Times" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusRoman-Bold.afm" glyphs="@WMF_FONTDIR@/NimbusRoman-Bold.t1" name="Times-Bold" fullname="Times Medium" familyname="Times" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusRoman-Italic.afm" glyphs="@WMF_FONTDIR@/NimbusRoman-Italic.t1" name="Times-Italic" fullname="Times Regular Italic" familyname="Times" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusRoman-BoldItalic.afm" glyphs="@WMF_FONTDIR@/NimbusRoman-BoldItalic.t1" name="Times-BoldItalic" fullname="Times Medium Italic" familyname="Times" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusMonoPS-Regular.afm" glyphs="@WMF_FONTDIR@/NimbusMonoPS-Regular.t1" name="Courier" fullname="Courier Regular" familyname="Courier" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusMonoPS-Bold.afm" glyphs="@WMF_FONTDIR@/NimbusMonoPS-Bold.t1" name="Courier-Bold" fullname="Courier Bold" familyname="Courier" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusMonoPS-Italic.afm" glyphs="@WMF_FONTDIR@/NimbusMonoPS-Italic.t1" name="Courier-Oblique" fullname="Courier Regular Oblique" familyname="Courier" weight="Regular" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/NimbusMonoPS-BoldItalic.afm" glyphs="@WMF_FONTDIR@/NimbusMonoPS-BoldItalic.t1" name="Courier-BoldOblique" fullname="Courier Bold Oblique" familyname="Courier" weight="Bold" version="0.1"/>
++ <font format="type1" metrics="@WMF_FONTDIR@/StandardSymbolsPS.afm" glyphs="@WMF_FONTDIR@/StandardSymbolsPS.t1" name="Symbol" fullname="Symbol" familyname="Symbol" weight="Regular" version="0.1"/>
+ </fontmap>
+diff -ru libwmf-0.2.8.4/configure.in libwmf-0.2.8.4.fixed/configure.in
+--- libwmf-0.2.8.4/configure.in 2018-08-08 11:59:17.657412141 +0100
++++ libwmf-0.2.8.4.fixed/configure.in 2018-08-08 12:00:28.976983132 +0100
+@@ -804,7 +804,9 @@
+ WMF_GS_FONTMAP=/usr/share/ghostscript/5.50/Fontmap
+ if test -d /usr/share/ghostscript; then
+ for i in `ls /usr/share/ghostscript`; do
+- if test -r "/usr/share/ghostscript/$i/Fontmap.GS"; then
++ if test -r "/usr/share/ghostscript/$i/Resource/Init/Fontmap.GS"; then
++ WMF_GS_FONTMAP="/usr/share/ghostscript/$i/Resource/Init/Fontmap.GS"
++ elif test -r "/usr/share/ghostscript/$i/Fontmap.GS"; then
+ WMF_GS_FONTMAP="/usr/share/ghostscript/$i/Fontmap.GS"
+ elif test -r "/usr/share/ghostscript/$i/Fontmap"; then
+ WMF_GS_FONTMAP="/usr/share/ghostscript/$i/Fontmap"
+diff -ru libwmf-0.2.8.4/src/font.h libwmf-0.2.8.4.fixed/src/font.h
+--- libwmf-0.2.8.4/src/font.h 2018-08-08 12:03:52.099609351 +0100
++++ libwmf-0.2.8.4.fixed/src/font.h 2018-08-08 12:07:02.888112396 +0100
+@@ -80,19 +80,19 @@
+ /* postscript (standard 13) font name mapping to type 1 font file
+ */
+ static wmfMapping PSFontMap[13] = {
+- { "Courier", "n022003l.pfb", ft_encoding_adobe_standard },
+- { "Courier-Oblique", "n022023l.pfb", ft_encoding_adobe_standard },
+- { "Courier-Bold", "n022004l.pfb", ft_encoding_adobe_standard },
+- { "Courier-BoldOblique", "n022024l.pfb", ft_encoding_adobe_standard },
+- { "Helvetica", "n019003l.pfb", ft_encoding_adobe_standard },
+- { "Helvetica-Oblique", "n019023l.pfb", ft_encoding_adobe_standard },
+- { "Helvetica-Bold", "n019004l.pfb", ft_encoding_adobe_standard },
+- { "Helvetica-BoldOblique","n019024l.pfb", ft_encoding_adobe_standard },
+- { "Times-Roman", "n021003l.pfb", ft_encoding_adobe_standard },
+- { "Times-Italic", "n021023l.pfb", ft_encoding_adobe_standard },
+- { "Times-Bold", "n021004l.pfb", ft_encoding_adobe_standard },
+- { "Times-BoldItalic", "n021024l.pfb", ft_encoding_adobe_standard },
+- { "Symbol", "s050000l.pfb", ft_encoding_adobe_custom }};
++ { "Courier", "NimbusMonoPS-Regular.t1", ft_encoding_adobe_standard },
++ { "Courier-Oblique", "NimbusMonoPS-Italic.t1", ft_encoding_adobe_standard },
++ { "Courier-Bold", "NimbusMonoPS-Bold.t1", ft_encoding_adobe_standard },
++ { "Courier-BoldOblique", "NimbusMonoPS-BoldItalic.t1", ft_encoding_adobe_standard },
++ { "Helvetica", "NimbusSans-Regular.t1", ft_encoding_adobe_standard },
++ { "Helvetica-Oblique", "NimbusSans-Italic.t1", ft_encoding_adobe_standard },
++ { "Helvetica-Bold", "NimbusSans-Bold.t1", ft_encoding_adobe_standard },
++ { "Helvetica-BoldOblique","NimbusSans-BoldItalic.t1", ft_encoding_adobe_standard },
++ { "Times-Roman", "NimbusRoman-Regular.t1", ft_encoding_adobe_standard },
++ { "Times-Italic", "NimbusRoman-Italic.t1", ft_encoding_adobe_standard },
++ { "Times-Bold", "NimbusRoman-Bold.t1", ft_encoding_adobe_standard },
++ { "Times-BoldItalic", "NimbusRoman-BoldItalic.t1", ft_encoding_adobe_standard },
++ { "Symbol", "StandardSymbolsPS.t1", ft_encoding_adobe_custom }};
+
+ /* exact WMF font name to postscript (standard 13) equivalent...
+ * well, yeah, I know. :-(
diff --git a/SPECS/libwmf.spec b/SPECS/libwmf.spec
index 1e3ff22..8634b70 100644
--- a/SPECS/libwmf.spec
+++ b/SPECS/libwmf.spec
@@ -1,7 +1,7 @@
Summary: Windows MetaFile Library
Name: libwmf
Version: 0.2.8.4
-Release: 41%{?dist}
+Release: 44%{?dist}
Group: System Environment/Libraries
#libwmf is under the LGPLv2+, however...
#1. The tarball contains an old version of the urw-fonts under GPL+.
@@ -61,6 +61,10 @@ Patch17: libwmf-0.2.8.4-CVE-2015-0848+CVE-2015-4588.patch
Patch18: libwmf-0.2.8.4-CVE-2015-4695.patch
# CVE-2015-4696
Patch19: libwmf-0.2.8.4-CVE-2015-4696.patch
+# CVE-2019-6978
+Patch20: 0001-merge-in-fixes-for-libgd-CVE-2019-6978.patch
+# rhbz#1840569
+Patch21: libwmf-0.2.8.4.newurwfonts.patch
Requires: urw-fonts
Requires: %{name}-lite = %{version}-%{release}
@@ -111,13 +115,15 @@ using libwmf.
%patch17 -p1 -b .CVE-2015-0848+CVE-2015-4588
%patch18 -p1 -b .CVE-2015-4695
%patch19 -p1 -b .CVE-2015-4696
+%patch20 -p1 -b .CVE-2019-6978
+%patch21 -p1 -b .newurwfonts
f=README ; iconv -f iso-8859-2 -t utf-8 $f > $f.utf8 ; mv $f.utf8 $f
%build
rm configure.ac
ln -s patches/acconfig.h acconfig.h
autoreconf -i -f
-%configure --with-libxml2 --disable-static --disable-dependency-tracking
+%configure --with-libxml2 --disable-static --disable-dependency-tracking --with-gsfontdir=/usr/share/fonts/urw-base35
make %{?_smp_mflags}
dos2unix doc/caolan/*.html
@@ -131,7 +137,7 @@ find doc -name "Makefile*" -exec rm {} \;
#we're carrying around duplicate fonts
rm -rf $RPM_BUILD_ROOT%{_datadir}/libwmf/fonts/*afm
rm -rf $RPM_BUILD_ROOT%{_datadir}/libwmf/fonts/*pfb
-sed -i $RPM_BUILD_ROOT%{_datadir}/libwmf/fonts/fontmap -e 's#libwmf/fonts#fonts/default/Type1#g'
+sed -i $RPM_BUILD_ROOT%{_datadir}/libwmf/fonts/fontmap -e 's#libwmf/fonts#fonts/urw-base35#g'
%post
/sbin/ldconfig
@@ -176,14 +182,20 @@ gdk-pixbuf-query-loaders-%{__isa_bits} --update-cache || :
%changelog
-* Wed Sep 02 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-41
-- Related: rhbz#1239161 fix patch context
+* Wed May 27 2020 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-44
+- Resolves: rhbz#1840569 adapt to new urw-fonts
-* Mon Jun 08 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-40
-- Resolves: rhbz#1239161 CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696
+* Mon Mar 30 2020 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-43
+- Resolves: rhbz#1679005 CVE-2019-6978
-* Mon Jun 08 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-39.1
-- Resolves: rhbz#1227430 CVE-2015-0848 heap overflow when decoding BMP images
+* Wed Sep 02 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-42
+- Related: rhbz#1239162 fix patch context
+
+* Tue Jul 07 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-41
+- Resolves: rhbz#1239162 CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696
+
+* Mon May 08 2015 Caolán McNamara <caolanm@redhat.com> - 0.2.8.4-40
+- Resolves: rhbz#1227431 CVE-2015-0848 libwmf: heap overflow when decoding BMP images
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.2.8.4-39
- Mass rebuild 2014-01-24