[freetype-freeworld/f24] Add CVE-2016-10244 fix from Fedora freetype (rh#1429965)
commit 5fc05842930e502a61a3dcce72a5725a28b70094
Author: Kevin Kofler <kevin.kofler(a)chello.at>
Date: Sat Mar 11 15:44:09 2017 +0100
Add CVE-2016-10244 fix from Fedora freetype (rh#1429965)
* Sat Mar 11 2017 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.6.3-2
- Add CVE-2016-10244 (heap buffer overflow, rh#1429965) fix from Fedora freetype
freetype-2.6.3-heap-buffer-overflow.patch | 29 +++++++++++++++++++++++++++++
freetype-freeworld.spec | 10 ++++++++--
2 files changed, 37 insertions(+), 2 deletions(-)
---
diff --git a/freetype-2.6.3-heap-buffer-overflow.patch
b/freetype-2.6.3-heap-buffer-overflow.patch
new file mode 100644
index 0000000..e7c7264
--- /dev/null
+++ b/freetype-2.6.3-heap-buffer-overflow.patch
@@ -0,0 +1,29 @@
+From a660e3de422731b94d4a134d27555430cbb6fb39 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl(a)gnu.org>
+Date: Fri, 26 Aug 2016 00:23:27 +0200
+Subject: [type1] Fix heap buffer overflow.
+
+Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36
+
+* src/type1/t1load.c (parse_charstrings): Reject fonts that don't
+contain glyph names.
+
+diff --git a/src/type1/t1load.c b/src/type1/t1load.c
+index c981adc..f8bf313 100644
+--- a/src/type1/t1load.c
++++ b/src/type1/t1load.c
+@@ -1776,6 +1776,12 @@
+ }
+ }
+
++ if ( !n )
++ {
++ error = FT_THROW( Invalid_File_Format );
++ goto Fail;
++ }
++
+ loader->num_glyphs = n;
+
+ /* if /.notdef is found but does not occupy index 0, do our magic. */
diff --git a/freetype-freeworld.spec b/freetype-freeworld.spec
index 517f8cc..363c073 100644
--- a/freetype-freeworld.spec
+++ b/freetype-freeworld.spec
@@ -1,7 +1,7 @@
Summary: A free and portable font rendering engine
Name: freetype-freeworld
Version: 2.6.3
-Release: 1%{?dist}
+Release: 2%{?dist}
License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement
URL: http://www.freetype.org
Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.ta...
@@ -12,7 +12,8 @@ Patch21: freetype-2.3.0-enable-spr.patch
Patch46: freetype-2.2.1-enable-valid.patch
## Security fixes:
-# none needed yet
+# https://bugzilla.redhat.com/show_bug.cgi?id=1429965
+Patch93: freetype-2.6.3-heap-buffer-overflow.patch
Provides: freetype-bytecode
Provides: freetype-subpixel
@@ -42,6 +43,8 @@ It transparently overrides the system library using ld.so.conf.d.
%patch46 -p1 -b .enable-valid
+%patch93 -p1 -b .heap-buffer-overflow
+
%build
%configure --disable-static \
@@ -85,6 +88,9 @@ echo "%{_libdir}/%{name}" \
%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
%changelog
+* Sat Mar 11 2017 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.6.3-2
+- Add CVE-2016-10244 (heap buffer overflow, rh#1429965) fix from Fedora freetype
+
* Thu Jun 23 2016 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 2.6.3-1
- Update to 2.6.3 (matches Fedora freetype)
- Drop obsolete 0001-cff-Don-t-use-hmtx-table-for-LSB-45520.patch backport