commit 54959c1ebf7bdb4c9b46bd14048af449c4a144f2 Author: Kevin Kofler <kevin.kofler(a)chello.at&gt; Date: Sat Feb 17 21:22:06 2018 +0100 Add fixes for CVE-2018-6942 and loading of named instances from Fedora * Sat Feb 17 2018 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.8-5 - Add 0077-truetype-Fix-loading-of-named-instances.patch and 0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch from Fedora freetype: Fix loading of named instances (TrueType) - Add freetype-2.8-getvariation.patch from Fedora freetype: Avoid NULL pointer dereference in the Ins_GETVARIATION() function (CVE-2018-6942, rh#1544776) 0077-truetype-Fix-loading-of-named-instances.patch | 67 ++++++++++++++++++++++ ...uetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch | 45 +++++++++++++++ freetype-2.8-getvariation.patch | 39 +++++++++++++ freetype-freeworld.spec | 20 ++++++- 4 files changed, 169 insertions(+), 2 deletions(-) --- diff --git a/0077-truetype-Fix-loading-of-named-instances.patch b/0077-truetype-Fix-loading-of-named-instances.patch new file mode 100644 index 0000000..26fd0bc --- /dev/null +++ b/0077-truetype-Fix-loading-of-named-instances.patch @@ -0,0 +1,67 @@ +From 55bbb98f5c5a89230127d6b998a6e23e634b5d0e Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod <behdad(a)behdad.org&gt; +Date: Tue, 1 Aug 2017 09:17:02 +0200 +Subject: [PATCH 077/132] [truetype] Fix loading of named instances. + +* src/truetype/ttgxvar.c (TT_Get_MM_Var): Preserve file position +while loading the `avar' table. +--- + ChangeLog | 7 +++++++ + include/freetype/ftmm.h | 2 +- + src/truetype/ttgxvar.c | 11 ++++++++++- + 3 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/include/freetype/ftmm.h b/include/freetype/ftmm.h +index c41b80ea6..1f48a4945 100644 +--- a/include/freetype/ftmm.h ++++ b/include/freetype/ftmm.h +@@ -178,7 +178,7 @@ FT_BEGIN_HEADER + /* strid :: The entry in `name' table identifying this instance. */ + /* */ + /* psid :: The entry in `name' table identifying a PostScript name */ +- /* for this instance. */ ++ /* for this instance. Value 0 indicates a missing entry. */ + /* */ + typedef struct FT_Var_Named_Style_ + { +diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c +index 68458362e..df42b3bfd 100644 +--- a/src/truetype/ttgxvar.c ++++ b/src/truetype/ttgxvar.c +@@ -2139,8 +2139,16 @@ + goto Exit; + + if ( fvar_head.instanceCount && !face->blend->avar_loaded ) ++ { ++ FT_ULong offset = FT_STREAM_POS(); ++ ++ + ft_var_load_avar( face ); + ++ if ( FT_STREAM_SEEK( offset ) ) ++ goto Exit; ++ } ++ + ns = mmvar->namedstyle; + nsc = face->blend->normalized_stylecoords; + for ( i = 0; i < fvar_head.instanceCount; i++, ns++ ) +@@ -2157,6 +2165,7 @@ + for ( j = 0; j < fvar_head.axisCount; j++, c++ ) + *c = FT_GET_LONG(); + ++ /* valid psid values are 6 and [256;32767] */ + if ( usePsName ) + ns->psid = FT_GET_USHORT(); + +@@ -2174,7 +2183,7 @@ + SFNT_Service sfnt = (SFNT_Service)face->sfnt; + + FT_Int found, dummy1, dummy2; +- FT_UInt strid = 0xFFFFFFFFUL; ++ FT_UInt strid = ~0U; + + + /* the default instance is missing in array the */ +-- +2.13.5 + diff --git a/0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch b/0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch new file mode 100644 index 0000000..e492e58 --- /dev/null +++ b/0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch @@ -0,0 +1,45 @@ +From 7e50824288fac5a36c2938fdb3e1c949ea53f982 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg <wl(a)gnu.org&gt; +Date: Tue, 1 Aug 2017 12:44:35 +0200 +Subject: [PATCH 079/132] * src/truetype/ttgxvar.c (TT_Get_MM_Var): Fix thinko. + +--- + ChangeLog | 4 ++++ + include/freetype/ftmm.h | 3 ++- + src/truetype/ttgxvar.c | 4 +++- + 3 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/include/freetype/ftmm.h b/include/freetype/ftmm.h +index 1f48a4945..b1bc1ed82 100644 +--- a/include/freetype/ftmm.h ++++ b/include/freetype/ftmm.h +@@ -178,7 +178,8 @@ FT_BEGIN_HEADER + /* strid :: The entry in `name' table identifying this instance. */ + /* */ + /* psid :: The entry in `name' table identifying a PostScript name */ +- /* for this instance. Value 0 indicates a missing entry. */ ++ /* for this instance. Value 0xFFFF indicates a missing */ ++ /* entry. */ + /* */ + typedef struct FT_Var_Named_Style_ + { +diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c +index df42b3bfd..5a87df139 100644 +--- a/src/truetype/ttgxvar.c ++++ b/src/truetype/ttgxvar.c +@@ -2165,9 +2165,11 @@ + for ( j = 0; j < fvar_head.axisCount; j++, c++ ) + *c = FT_GET_LONG(); + +- /* valid psid values are 6 and [256;32767] */ ++ /* valid psid values are 6, [256;32767], and 0xFFFF */ + if ( usePsName ) + ns->psid = FT_GET_USHORT(); ++ else ++ ns->psid = 0xFFFF; + + ft_var_to_normalized( face, + fvar_head.axisCount, +-- +2.13.5 + diff --git a/freetype-2.8-getvariation.patch b/freetype-2.8-getvariation.patch new file mode 100644 index 0000000..7e0ecf9 --- /dev/null +++ b/freetype-2.8-getvariation.patch @@ -0,0 +1,39 @@ +From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001 +From: Werner Lemberg <wl(a)gnu.org&gt; +Date: Sat, 27 Jan 2018 14:43:43 +0100 +Subject: [PATCH] * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL + reference. + +Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 +--- + src/truetype/ttinterp.c | 12 ++++++++++-- + 1 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c +index d855aaaa9..551f14a2e 100644 +--- a/src/truetype/ttinterp.c ++++ b/src/truetype/ttinterp.c +@@ -7470,8 +7470,16 @@ + return; + } + +- for ( i = 0; i < num_axes; i++ ) +- args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ if ( coords ) ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ } ++ else ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = 0; ++ } + } + + +-- +2.14.3 + diff --git a/freetype-freeworld.spec b/freetype-freeworld.spec index d6986e6..2fb9ced 100644 --- a/freetype-freeworld.spec +++ b/freetype-freeworld.spec @@ -1,7 +1,7 @@ Summary: A free and portable font rendering engine Name: freetype-freeworld Version: 2.8 -Release: 4%{?dist} +Release: 5%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.ta... @@ -19,8 +19,12 @@ Patch4: freetype-2.8-pcf-encoding.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1456585 Patch5: freetype-2.8-loop-counter.patch +Patch6: 0077-truetype-Fix-loading-of-named-instances.patch +Patch7: 0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch + ## Security fixes: -# None yet +# CVE-2018-6942 NULL pointer dereference in the Ins_GETVARIATION() function +Patch9: freetype-2.8-getvariation.patch Provides: freetype-bytecode Provides: freetype-subpixel @@ -52,6 +56,11 @@ It transparently overrides the system library using ld.so.conf.d. %patch4 -p1 -b .pcf-encoding %patch5 -p1 -b .loop-counter +%patch6 -p1 -b .named-instances +%patch7 -p1 -b .named-instances2 + +# Security fixes: +%patch9 -p1 -b .getvariation %build %configure --disable-static \ @@ -95,6 +104,13 @@ echo "%{_libdir}/%{name}" \ %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %changelog +* Sat Feb 17 2018 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.8-5 +- Add 0077-truetype-Fix-loading-of-named-instances.patch and + 0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch from Fedora + freetype: Fix loading of named instances (TrueType) +- Add freetype-2.8-getvariation.patch from Fedora freetype: Avoid NULL pointer + dereference in the Ins_GETVARIATION() function (CVE-2018-6942, rh#1544776) + * Thu Aug 31 2017 RPM Fusion Release Engineering <kwizart(a)rpmfusion.org&gt; - 2.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild