Author: kkofler Update of /cvs/free/rpms/freetype-freeworld/F-20 In directory old02.ovh.rpmfusion.lan:/tmp/cvs-serv1803/F-20 Modified Files: freetype-freeworld.spec Added Files: freetype-2.5.0-hintmap.patch freetype-2.5.0-hintmask.patch Log Message: * Fri Dec 12 2014 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.5.0.1-5 - Add freetype-2.5.0-hintmask.patch from Fedora freetype (rh#1172634) (Don't append to stem arrays after hintmask is constructed.) - Add freetype-2.5.0-hintmap.patch from Fedora freetype (rh#1172634) (Suppress an assert when hintMap.count == 0 in specific situations.) freetype-2.5.0-hintmap.patch: cf2hints.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) --- NEW FILE freetype-2.5.0-hintmap.patch --- From: Dave Arnold <darnold(a)adobe.com&gt; Date: Thu, 04 Dec 2014 05:17:26 +0000 Subject: [cff] Modify an FT_ASSERT. * src/cff/cf2hints.c (cf2_hintmap_map): After the fix for Savannah bug #43661, the test font `...aspartam.otf' still triggers an FT_ASSERT. Since hintmap still works with count==0, ... (cf2_glyphpath_lineTo, cf2_glyphpath_curveTo): ... add that term to suppress the assert. --- diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c index 28a892b..040d193 100644 --- a/src/cff/cf2hints.c +++ b/src/cff/cf2hints.c @@ -304,9 +304,6 @@ cf2_hintmap_map( CF2_HintMap hintmap, CF2_Fixed csCoord ) { - FT_ASSERT( hintmap->isValid ); /* must call Build before Map */ - FT_ASSERT( hintmap->lastIndex < CF2_MAX_HINT_EDGES ); - if ( hintmap->count == 0 || ! hintmap->hinted ) { /* there are no hints; use uniform scale and zero offset */ @@ -317,6 +314,7 @@ /* start linear search from last hit */ CF2_UInt i = hintmap->lastIndex; + FT_ASSERT( hintmap->lastIndex < CF2_MAX_HINT_EDGES ); /* search up */ while ( i < hintmap->count - 1 && @@ -1586,7 +1584,8 @@ if ( glyphpath->elemIsQueued ) { - FT_ASSERT( cf2_hintmap_isValid( &glyphpath->hintMap ) ); + FT_ASSERT( cf2_hintmap_isValid( &glyphpath->hintMap ) || + glyphpath->hintMap.count == 0 ); cf2_glyphpath_pushPrevElem( glyphpath, &glyphpath->hintMap, @@ -1672,7 +1671,8 @@ if ( glyphpath->elemIsQueued ) { - FT_ASSERT( cf2_hintmap_isValid( &glyphpath->hintMap ) ); + FT_ASSERT( cf2_hintmap_isValid( &glyphpath->hintMap ) || + glyphpath->hintMap.count == 0 ); cf2_glyphpath_pushPrevElem( glyphpath, &glyphpath->hintMap, -- cgit v0.9.0.2 freetype-2.5.0-hintmask.patch: cf2hints.c | 5 ++++- cf2intrp.c | 22 ++++++++++++++-------- 2 files changed, 18 insertions(+), 9 deletions(-) --- NEW FILE freetype-2.5.0-hintmask.patch --- From: Dave Arnold <darnold(a)adobe.com&gt; Date: Thu, 04 Dec 2014 05:10:16 +0000 Subject: [cff] Fix Savannah bug #43661. * src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdHSTEM, cf2_cmdVSTEM, cf2_cmdHINTMASK>: Don't append to stem arrays after hintmask is constructed. * src/cff/cf2hints.c (cf2_hintmap_build): Add defensive code to avoid reading past end of hintmask. --- diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c index 81049f4..28a892b 100644 --- a/src/cff/cf2hints.c +++ b/src/cff/cf2hints.c @@ -794,9 +794,12 @@ maskPtr = cf2_hintmask_getMaskPtr( &tempHintMask ); /* use the hStem hints only, which are first in the mask */ - /* TODO: compare this to cffhintmaskGetBitCount */ bitCount = cf2_arrstack_size( hStemHintArray ); + /* Defense-in-depth. Should never return here. */ + if ( bitCount > hintMask->bitCount ) + return; + /* synthetic embox hints get highest priority */ if ( font->blues.doEmBoxHints ) { diff --git a/src/cff/cf2intrp.c b/src/cff/cf2intrp.c index 5610917..a269606 100644 --- a/src/cff/cf2intrp.c +++ b/src/cff/cf2intrp.c @@ -4,7 +4,7 @@ /* */ /* Adobe's CFF Interpreter (body). */ /* */ -/* Copyright 2007-2013 Adobe Systems Incorporated. */ +/* Copyright 2007-2014 Adobe Systems Incorporated. */ /* */ /* This software, and all works of authorship, whether in source or */ /* object code form as indicated by the copyright notice(s) included */ @@ -593,8 +593,11 @@ /* never add hints after the mask is computed */ if ( cf2_hintmask_isValid( &hintMask ) ) + { FT_TRACE4(( "cf2_interpT2CharString:" " invalid horizontal hint mask\n" )); + break; + } cf2_doStems( font, opStack, @@ -614,8 +617,11 @@ /* never add hints after the mask is computed */ if ( cf2_hintmask_isValid( &hintMask ) ) + { FT_TRACE4(( "cf2_interpT2CharString:" " invalid vertical hint mask\n" )); + break; + } cf2_doStems( font, opStack, @@ -1141,15 +1147,16 @@ /* `cf2_hintmask_read' (which also traces the mask bytes) */ FT_TRACE4(( op1 == cf2_cmdCNTRMASK ? " cntrmask" : " hintmask" )); - /* if there are arguments on the stack, there this is an */ - /* implied cf2_cmdVSTEMHM */ - if ( cf2_stack_count( opStack ) != 0 ) + /* never add hints after the mask is computed */ + if ( cf2_stack_count( opStack ) > 1 && + cf2_hintmask_isValid( &hintMask ) ) { - /* never add hints after the mask is computed */ - if ( cf2_hintmask_isValid( &hintMask ) ) - FT_TRACE4(( "cf2_interpT2CharString: invalid hint mask\n" )); + FT_TRACE4(( "cf2_interpT2CharString: invalid hint mask\n" )); + break; } + /* if there are arguments on the stack, there this is an */ + /* implied cf2_cmdVSTEMHM */ cf2_doStems( font, opStack, &vStemHintArray, -- cgit v0.9.0.2 Index: freetype-freeworld.spec =================================================================== RCS file: /cvs/free/rpms/freetype-freeworld/F-20/freetype-freeworld.spec,v retrieving revision 1.32 retrieving revision 1.33 diff -u -r1.32 -r1.33 --- freetype-freeworld.spec 11 Mar 2014 11:31:07 -0000 1.32 +++ freetype-freeworld.spec 12 Dec 2014 04:04:27 -0000 1.33 @@ -1,7 +1,7 @@ Summary: A free and portable font rendering engine Name: freetype-freeworld Version: 2.5.0.1 -Release: 4%{?dist} +Release: 5%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -20,6 +20,10 @@ Patch93: freetype-2.5.0-CVE-2014-2240.patch Patch94: freetype-2.5.0-CVE-2014-2241.patch +# https://bugzilla.gnome.org/show_bug.cgi?id=1172634 +Patch95: freetype-2.5.0-hintmask.patch +Patch96: freetype-2.5.0-hintmap.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-root-%(%{__id_u} -n) Provides: freetype-bytecode @@ -53,6 +57,9 @@ %patch93 -p1 -b .CVE-2014-2240 %patch94 -p1 -b .CVE-2014-2241 +%patch95 -p1 -b .hintmask +%patch96 -p1 -b .hintmap + %build @@ -97,6 +104,12 @@ %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %changelog +* Fri Dec 12 2014 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.5.0.1-5 +- Add freetype-2.5.0-hintmask.patch from Fedora freetype (rh#1172634) + (Don't append to stem arrays after hintmask is constructed.) +- Add freetype-2.5.0-hintmap.patch from Fedora freetype (rh#1172634) + (Suppress an assert when hintMap.count == 0 in specific situations.) + * Tue Mar 11 2014 Kevin Kofler <Kevin(a)tigcc.ticalc.org&gt; 2.5.0.1-4 - Add freetype-2.5.0-CVE-2014-2240.patch from Fedora freetype (rh#1074647) (Return when `hintMask' is invalid.)