CVE-2016-5384: Validate offsets in cache files properly. (#1364439 )

2016-08-05 20:37:39 +09:00
16 changed files with 645 additions and 691 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -17,30 +17,3 @@ fontconfig-2.8.0.tar.gz
 /fontconfig-2.11.92.tar.bz2
 /fontconfig-2.11.93.tar.bz2
 /fontconfig-2.11.94.tar.bz2
-/fontconfig-2.11.95.tar.bz2
-/fontconfig-2.12.0.tar.bz2
-/fontconfig-2.12.1.tar.bz2
-/fontconfig-2.12.2.tar.bz2
-/fontconfig-2.12.3.tar.bz2
-/fontconfig-2.12.4.tar.bz2
-/fontconfig-2.12.5.tar.bz2
-/fontconfig-2.12.6.tar.bz2
-/fontconfig-2.12.91.tar.bz2
-/fontconfig-2.12.92.tar.bz2
-/fontconfig-2.12.93.tar.bz2
-/fontconfig-2.13.0.tar.bz2
-/fontconfig-2.13.1.tar.bz2
-/fontconfig-2.13.91.tar.xz
-/fontconfig-2.13.92.tar.xz
-/fontconfig-2.13.93.tar.xz
-/fontconfig-2.13.94.tar.xz
-/fontconfig-2.13.95.tar.xz
-/fontconfig-2.13.96.tar.xz
-/fontconfig-2.14.0.tar.xz
-/fontconfig-2.14.1.tar.xz
-/fontconfig-2.14.2.tar.xz
-/fontconfig-2.15.0.tar.xz
-/fontconfig-2.16.0.tar.xz
-/fontconfig-2.16.1.tar.xz
-/fontconfig-2.16.2.tar.xz
-/fontconfig-2.17.0.tar.xz
--- a/4
+++ b/4
@ -1,4 +0,0 @@
-#! /bin/sh
-
-[ -x /usr/bin/fc-cache-32 ] && /usr/bin/fc-cache-32 "$@" || :
-[ -x /usr/bin/fc-cache-64 ] && /usr/bin/fc-cache-64 "$@" || :
--- a/fontconfig-disable-network-required-test.patch
+++ b/fontconfig-disable-network-required-test.patch
@ -1,113 +0,0 @@
-diff -pruN fontconfig-2.17.0.orig/test/meson.build fontconfig-2.17.0/test/meson.build
--- fontconfig-2.17.0.orig/test/meson.build	2025-06-27 12:12:04.000000000 +0900
-+++ fontconfig-2.17.0/test/meson.build	2025-06-27 14:41:08.843726446 +0900
-@@ -1,16 +1,16 @@
-fetch_test_fonts = custom_target(
-  'fetch_test_fonts',
-  output: 'testfonts',
-  command: [
-    python3,
-    join_paths(meson.project_source_root(), 'build-aux', 'fetch-testfonts.py'),
-    '--target-dir',
-    '@BUILD_ROOT@/testfonts',
-    '--try-symlink',
-  ],
-  build_by_default: false,
-  build_always_stale: true,
-)
-+#fetch_test_fonts = custom_target(
-+#  'fetch_test_fonts',
-+#  output: 'testfonts',
-+#  command: [
-+#    python3,
-+#    join_paths(meson.project_source_root(), 'build-aux', 'fetch-testfonts.py'),
-+#    '--target-dir',
-+#    '@BUILD_ROOT@/testfonts',
-+#    '--try-symlink',
-+#  ],
-+#  build_by_default: false,
-+#  build_always_stale: true,
-+#)
- 
- tests = [
-   ['test-bz89617.c', {'c_args': ['-DSRCDIR="@0@"'.format(meson.current_source_dir())]}],
-@@ -33,7 +33,7 @@ if host_machine.system() != 'windows'
-   ]
-   tests_not_parallel += [
-     # FIXME: this needs NotoSans-hinted.zip font downloaded and unpacked into test build directory! see run-test.sh
-    ['test-crbug1004254.c', {'dependencies': dependency('threads')}], # for pthread
-+    # ['test-crbug1004254.c', {'dependencies': dependency('threads')}], # for pthread
-     ['test-mt-fccfg.c', {'include_directories': include_directories('../src'), 'dependencies': dependency('threads')}],
-   ]
- 
-@@ -74,10 +74,10 @@ foreach test_data : tests + tests_not_pa
- endforeach
- 
- 
-if get_option('fontations').enabled()
-  rust = import('rust')
-  rust.test('fc_fontations_rust_tests', fc_fontations, link_with: [libfontconfig_internal], depends: fetch_test_fonts, env: ['builddir=@0@'.format(meson.project_build_root())],)
-endif
-+#if get_option('fontations').enabled()
-+#  rust = import('rust')
-+#  rust.test('fc_fontations_rust_tests', fc_fontations, link_with: [libfontconfig_internal], depends: fetch_test_fonts, env: ['builddir=@0@'.format(meson.project_build_root())],)
-+#endif
- 
- fs = import('fs')
- 
-@@ -92,14 +92,14 @@ if host_machine.system() != 'windows'
- 
-   test('run_test_sh', find_program('run-test.sh'), timeout: 600, env: ['srcdir=@0@'.format(meson.current_source_dir()), 'builddir=@0@'.format(meson.current_build_dir()), 'EXEEXT=@0@'.format(conf.get('EXEEXT')), 'VERBOSE=1'])
- 
-  if pytest.found()
-    test('pytest', pytest, args: ['--tap'],
-         workdir: meson.current_source_dir(),
-         env: ['builddir=@0@'.format(meson.project_build_root())],
-         protocol: 'tap',
-         timeout: 600,
-         depends: fetch_test_fonts)
-  endif
-+#  if pytest.found()
-+#    test('pytest', pytest, args: ['--tap'],
-+#         workdir: meson.current_source_dir(),
-+#         env: ['builddir=@0@'.format(meson.project_build_root())],
-+#         protocol: 'tap',
-+#         timeout: 600,
-+#         depends: fetch_test_fonts)
-+#  endif
- endif
- 
- if jsonc_dep.found()
-diff -pruN fontconfig-2.17.0.orig/test/run-test.sh fontconfig-2.17.0/test/run-test.sh
--- fontconfig-2.17.0.orig/test/run-test.sh	2025-06-27 12:12:04.000000000 +0900
-+++ fontconfig-2.17.0/test/run-test.sh	2025-06-27 14:39:19.098581228 +0900
-@@ -521,18 +521,18 @@ rm -rf "$MYCACHEBASEDIR" "$MYCONFIG" "$B
- 
- fi # if [ "x$EXEEXT" = "x" ]
- 
-if [ -x "$BUILDTESTDIR"/test-crbug1004254 ]; then
-    dotest "MT-safe global config"
-    prep
-    curl -s -o "$FONTDIR"/noto.zip https://noto-website-2.storage.googleapis.com/pkgs/NotoSans-hinted.zip
-    (cd "$FONTDIR"; unzip noto.zip)
-    if [ -n "${SOURCE_DATE_EPOCH:-}" ] && [ ${#SOURCE_DATE_EPOCH} -gt 0 ]; then
-        touch -m -t "$(fdate ${SOURCE_DATE_EPOCH})" "$FONTDIR"
-    fi
-    "$BUILDTESTDIR"/test-crbug1004254
-else
-+#if [ -x "$BUILDTESTDIR"/test-crbug1004254 ]; then
-+#    dotest "MT-safe global config"
-+#    prep
-+#    curl -s -o "$FONTDIR"/noto.zip https://noto-website-2.storage.googleapis.com/pkgs/NotoSans-hinted.zip
-+#    (cd "$FONTDIR"; unzip noto.zip)
-+#    if [ -n "${SOURCE_DATE_EPOCH:-}" ] && [ ${#SOURCE_DATE_EPOCH} -gt 0 ]; then
-+#        touch -m -t "$(fdate ${SOURCE_DATE_EPOCH})" "$FONTDIR"
-+#    fi
-+#    "$BUILDTESTDIR"/test-crbug1004254
-+#else
-     echo "No test-crbug1004254: skipped"
-fi
-+#fi
- 
- if [ "x$EXEEXT" = "x" ]; then
- 
--- a/fontconfig-drop-lang-from-pkgkit-format.patch
+++ b/fontconfig-drop-lang-from-pkgkit-format.patch
@ -1,12 +0,0 @@
-diff -pruN fontconfig-2.16.1.orig/src/fcformat.c fontconfig-2.16.1/src/fcformat.c
--- fontconfig-2.16.1.orig/src/fcformat.c	2025-03-13 20:16:47.000000000 +0900
-+++ fontconfig-2.16.1/src/fcformat.c	2025-03-13 20:42:03.633324643 +0900
-@@ -77,7 +77,7 @@
- #define FCCAT_FORMAT   "\"%{file|basename|cescape}\" %{index} \"%{-file{%{=unparse|cescape}}}\""
- #define FCMATCH_FORMAT "%{file:-<unknown filename>|basename}: \"%{family[0]:-<unknown family>}\" \"%{style[0]:-<unknown style>}\""
- #define FCLIST_FORMAT  "%{?file{%{file}: }}%{-file{%{=unparse}}}"
-#define PKGKIT_FORMAT  "%{[]family{font(%{family|downcase|delete( )})\n}}%{[]lang{font(:lang=%{lang|downcase|translate(_,-)})\n}}"
-+#define PKGKIT_FORMAT  "%{[]family{font(%{family|downcase|delete( )})\n}}"
- 
- static void
- message (const char *fmt, ...)
--- a/fontconfig-fix-SIGFPE.patch
+++ b/fontconfig-fix-SIGFPE.patch
@ -0,0 +1,25 @@
+From 7bc07cf6c2a5685ab95f146f5af2b3bcd5f5864d Mon Sep 17 00:00:00 2001
+From: Akira TAGOH <akira@tagoh.org>
+Date: Mon, 30 Mar 2015 15:18:44 +0900
+Subject: [PATCH] Fix SIGFPE
+
+---
+ src/fcrange.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fcrange.c b/src/fcrange.c
+index 37cf067..9b1b67b 100644
+--- a/src/fcrange.c
+++ b/src/fcrange.c
+@@ -204,7 +204,7 @@ FcRangeHash (const FcRange *r)
+ {
+     FcRange c = FcRangeCanonicalize (r);
+     int b = (int) (c.u.d.begin * 100);
+-    int e = (int) (c.u.d.end * 100);
+    int e = FcDoubleCmpEQ (c.u.d.end, DBL_MAX) ? INT_MAX : (int) (c.u.d.end * 100);
+ 
+     return b ^ (b << 1) ^ (e << 9);
+ }
+-- 
+2.1.0
+
--- a/fontconfig-fix-crash.patch
+++ b/fontconfig-fix-crash.patch
@ -1,28 +0,0 @@
-From b9bec06d73340f1b5727302d13ac3df307b7febc Mon Sep 17 00:00:00 2001
-From: Akira TAGOH <akira@tagoh.org>
-Date: Mon, 30 Jun 2025 09:05:18 +0900
-Subject: [PATCH] Fix a heap buffer overflow
-
-https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/481
-
-Changelog: fixed
---
- src/fcfreetype.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/fcfreetype.c b/src/fcfreetype.c
-index 7a4d9811..0a87d27a 100644
--- a/src/fcfreetype.c
-+++ b/src/fcfreetype.c
-@@ -2661,7 +2661,7 @@ FcFontCapabilities (FT_Face face)
- 	goto bail;
- 
-     maxsize = (((FT_ULong)gpos_count + (FT_ULong)gsub_count) * OTLAYOUT_LEN +
-               (issilgraphitefont ? strlen(fcSilfCapability) : 0));
-+               (issilgraphitefont ? strlen(fcSilfCapability) + 1: 0));
-     complex_ = malloc (sizeof (FcChar8) * maxsize);
-     if (!complex_)
- 	goto bail;
-- 
-2.50.0
-
--- a/fontconfig-lock-cache.patch
+++ b/fontconfig-lock-cache.patch
@ -0,0 +1,456 @@
+From ad9f5880502c9a3f8e7f8919336888ee056f17ba Mon Sep 17 00:00:00 2001
+From: Akira TAGOH <akira@tagoh.org>
+Date: Fri, 14 Aug 2015 17:17:34 +0900
+Subject: [PATCH] Fix the broken cache more.
+
+Take a look at the nano second in the mtime to figure out
+if the cache needs to be updated if available.
+and do the mutex lock between scanning and writing a cache
+to avoid the conflict.
+
+Also we don't need to scan directories again after writing
+caches. so getting rid of the related code as well.
+
+https://bugs.freedesktop.org/show_bug.cgi?id=69845
+
+and for reference:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1236034
+---
+ configure.ac            |  3 ++
+ fc-cache/fc-cache.c     | 75 +++++++++++++------------------------
+ fontconfig/fontconfig.h |  2 +-
+ src/fcarch.c            |  2 +-
+ src/fccache.c           | 98 ++++++++++++++++++++++++++++++++++++++++++++++++-
+ src/fcdir.c             |  6 +++
+ src/fcint.h             |  8 ++++
+ 7 files changed, 142 insertions(+), 52 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index e888f2c..0ab3cfc 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -167,6 +167,9 @@ AC_CHECK_SYMBOL([posix_fadvise], [fcntl.h], [fc_func_posix_fadvise=1], [fc_func_
+ AC_DEFINE_UNQUOTED([HAVE_POSIX_FADVISE], [$fc_func_posix_fadvise], [Define to 1 if you have the 'posix_fadvise' function.])
+ 
+ #
+AC_CHECK_MEMBERS([struct stat.st_mtim],,, [#include <sys/stat.h>])
+
+#
+ if test "x$ac_cv_func_fstatvfs" = "xyes"; then
+ 	AC_CHECK_MEMBERS([struct statvfs.f_basetype, struct statvfs.f_fstypename],,,
+ 		[#include <sys/statvfs.h>])
+diff --git a/fc-cache/fc-cache.c b/fc-cache/fc-cache.c
+index 18cd6c5..0336073 100644
+--- a/fc-cache/fc-cache.c
+++ b/fc-cache/fc-cache.c
+@@ -122,7 +122,7 @@ usage (char *program, int error)
+ static FcStrSet *processed_dirs;
+ 
+ static int
+-scanDirs (FcStrList *list, FcConfig *config, FcBool force, FcBool really_force, FcBool verbose, FcBool recursive, FcBool error_on_no_fonts, int *changed, FcStrSet *updateDirs)
+scanDirs (FcStrList *list, FcConfig *config, FcBool force, FcBool really_force, FcBool verbose, FcBool error_on_no_fonts, int *changed)
+ {
+     int		    ret = 0;
+     const FcChar8   *dir;
+@@ -142,15 +142,13 @@ scanDirs (FcStrList *list, FcConfig *config, FcBool force, FcBool really_force,
+     {
+ 	if (verbose)
+ 	{
+-	    if (!recursive)
+-		printf ("Re-scanning ");
+ 	    if (sysroot)
+ 		printf ("[%s]", sysroot);
+ 	    printf ("%s: ", dir);
+ 	    fflush (stdout);
+ 	}
+ 	
+-	if (recursive && FcStrSetMember (processed_dirs, dir))
+	if (FcStrSetMember (processed_dirs, dir))
+ 	{
+ 	    if (verbose)
+ 		printf ("skipping, looped directory detected\n");
+@@ -194,13 +192,8 @@ scanDirs (FcStrList *list, FcConfig *config, FcBool force, FcBool really_force,
+ 	
+ 	if (!cache)
+ 	{
+-	    if (!recursive)
+-		cache = FcDirCacheRescan (dir, config);
+-	    else
+-	    {
+-		(*changed)++;
+-		cache = FcDirCacheRead (dir, FcTrue, config);
+-	    }
+	    (*changed)++;
+	    cache = FcDirCacheRead (dir, FcTrue, config);
+ 	    if (!cache)
+ 	    {
+ 		fprintf (stderr, "%s: error scanning\n", dir);
+@@ -229,37 +222,30 @@ scanDirs (FcStrList *list, FcConfig *config, FcBool force, FcBool really_force,
+ 	    }
+ 	}
+ 
+-	if (recursive)
+	subdirs = FcStrSetCreate ();
+	if (!subdirs)
+ 	{
+-	    subdirs = FcStrSetCreate ();
+-	    if (!subdirs)
+-	    {
+-		fprintf (stderr, "%s: Can't create subdir set\n", dir);
+-		ret++;
+-		FcDirCacheUnload (cache);
+-		continue;
+-	    }
+-	    for (i = 0; i < FcCacheNumSubdir (cache); i++)
+-		FcStrSetAdd (subdirs, FcCacheSubdir (cache, i));
+-	    if (updateDirs && FcCacheNumSubdir (cache) > 0)
+-		FcStrSetAdd (updateDirs, dir);
+-	
+	    fprintf (stderr, "%s: Can't create subdir set\n", dir);
+	    ret++;
+ 	    FcDirCacheUnload (cache);
+	    continue;
+	}
+	for (i = 0; i < FcCacheNumSubdir (cache); i++)
+	    FcStrSetAdd (subdirs, FcCacheSubdir (cache, i));
+ 	
+-	    sublist = FcStrListCreate (subdirs);
+-	    FcStrSetDestroy (subdirs);
+-	    if (!sublist)
+-	    {
+-		fprintf (stderr, "%s: Can't create subdir list\n", dir);
+-		ret++;
+-		continue;
+-	    }
+-	    FcStrSetAdd (processed_dirs, dir);
+-	    ret += scanDirs (sublist, config, force, really_force, verbose, recursive, error_on_no_fonts, changed, updateDirs);
+-	    FcStrListDone (sublist);
+	FcDirCacheUnload (cache);
+
+	sublist = FcStrListCreate (subdirs);
+	FcStrSetDestroy (subdirs);
+	if (!sublist)
+	{
+	    fprintf (stderr, "%s: Can't create subdir list\n", dir);
+	    ret++;
+	    continue;
+ 	}
+-	else
+-	    FcDirCacheUnload (cache);
+	FcStrSetAdd (processed_dirs, dir);
+	ret += scanDirs (sublist, config, force, really_force, verbose, error_on_no_fonts, changed);
+	FcStrListDone (sublist);
+     }
+     if (error_on_no_fonts && !was_processed)
+ 	ret++;
+@@ -290,7 +276,7 @@ cleanCacheDirectories (FcConfig *config, FcBool verbose)
+ int
+ main (int argc, char **argv)
+ {
+-    FcStrSet	*dirs, *updateDirs;
+    FcStrSet	*dirs;
+     FcStrList	*list;
+     FcBool    	verbose = FcFalse;
+     FcBool	force = FcFalse;
+@@ -393,18 +379,9 @@ main (int argc, char **argv)
+ 	return 1;
+     }
+ 
+-    updateDirs = FcStrSetCreate ();
+     changed = 0;
+-    ret = scanDirs (list, config, force, really_force, verbose, FcTrue, error_on_no_fonts, &changed, updateDirs);
+-    /* Update the directory cache again to avoid the race condition as much as possible */
+    ret = scanDirs (list, config, force, really_force, verbose, error_on_no_fonts, &changed);
+     FcStrListDone (list);
+-    list = FcStrListCreate (updateDirs);
+-    if (list)
+-    {
+-	ret += scanDirs (list, config, FcTrue, FcFalse, verbose, FcFalse, error_on_no_fonts, &changed, NULL);
+-	FcStrListDone (list);
+-    }
+-    FcStrSetDestroy (updateDirs);
+ 
+     /*
+      * Try to create CACHEDIR.TAG anyway.
+diff --git a/fontconfig/fontconfig.h b/fontconfig/fontconfig.h
+index a570b2f..57c1b68 100644
+--- a/fontconfig/fontconfig.h
+++ b/fontconfig/fontconfig.h
+@@ -66,7 +66,7 @@ typedef int		FcBool;
+  * it means multiple copies of the font information.
+  */
+ 
+-#define FC_CACHE_VERSION_NUMBER	6
+#define FC_CACHE_VERSION_NUMBER	7
+ #define _FC_STRINGIFY_(s)    	#s
+ #define _FC_STRINGIFY(s)    	_FC_STRINGIFY_(s)
+ #define FC_CACHE_VERSION    	_FC_STRINGIFY(FC_CACHE_VERSION_NUMBER)
+diff --git a/src/fcarch.c b/src/fcarch.c
+index 4a921c0..da33a83 100644
+--- a/src/fcarch.c
+++ b/src/fcarch.c
+@@ -48,7 +48,7 @@ FC_ASSERT_STATIC (0x08 + 1*FC_MAX(SIZEOF_VOID_P,ALIGNOF_DOUBLE) == sizeof (FcVal
+ FC_ASSERT_STATIC (0x00 + 2*SIZEOF_VOID_P == sizeof (FcPatternElt));
+ FC_ASSERT_STATIC (0x08 + 2*SIZEOF_VOID_P == sizeof (FcPattern));
+ FC_ASSERT_STATIC (0x08 + 2*SIZEOF_VOID_P == sizeof (FcCharSet));
+-FC_ASSERT_STATIC (0x08 + 6*SIZEOF_VOID_P == sizeof (FcCache));
+FC_ASSERT_STATIC (0x08 + 7*SIZEOF_VOID_P == sizeof (FcCache));
+ 
+ 
+ int
+diff --git a/src/fccache.c b/src/fccache.c
+index fc3ed41..20c4418 100644
+--- a/src/fccache.c
+++ b/src/fccache.c
+@@ -253,6 +253,7 @@ struct _FcCacheSkip {
+     dev_t	    cache_dev;
+     ino_t	    cache_ino;
+     time_t	    cache_mtime;
+    long	    cache_mtime_nano;
+     FcCacheSkip	    *next[1];
+ };
+ 
+@@ -380,12 +381,18 @@ FcCacheInsert (FcCache *cache, struct stat *cache_stat)
+ 	s->cache_dev = cache_stat->st_dev;
+ 	s->cache_ino = cache_stat->st_ino;
+ 	s->cache_mtime = cache_stat->st_mtime;
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+	s->cache_mtime_nano = cache_stat->st_mtim.tv_nsec;
+#else
+	s->cache_mtime_nano = 0;
+#endif
+     }
+     else
+     {
+ 	s->cache_dev = 0;
+ 	s->cache_ino = 0;
+ 	s->cache_mtime = 0;
+	s->cache_mtime_nano = 0;
+     }
+ 
+     /*
+@@ -473,6 +480,10 @@ FcCacheFindByStat (struct stat *cache_stat)
+ 	    s->cache_ino == cache_stat->st_ino &&
+ 	    s->cache_mtime == cache_stat->st_mtime)
+ 	{
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+	    if (s->cache_mtime != cache_stat->st_mtim.tv_nsec)
+		continue;
+#endif
+ 	    FcRefInc (&s->ref);
+ 	    unlock_cache ();
+ 	    return s->cache;
+@@ -540,6 +551,7 @@ static FcBool
+ FcCacheTimeValid (FcConfig *config, FcCache *cache, struct stat *dir_stat)
+ {
+     struct stat	dir_static;
+    FcBool fnano = FcTrue;
+ 
+     if (!dir_stat)
+     {
+@@ -558,10 +570,18 @@ FcCacheTimeValid (FcConfig *config, FcCache *cache, struct stat *dir_stat)
+ 	FcStrFree (d);
+ 	dir_stat = &dir_static;
+     }
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+    fnano = (cache->checksum_nano == dir_stat->st_mtim.tv_nsec);
+    if (FcDebug () & FC_DBG_CACHE)
+	printf ("FcCacheTimeValid dir \"%s\" cache checksum %d.%ld dir checksum %d.%ld\n",
+		FcCacheDir (cache), cache->checksum, cache->checksum_nano, (int) dir_stat->st_mtime, dir_stat->st_mtim.tv_nsec);
+#else
+     if (FcDebug () & FC_DBG_CACHE)
+ 	printf ("FcCacheTimeValid dir \"%s\" cache checksum %d dir checksum %d\n",
+ 		FcCacheDir (cache), cache->checksum, (int) dir_stat->st_mtime);
+-    return cache->checksum == (int) dir_stat->st_mtime;
+#endif
+
+    return cache->checksum == (int) dir_stat->st_mtime && fnano;
+ }
+ 
+ static FcBool
+@@ -757,6 +777,10 @@ FcDirCacheValidateHelper (FcConfig *config, int fd, struct stat *fd_stat, struct
+ 	ret = FcFalse;
+     else if (c.checksum != (int) dir_stat->st_mtime)
+ 	ret = FcFalse;
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+    else if (c.checksum_nano != dir_stat->st_mtim.tv_nsec)
+	ret = FcFalse;
+#endif
+     return ret;
+ }
+ 
+@@ -831,6 +855,9 @@ FcDirCacheBuild (FcFontSet *set, const FcChar8 *dir, struct stat *dir_stat, FcSt
+     cache->version = FC_CACHE_VERSION_NUMBER;
+     cache->size = serialize->size;
+     cache->checksum = (int) dir_stat->st_mtime;
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+    cache->checksum_nano = dir_stat->st_mtim.tv_nsec;
+#endif
+ 
+     /*
+      * Serialize directory name
+@@ -1018,6 +1045,11 @@ FcDirCacheWrite (FcCache *cache, FcConfig *config)
+ 	    skip->cache_dev = cache_stat.st_dev;
+ 	    skip->cache_ino = cache_stat.st_ino;
+ 	    skip->cache_mtime = cache_stat.st_mtime;
+#ifdef HAVE_STRUCT_STAT_ST_MTIM
+	    skip->cache_mtime_nano = cache_stat.st_mtim.tv_nsec;
+#else
+	    skip->cache_mtime_nano = 0;
+#endif
+ 	}
+ 	unlock_cache ();
+     }
+@@ -1142,6 +1174,70 @@ FcDirCacheClean (const FcChar8 *cache_dir, FcBool verbose)
+     return ret;
+ }
+ 
+int
+FcDirCacheLock (const FcChar8 *dir,
+		FcConfig      *config)
+{
+    FcChar8 *cache_hashed = NULL;
+    FcChar8 cache_base[CACHEBASE_LEN];
+    FcStrList *list;
+    FcChar8 *cache_dir;
+    const FcChar8 *sysroot = FcConfigGetSysRoot (config);
+    int fd = -1;
+
+    FcDirCacheBasename (dir, cache_base);
+    list = FcStrListCreate (config->cacheDirs);
+    if (!list)
+	return -1;
+
+    while ((cache_dir = FcStrListNext (list)))
+    {
+	if (sysroot)
+	    cache_hashed = FcStrBuildFilename (sysroot, cache_dir, cache_base, NULL);
+	else
+	    cache_hashed = FcStrBuildFilename (cache_dir, cache_base, NULL);
+	if (!cache_hashed)
+	    break;
+	fd = FcOpen ((const char *)cache_hashed, O_RDWR);
+	/* No caches in that directory. simply retry with another one */
+	if (fd != -1)
+	{
+	    struct flock fl;
+
+	    fl.l_type = F_WRLCK;
+	    fl.l_whence = SEEK_SET;
+	    fl.l_start = 0;
+	    fl.l_len = 0;
+	    fl.l_pid = getpid ();
+	    if (fcntl (fd, F_SETLKW, &fl) == -1)
+		goto bail;
+	    break;
+	}
+    }
+    return fd;
+bail:
+    if (fd != -1)
+	close (fd);
+    return -1;
+}
+
+void
+FcDirCacheUnlock (int fd)
+{
+    struct flock fl;
+
+    if (fd != -1)
+    {
+	fl.l_type = F_UNLCK;
+	fl.l_whence = SEEK_SET;
+	fl.l_start = 0;
+	fl.l_len = 0;
+	fl.l_pid = getpid ();
+	fcntl (fd, F_SETLK, &fl);
+	close (fd);
+    }
+}
+
+ /*
+  * Hokey little macro trick to permit the definitions of C functions
+  * with the same name as CPP macros
+diff --git a/src/fcdir.c b/src/fcdir.c
+index 2e7f0dc..f4807dd 100644
+--- a/src/fcdir.c
+++ b/src/fcdir.c
+@@ -332,6 +332,7 @@ FcDirCacheScan (const FcChar8 *dir, FcConfig *config)
+     struct stat		dir_stat;
+     const FcChar8	*sysroot = FcConfigGetSysRoot (config);
+     FcChar8		*d;
+    int			fd = -1;
+ 
+     if (sysroot)
+ 	d = FcStrBuildFilename (sysroot, dir, NULL);
+@@ -352,6 +353,7 @@ FcDirCacheScan (const FcChar8 *dir, FcConfig *config)
+     if (!dirs)
+ 	goto bail1;
+ 
+    fd = FcDirCacheLock (dir, config);
+     /*
+      * Scan the dir
+      */
+@@ -371,6 +373,7 @@ FcDirCacheScan (const FcChar8 *dir, FcConfig *config)
+     FcDirCacheWrite (cache, config);
+ 
+  bail2:
+    FcDirCacheUnlock (fd);
+     FcStrSetDestroy (dirs);
+  bail1:
+     FcFontSetDestroy (set);
+@@ -389,6 +392,7 @@ FcDirCacheRescan (const FcChar8 *dir, FcConfig *config)
+     FcStrSet *dirs;
+     const FcChar8 *sysroot = FcConfigGetSysRoot (config);
+     FcChar8 *d = NULL;
+    int fd = -1;
+ 
+     cache = FcDirCacheLoad (dir, config, NULL);
+     if (!cache)
+@@ -404,6 +408,7 @@ FcDirCacheRescan (const FcChar8 *dir, FcConfig *config)
+     if (!dirs)
+ 	goto bail;
+ 
+    fd = FcDirCacheLock (dir, config);
+     /*
+      * Scan the dir
+      */
+@@ -422,6 +427,7 @@ FcDirCacheRescan (const FcChar8 *dir, FcConfig *config)
+     FcDirCacheWrite (new, config);
+ 
+ bail1:
+    FcDirCacheUnlock (fd);
+     FcStrSetDestroy (dirs);
+ bail:
+     if (d)
+diff --git a/src/fcint.h b/src/fcint.h
+index 15e22fd..68f9817 100644
+--- a/src/fcint.h
+++ b/src/fcint.h
+@@ -369,6 +369,7 @@ struct _FcCache {
+     int		dirs_count;	    /* number of subdir strings */
+     intptr_t	set;		    /* offset to font set */
+     int		checksum;	    /* checksum of directory state */
+    long	checksum_nano;	    /* checksum of directory state */
+ };
+ 
+ #undef FcCacheDir
+@@ -590,6 +591,13 @@ FcCacheFini (void);
+ FcPrivate void
+ FcDirCacheReference (FcCache *cache, int nref);
+ 
+FcPrivate int
+FcDirCacheLock (const FcChar8 *dir,
+		FcConfig      *config);
+
+FcPrivate void
+FcDirCacheUnlock (int fd);
+
+ /* fccfg.c */
+ 
+ FcPrivate FcBool
+-- 
+2.4.3
+
--- a/fontconfig-lower-nonlatin-conf.patch
+++ b/fontconfig-lower-nonlatin-conf.patch
@ -1,42 +0,0 @@
-diff -pruN fontconfig-2.16.0.orig/conf.d/Makefile.am fontconfig-2.16.0/conf.d/Makefile.am
--- fontconfig-2.16.0.orig/conf.d/Makefile.am	2025-01-18 00:15:05.000000000 +0900
-+++ fontconfig-2.16.0/conf.d/Makefile.am	2025-01-18 00:38:32.245398277 +0900
-@@ -47,7 +47,7 @@ CONF_LINKS = \
- 	60-generic.conf \
- 	60-latin.conf \
- 	65-fonts-persian.conf \
-	65-nonlatin.conf \
-+	69-nonlatin.conf \
- 	69-unifont.conf \
- 	80-delicious.conf \
- 	90-synthetic.conf
-@@ -95,7 +95,7 @@ template_DATA =				\
- 	60-latin.conf			\
- 	65-fonts-persian.conf		\
- 	65-khmer.conf			\
-	65-nonlatin.conf		\
-+	69-nonlatin.conf		\
- 	69-unifont.conf			\
- 	70-no-bitmaps.conf		\
- 	70-no-bitmaps-and-emoji.conf	\
-diff -pruN fontconfig-2.16.0.orig/conf.d/meson.build fontconfig-2.16.0/conf.d/meson.build
--- fontconfig-2.16.0.orig/conf.d/meson.build	2025-01-18 00:15:05.000000000 +0900
-+++ fontconfig-2.16.0/conf.d/meson.build	2025-01-18 00:38:43.243595743 +0900
-@@ -33,7 +33,7 @@ conf_files = [
-   '60-latin.conf',
-   '65-fonts-persian.conf',
-   '65-khmer.conf',
-  '65-nonlatin.conf',
-+  '69-nonlatin.conf',
-   '69-unifont.conf',
-   '70-no-bitmaps.conf',
-   '70-no-bitmaps-and-emoji.conf',
-@@ -64,7 +64,7 @@ conf_links = [
-   '60-generic.conf',
-   '60-latin.conf',
-   '65-fonts-persian.conf',
-  '65-nonlatin.conf',
-+  '69-nonlatin.conf',
-   '69-unifont.conf',
-   '80-delicious.conf',
-   '90-synthetic.conf',
--- a/fontconfig-sleep-less.patch
+++ b/fontconfig-sleep-less.patch
@ -1,12 +1,12 @@
-diff -pruN fontconfig-2.12.91.orig/fc-cache/fc-cache.c fontconfig-2.12.91/fc-cache/fc-cache.c
--- fontconfig-2.12.91.orig/fc-cache/fc-cache.c	2017-11-20 21:02:20.000000000 +0900
-+++ fontconfig-2.12.91/fc-cache/fc-cache.c	2017-12-14 16:59:19.002003145 +0900
-@@ -413,7 +413,7 @@ main (int argc, char **argv)
+diff -pruN fontconfig-2.11.0.orig/fc-cache/fc-cache.c fontconfig-2.11.0/fc-cache/fc-cache.c
+--- fontconfig-2.11.0.orig/fc-cache/fc-cache.c	2013-10-11 12:10:17.000000000 +0900
+++ fontconfig-2.11.0/fc-cache/fc-cache.c	2013-10-11 13:09:48.000000000 +0900
+@@ -399,7 +399,7 @@ main (int argc, char **argv)
      */
     /* the resolution of mtime on FAT is 2 seconds */
     if (changed)
 -	sleep (2);
 +	sleep (1);
     if (verbose)
- 	printf ("%s: %s\n", argv[0], ret ? _("failed") : _("succeeded"));
+ 	printf ("%s: %s\n", argv[0], ret ? "failed" : "succeeded");
     return ret;
--- a/fontconfig-validate-offset-in-cache.patch
+++ b/fontconfig-validate-offset-in-cache.patch
@ -0,0 +1,112 @@
+diff -pruN fontconfig-2.11.94.orig/src/fccache.c fontconfig-2.11.94/src/fccache.c
+--- fontconfig-2.11.94.orig/src/fccache.c	2016-08-05 20:07:43.053872110 +0900
+++ fontconfig-2.11.94/src/fccache.c	2016-08-05 20:09:35.819872110 +0900
+@@ -27,6 +27,7 @@
+ #include <fcntl.h>
+ #include <dirent.h>
+ #include <string.h>
+#include <limits.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <assert.h>
+@@ -611,6 +612,82 @@ bail:
+     return ret;
+ }
+ 
+static FcBool
+FcCacheOffsetsValid (FcCache *cache)
+{
+    char		*base = (char *)cache;
+    char		*end = base + cache->size;
+    intptr_t		*dirs;
+    FcFontSet		*fs;
+    int			 i, j;
+
+    if (cache->dir < 0 || cache->dir > cache->size - sizeof (intptr_t) ||
+        memchr (base + cache->dir, '\0', cache->size - cache->dir) == NULL)
+        return FcFalse;
+
+    if (cache->dirs < 0 || cache->dirs >= cache->size ||
+        cache->dirs_count < 0 ||
+        cache->dirs_count > (cache->size - cache->dirs) / sizeof (intptr_t))
+        return FcFalse;
+
+    dirs = FcCacheDirs (cache);
+    if (dirs)
+    {
+        for (i = 0; i < cache->dirs_count; i++)
+        {
+            FcChar8	*dir;
+
+            if (dirs[i] < 0 ||
+                dirs[i] > end - (char *) dirs - sizeof (intptr_t))
+                return FcFalse;
+
+            dir = FcOffsetToPtr (dirs, dirs[i], FcChar8);
+            if (memchr (dir, '\0', end - (char *) dir) == NULL)
+                return FcFalse;
+         }
+    }
+
+    if (cache->set < 0 || cache->set > cache->size - sizeof (FcFontSet))
+        return FcFalse;
+
+    fs = FcCacheSet (cache);
+    if (fs)
+    {
+        if (fs->nfont > (end - (char *) fs) / sizeof (FcPattern))
+            return FcFalse;
+
+        if (fs->fonts != 0 && !FcIsEncodedOffset(fs->fonts))
+            return FcFalse;
+
+        for (i = 0; i < fs->nfont; i++)
+        {
+            FcPattern		*font = FcFontSetFont (fs, i);
+            FcPatternElt	*e;
+            FcValueListPtr	 l;
+
+            if ((char *) font < base ||
+                (char *) font > end - sizeof (FcFontSet) ||
+                font->elts_offset < 0 ||
+                font->elts_offset > end - (char *) font ||
+                font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt))
+                return FcFalse;
+
+
+            e = FcPatternElts(font);
+            if (e->values != 0 && !FcIsEncodedOffset(e->values))
+                return FcFalse;
+
+            for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l))
+                if (l->next != NULL && !FcIsEncodedOffset(l->next))
+                    break;
+            if (j < 0)
+                return FcFalse;
+        }
+    }
+
+    return FcTrue;
+}
+
+ /*
+  * Map a cache file into memory
+  */
+@@ -620,7 +697,8 @@ FcDirCacheMapFd (FcConfig *config, int f
+     FcCache	*cache;
+     FcBool	allocated = FcFalse;
+ 
+-    if (fd_stat->st_size < (int) sizeof (FcCache))
+    if (fd_stat->st_size > INTPTR_MAX ||
+        fd_stat->st_size < (int) sizeof (FcCache))
+ 	return NULL;
+     cache = FcCacheFindByStat (fd_stat);
+     if (cache)
+@@ -677,6 +755,7 @@ FcDirCacheMapFd (FcConfig *config, int f
+     if (cache->magic != FC_CACHE_MAGIC_MMAP ||
+ 	cache->version < FC_CACHE_VERSION_NUMBER ||
+ 	cache->size != (intptr_t) fd_stat->st_size ||
+	!FcCacheOffsetsValid (cache) ||
+ 	!FcCacheTimeValid (config, cache, dir_stat) ||
+ 	!FcCacheDirsValid (config, cache) ||
+ 	!FcCacheInsert (cache, fd_stat))
--- a/fontconfig.spec
+++ b/fontconfig.spec
@ -1,46 +1,35 @@
-# ifdef'd in source code but runtime dep will be made for FT_Done_MM_Var symbol in freetype-2.9.1
-# so update the build deps as well to keep deps consistency between runtime and build time.
-%global freetype_version 2.9.1
+%global freetype_version 2.1.4

 Summary:	Font configuration and customization library
 Name:		fontconfig
-Version:	2.17.0
-Release:	3%{?dist}
+Version:	2.11.94
+Release:	5%{?dist}
 # src/ftglue.[ch] is in Public Domain
 # src/fccache.c contains Public Domain code
-## https://gitlab.com/fedora/legal/fedora-license-data/-/issues/177
 # fc-case/CaseFolding.txt is in the UCD
 # otherwise MIT
-License:	HPND AND LicenseRef-Fedora-Public-Domain AND Unicode-DFS-2016
-Source:		http://fontconfig.org/release/%{name}-%{version}.tar.xz
+License:	MIT and Public Domain and UCD
+Group:		System Environment/Libraries
+Source:		http://fontconfig.org/release/%{name}-%{version}.tar.bz2
 URL:		http://fontconfig.org
 Source1:	25-no-bitmap-fedora.conf
-Source2:	fc-cache

 # https://bugzilla.redhat.com/show_bug.cgi?id=140335
 Patch0:		%{name}-sleep-less.patch
-Patch4:		%{name}-drop-lang-from-pkgkit-format.patch
-Patch5:		%{name}-disable-network-required-test.patch
-Patch6:		%{name}-lower-nonlatin-conf.patch
-Patch7:		%{name}-fix-crash.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1236034
+Patch1:		%{name}-lock-cache.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1364439
+Patch2:		%{name}-validate-offset-in-cache.patch

-BuildRequires:	libxml2-devel
+BuildRequires:	expat-devel
 BuildRequires:	freetype-devel >= %{freetype_version}
 BuildRequires:	fontpackages-devel
-BuildRequires:	gettext
-BuildRequires:	gperf
-BuildRequires:  docbook-utils docbook-utils-pdf
-BuildRequires:  meson ninja-build gcc
+BuildRequires:	autoconf automake libtool

-Requires:	fonts-filesystem freetype
-# Register DTD system-wide to make validation work by default
-# (used by fonts-rpm-macros)
-Requires(pre):    xml-common
-Requires(postun): xml-common
-PreReq:		freetype >= 2.9.1-6
+Requires:	fontpackages-filesystem
+Requires(pre):	freetype
 Requires(post):	grep coreutils
 Requires:	font(:lang=en)
-Suggests:	font(notosans)

 %description
 Fontconfig is designed to locate fonts within the
@ -49,10 +38,10 @@ applications.

 %package	devel
 Summary:	Font configuration and customization library
+Group:		Development/Libraries
 Requires:	%{name}%{?_isa} = %{version}-%{release}
 Requires:	freetype-devel >= %{freetype_version}
 Requires:	pkgconfig
-Requires:	gettext

 %description	devel
 The fontconfig-devel package includes the header files,
@ -63,6 +52,7 @@ will use fontconfig.

 %package	devel-doc
 Summary:	Development Documentation files for fontconfig library
+Group:		Documentation
 BuildArch:	noarch
 Requires:	%{name}-devel = %{version}-%{release}

@ -71,73 +61,42 @@ The fontconfig-devel-doc package contains the documentation files
 which is useful for developing applications that uses fontconfig.

 %prep
-%autosetup -p1
-# To reduce a maintenance cost of fontconfig-lower-nonlatin-conf.patch
-mv conf.d/65-nonlatin.conf conf.d/69-nonlatin.conf
+%setup -q
+%patch0 -p1 -b .sleep-less
+%patch1 -p1 -b .lock-cache
+%patch2 -p1 -b .validate-offset

 %build
-%meson -Ddoc=disabled -Dcache-build=disabled -Dxml-backend=libxml2 \
-       -Dadditional-fonts-dirs=/usr/share/X11/fonts/Type1,/usr/share/X11/fonts/TTF,/usr/local/share/fonts \
-       -Dcache-dir=/usr/lib/fontconfig/cache \
-       --default-library=shared
-%meson_build
+# We don't want to rebuild the docs, but we want to install the included ones.
+export HASDOCBOOK=no
+
+%configure	--with-add-fonts=/usr/share/X11/fonts/Type1,/usr/share/X11/fonts/TTF,/usr/local/share/fonts \
+		--disable-static
+
+make %{?_smp_mflags}

 %install
-%meson_install
+make install DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
+
+find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'

 install -p -m 0644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/fonts/conf.d
 ln -s %{_fontconfig_templatedir}/25-unhint-nonlatin.conf $RPM_BUILD_ROOT%{_fontconfig_confdir}/

-# Use implied value to allow the use of conditional conf
-rm $RPM_BUILD_ROOT%{_sysconfdir}/fonts/conf.d/10-sub-pixel-*.conf
-
-# Do not enable bitmap-related conf
-rm $RPM_BUILD_ROOT%{_sysconfdir}/fonts/conf.d/70-*bitmaps*.conf
-
-# Install docs manually
-install -d $RPM_BUILD_ROOT%{_mandir}/man1
-install -d $RPM_BUILD_ROOT%{_mandir}/man3
-install -d $RPM_BUILD_ROOT%{_mandir}/man5
-for f in doc/*.1; do
-  install -p -m 0644 $f $RPM_BUILD_ROOT%{_mandir}/man1
-done
-for f in doc/*.3; do
-  install -p -m 0644 $f $RPM_BUILD_ROOT%{_mandir}/man3
-done
-for f in doc/*.5; do
-  install -p -m 0644 $f $RPM_BUILD_ROOT%{_mandir}/man5
-done
-for f in doc/*.txt doc/*.pdf doc/*.html; do
-  install -p -m 0644 $f .
-done
-
-# adjust the timestamp to avoid conflicts for multilib
-touch -r doc/fontconfig-user.sgml fontconfig-user.txt
-touch -r doc/fontconfig-user.sgml fontconfig-user.html
-touch -r doc/fontconfig-devel.sgml fontconfig-devel.txt
-touch -r doc/fontconfig-devel.sgml fontconfig-devel.html
-
-# rename fc-cache binary
-mv $RPM_BUILD_ROOT%{_bindir}/fc-cache $RPM_BUILD_ROOT%{_bindir}/fc-cache-%{__isa_bits}
-
-# create link to man page
-echo ".so man1/fc-cache.1" > $RPM_BUILD_ROOT%{_mandir}/man1/fc-cache-%{__isa_bits}.1
-
-install -p -m 0755 %{SOURCE2} $RPM_BUILD_ROOT%{_bindir}/fc-cache
-
-%find_lang %{name}
-%find_lang %{name}-conf
-cat %{name}-conf.lang >> %{name}.lang
+# move installed doc files back to build directory to package themm
+# in the right place
+mv $RPM_BUILD_ROOT%{_docdir}/fontconfig/* .
+rmdir $RPM_BUILD_ROOT%{_docdir}/fontconfig/

 %check
-%meson_test
+make check

 %post
+/sbin/ldconfig
+
 umask 0022

-mkdir -p /usr/lib/fontconfig/cache
-
-[[ -d %{_localstatedir}/cache/fontconfig ]] && rm -rf %{_localstatedir}/cache/fontconfig/* 2> /dev/null || :
+mkdir -p %{_localstatedir}/cache/fontconfig

 # Force regeneration of all fontconfig cache files
 # The check for existance is needed on dual-arch installs (the second
@ -147,34 +106,15 @@ if [ -x /usr/bin/fc-cache ] && /usr/bin/fc-cache --version 2>&1 | grep -q %{vers
  HOME=/root /usr/bin/fc-cache -f
 fi

-%transfiletriggerin -- /usr/share/fonts /usr/share/X11/fonts/Type1 /usr/share/X11/fonts/TTF /usr/local/share/fonts
-HOME=/root /usr/bin/fc-cache -s
+%postun -p /sbin/ldconfig

-%transfiletriggerpostun -- /usr/share/fonts /usr/share/X11/fonts/Type1 /usr/share/X11/fonts/TTF /usr/local/share/fonts
-HOME=/root /usr/bin/fc-cache -s
-
-%posttrans
-if [ -e %{_sysconfdir}/xml/catalog ]; then
-  %{_bindir}/xmlcatalog --noout --add system \
-                        "urn:fontconfig:fonts.dtd" \
-                        "file://%{_datadir}/xml/fontconfig/fonts.dtd" \
-                        %{_sysconfdir}/xml/catalog
-fi
-
-%postun
-if [ $1 == 0 ] && [ -e %{_sysconfdir}/xml/catalog ]; then
-  %{_bindir}/xmlcatalog --noout --del "urn:fontconfig:fonts.dtd" %{_sysconfdir}/xml/catalog
-fi
-
-%files -f %{name}.lang
-%doc README.md AUTHORS
+%files
+%doc README AUTHORS COPYING
 %doc fontconfig-user.txt fontconfig-user.html
 %doc %{_fontconfig_confdir}/README
-%license COPYING
 %{_libdir}/libfontconfig.so.*
-%{_bindir}/fc-cache*
+%{_bindir}/fc-cache
 %{_bindir}/fc-cat
-%{_bindir}/fc-conflist
 %{_bindir}/fc-list
 %{_bindir}/fc-match
 %{_bindir}/fc-pattern
@ -187,8 +127,7 @@ fi
 # If you want to do so, you should use local.conf instead.
 %config %{_fontconfig_masterdir}/fonts.conf
 %config(noreplace) %{_fontconfig_confdir}/*.conf
-%dir /usr/lib/fontconfig
-%dir /usr/lib/fontconfig/cache
+%dir %{_localstatedir}/cache/fontconfig
 %{_mandir}/man1/*
 %{_mandir}/man5/*

@ -197,334 +136,13 @@ fi
 %{_libdir}/pkgconfig/*
 %{_includedir}/fontconfig
 %{_mandir}/man3/*
-%{_datadir}/gettext/its/fontconfig.its
-%{_datadir}/gettext/its/fontconfig.loc

 %files devel-doc
-%doc fontconfig-devel.txt fontconfig-devel.html
+%doc fontconfig-devel.txt fontconfig-devel

 %changelog
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jun 30 2025 Akira TAGOH <tagoh@redhat.com> - 2.17.0-2
- Backport a patch to fix a crash with Graphite fonts
- Drop 70-*bitmaps*.conf from /etc/fonts/conf.d so far.
-  Resolves: rhbz#2375426
-
-* Fri Jun 27 2025 Akira TAGOH <tagoh@redhat.com> - 2.17.0-1
- New upstream release.
-  Resolves: rhbz#2375126
-
-* Fri Apr 11 2025 Akira TAGOH <tagoh@redhat.com> - 2.16.2-1
- New upstream release.
-
-* Thu Mar 13 2025 Akira TAGOH <tagoh@redhat.com> - 2.16.1-1
- New upstream release.
-
-* Mon Jan 27 2025 Akira TAGOH <tagoh@redhat.com> - 2.16.0-2
- Fix endian detection.
-  Resolves: rhbz#2341757
-
-* Sat Jan 18 2025 Akira TAGOH <tagoh@redhat.com> - 2.16.0-1
- New upstream release.
-  Resolves: rhbz#2338618
- Use meson instead of autotools to build.
- Disable meson test on s390x temporarily.
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.15.0-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Thu Aug  1 2024 Akira TAGOH <tagoh@redhat.com> - 2.15.0-8
- Fix a memory leak and potentially uninitialized values.
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.15.0-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Fri Jun  7 2024 Akira TAGOH <tagoh@redhat.com> - 2.15.0-6
- Own /usr/lib/fontconfig
-  Resolves: rhbz#2284076
-
-* Mon Apr 29 2024 Michael Kuhn <suraia@fedoraproject.org> - 2.15.0-5
- Fix emoji fonts being disabled when bitmap fonts were disabled
-
-* Sat Feb 10 2024 Akira TAGOH <tagoh@redhat.com> - 2.15.0-4
- Delete .uuid with fc-cache -f.
-  Resolves: rhbz#1761885
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.15.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.15.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Dec 22 2023 Akira TAGOH <tagoh@redhat.com> - 2.15.0-1
- New upstream release.
-  Resolves: rhbz#2255623
-
-* Thu Aug 17 2023 Akira TAGOH <tagoh@redhat.com> - 2.14.2-5
- Update 65-nonlatin.conf to 69-nonlatin.conf
-  This basically provides substitutes for certain languages and is helpful
-  to determine default behavior though, we have per-package config for similar purpose.
-  Since 65 is mostly used for default fonts and this config prevents some behavior for
-  packages named something coming later than "nonlatin" in the alphabetical order.
-  So moving this to the safer priority.
-  This would fixes an issue, particularly Lohit Marathi vs Lohit Devanagari after
-  updating their priorities from 65 to 66.
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.14.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Jun 16 2023 Akira TAGOH <tagoh@redhat.com> - 2.14.2-3
- Drop 10-sub-pixel-rgb-for-kde.conf
-  Resolves: rhbz#2212512
-
-* Tue Apr  4 2023 Akira TAGOH <tagoh@redhat.com> - 2.14.2-2
- Migrated license tag to SPDX.
-
-* Fri Jan 27 2023 Akira TAGOH <tagoh@redhat.com> - 2.14.2-1
- New upstream release.
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.14.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Nov 26 2022 Akira TAGOH <tagoh@redhat.com> - 2.14.1-2
- Enable RGB stripes layout for sub-pixel rendering on KDE only.
-  Resolves: rhbz#2137825
-
-* Fri Oct 21 2022 Akira TAGOH <tagoh@redhat.com> - 2.14.1-1
- New upstream release.
-
-* Wed Sep 28 2022 Akira TAGOH <tagoh@redhat.com> - 2.14.0-3
- Remap font paths to other place properly.
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.14.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Mar 31 2022 Akira TAGOH <tagoh@redhat.com> - 2.14.0-1
- New upstream release.
-
-* Fri Feb  4 2022 Akira TAGOH <tagoh@redhat.com> - 2.13.96-1
- New upstream release.
- Fix missing a file in the archive.
-  Resolves: rhbz#2050478
-
-* Tue Feb  1 2022 Akira TAGOH <tagoh@redhat.com> - 2.13.95-1
- New upstream release.
- Update deps to font(notosans)
-  https://fedoraproject.org/wiki/Changes/DefaultToNotoFonts
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.94-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.94-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jul 20 2021 Akira TAGOH <tagoh@redhat.com> - 2.13.94-2
- Fix the score calculation on matching for multiple values.
- Enable 11-lcdfilter-default.conf.
-  Resolves: rhbz#1965684
-
-* Tue Jun 29 2021 Akira TAGOH <tagoh@redhat.com> - 2.13.94-1
- New upstream release.
-
-* Thu Mar 25 2021 Akira TAGOH <tagoh@redhat.com> - 2.13.93-6
- Fix postun scriptlet to remove the entry from xml catalog.
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.93-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Dec 23 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.93-4
- cherry pick some upstream patches
-  - Skip leading white space in style.
-  - Remove abort from FcCompareSize.
-  - Fix memory leaks
-  - Check qual and compare for family tests.
- 
-* Thu Dec  3 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.93-3
- Add back fullname property at the scan matching phase for the backward compatibility.
-  Resolves: rhbz#1902881
-
-* Mon Nov 30 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.93-2
- Fix file conflicts.
-
-* Sat Nov 28 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.93-1
- New upstream release.
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.92-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu Apr 23 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-11
- deal with system caches as always latest on Silverblue. (#1750891)
-
-* Thu Apr 02 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-10
- Build against libxml2 instead of expat.
-
-* Sat Mar 28 2020 Nicolas Mailhot <nim@fedoraproject.org> - 2.13.92-9
- Fix DTD declaration and registration so users and Fedora automation can
-  easily validate new configuration files
-
-* Mon Mar 23 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-8
- Fix assertion in FcCacheFini() again.
-  Resolves: rhbz#1815684
-
-* Wed Feb 26 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-7
- Fix assertion in FcCacheFini().
-
-* Thu Jan 30 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-6
- Fix some wrong behavior with sysroot option.
- Fix reading the outdated caches.
- Apply a patch to make it MT-safe more.
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.92-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Mon Jan 20 2020 Akira TAGOH <tagoh@redhat.com> - 2.13.92-4
- Drop font(:lang=...) from %%{=pkgkit} format.
-  Reference: rhbz#1792463
-
-* Wed Aug 28 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.92-3
- Do not return false on FcConfigParseAndLoad*() if complain is set to false.
-  Resolves: rhbz#1744377
-
-* Fri Aug  9 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.92-2
- Fix to affect fonthashint property for score on match.
-
-* Fri Aug  9 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.92-1
- New upstream release.
-
-* Wed Jul 31 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.91-4
- Fix make check fails.
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.91-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Sun Jun 16 2019 Tim Landscheidt <tim@tim-landscheidt.de> - 2.13.91-2
- Remove calls to ldconfig from scriptlets
- Use "PreReq" instead of "Requires(pre)" for freetype
-
-* Mon Jun 10 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.91-1
- New upstream release.
-
-* Fri Feb 22 2019 Akira TAGOH <tagoh@redhat.com> - 2.13.1-6
- Update freetype version for runtime dependency to ensure
-  they have FT_Done_MM_Var symbol certainly. (#1679619)
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Nov 13 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.1-4
- Use Rachana instead of Meera for serif subsitution. (#1649184)
-
-* Wed Nov 07 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.1-3
- Stop cleaning up .uuid file even when a directory is empty.
-
-* Wed Sep 26 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.1-2
- Add man page for fc-cache-* links to fc-cache.
- Drop unnecessary BR.
-
-* Thu Aug 30 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.1-1
- New upstream release.
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.0-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Fri Jun 29 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-7
- Use ldconfig rpm macro.
-
-* Thu Jun 07 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-6
- Add Suggests: dejavu-sans-fonts to address pulling the unpredicted
-  font package as dependency. (#1321551)
-
-* Wed Jun 06 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-5
- Update the version deps of freetype to resolve FT_Done_MM_Var symbol. (#1579464)
-
-* Fri May 11 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-4
- Fix the emboldening logic. (#1575649)
-
-* Thu Mar 15 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-3
- Another fix to accept the const names in param.
- Fix locale issue.
-
-* Mon Mar 12 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-2
- Allow the const names in the range.
-
-* Tue Mar 06 2018 Akira TAGOH <tagoh@redhat.com> - 2.13.0-1
- New upstream release.
-
-* Thu Feb 15 2018 Akira TAGOH <tagoh@redhat.com> - 2.12.93-1
- New upstream release.
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.92-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Jan  4 2018 Akira TAGOH <tagoh@redhat.com> - 2.12.92-1
- New upstream release.
- Fix the mis-ordering of evaluating config. (#1530211)
-
-* Sat Dec 23 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.91-2
- Fix crash (#1528706)
-
-* Thu Dec 14 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.91-1
- New upstream release.
-
-* Wed Nov  8 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.6-4
- Remove the debug print in fc-query. (#1509790)
-
-* Thu Oct  5 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.6-3
- Backport a patch to change the order of the emoji fonts. (#1496761)
-
-* Tue Oct  3 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.6-2
- Bump the release to address the upgrade path issue.
-
-* Thu Sep 21 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.6-1
- New upstream release.
-
-* Sat Sep  9 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.5-1
- New upstream release.
-
-* Mon Jul 31 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.4-4
- Fix exiting with 1 on 32bit arch. (#1476831)
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Mon Jul 24 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.4-2
- Allow installing 32/64 bit version of fc-cache at the same time. (#1474257)
- Add fc-cache script to invoke both version of fc-cache if available.
-
-* Wed Jul  5 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.4-1
- New upstream release.
-
-* Wed May 31 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.3-1
- New upstream release.
-
-* Thu Feb 23 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.1-4
- Move the cache files into /usr/lib/fontconfig/cache (#1377367, #1416380)
-
-* Wed Feb 22 2017 Akira TAGOH <tagoh@redhat.com> - 2.12.1-3
- Fix FTBFS (#1423570)
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Fri Aug  5 2016 Akira TAGOH <tagoh@redhat.com> - 2.12.1-1
- New upstream release.
-
-* Wed Jun 15 2016 Akira TAGOH <tagoh@redhat.com> - 2.12.0-1
- New upstream release.
-
-* Tue Apr 12 2016 Akira TAGOH <tagoh@redhat.com> - 2.11.95-1
- New upstream release. (#1325560)
-
-* Mon Mar 28 2016 Akira TAGOH <tagoh@redhat.com> - 2.11.94-7
- Add Requires: freetype.
-
-* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.94-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Mon Sep  7 2015 Akira TAGOH <tagoh@redhat.com> - 2.11.94-5
- Add file triggers for fonts.
+* Fri Aug  5 2016 Akira TAGOH <tagoh@redhat.com> - 2.11.94-5
+- CVE-2016-5384: Validate offsets in cache files properly. (#1364439)

 * Fri Aug 14 2015 Akira TAGOH <tagoh@redhat.com> - 2.11.94-4
 - Revise the patch. (#1236034)
--- a/plans/basic.fmf
+++ b/plans/basic.fmf
@ -1,5 +0,0 @@
-summary: Basic smoke test
-discover:
-    how: fmf
-execute:
-    how: tmt
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (fontconfig-2.17.0.tar.xz) = dd64905c3e0e5c5881df505b8f0bea594bbac5ce145f57aedcd7130978cd285491497198d8f2d6ed26f7b2abb31268dc3ff97aa75ce998b8e57f2d5c75b240b4
+c988ea12f4117330246e041109152b4a  fontconfig-2.11.94.tar.bz2
--- a/tests/basic/main.fmf
+++ b/tests/basic/main.fmf
@ -1,3 +0,0 @@
-summary: Concise summary describing what the test does
-test: ./test.sh
-framework: beakerlib
--- a/tests/basic/test.sh
+++ b/tests/basic/test.sh
@ -1,22 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
-        rlRun "pushd $tmp"
-        rlRun "set -o pipefail"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "fc-match" 0 "Check fc-match"
-	rlRun "fc-list" 0 "Check fc-list"
-	rlRun "fc-scan /usr/share/fonts" 0 "Check fc-scan"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "popd"
-        rlRun "rm -r $tmp" 0 "Remove tmp directory"
-    rlPhaseEnd
-rlJournalEnd