From b887d673c8bd3d6b1d956daa93294354850eb1d2 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Tue, 28 Oct 2025 08:11:02 +0530 Subject: [PATCH 1/2] Resolves: CVE-2025-50949 and CVE-2025-50951 --- fix_memleak_in_function_DlgCreate8-5491.patch | 31 +++++++++++++++++++ ...eak_in_function_utf7toutf8_copy-5495.patch | 21 +++++++++++++ fontforge.spec | 9 +++++- 3 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 fix_memleak_in_function_DlgCreate8-5491.patch create mode 100644 fix_memleak_in_function_utf7toutf8_copy-5495.patch diff --git a/fix_memleak_in_function_DlgCreate8-5491.patch b/fix_memleak_in_function_DlgCreate8-5491.patch new file mode 100644 index 0000000..9af06f8 --- /dev/null +++ b/fix_memleak_in_function_DlgCreate8-5491.patch @@ -0,0 +1,31 @@ +From 701e4d7569d6bd777704ab3364d7d1c519d89a91 Mon Sep 17 00:00:00 2001 +From: zhailiangliang +Date: Mon, 4 Nov 2024 08:56:07 +0000 +Subject: [PATCH] fix memleak in function DlgCreate8 + +--- + gdraw/gaskdlg.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/gdraw/gaskdlg.c b/gdraw/gaskdlg.c +index 3563361796..8178be14c8 100644 +--- a/gdraw/gaskdlg.c ++++ b/gdraw/gaskdlg.c +@@ -209,12 +209,13 @@ static GWindow DlgCreate8(const char *title,const char *question,va_list ap, + extern GBox _GGadget_defaultbutton_box; + + if ( d!=NULL ) +- memset(d,0,sizeof(*d)); ++ memset(d,0,sizeof(*d)); + buf = vsmprintf(question, ap); + if ( screen_display==NULL ) { +- fprintf(stderr, "%s\n", buf ); +- if ( d!=NULL ) d->done = true; +-return( NULL ); ++ fprintf(stderr, "%s\n", buf); ++ if ( d!=NULL ) d->done = true; ++ free(buf); ++ return( NULL ); + } + ubuf = utf82u_copy(buf); + free(buf); diff --git a/fix_memleak_in_function_utf7toutf8_copy-5495.patch b/fix_memleak_in_function_utf7toutf8_copy-5495.patch new file mode 100644 index 0000000..90493c2 --- /dev/null +++ b/fix_memleak_in_function_utf7toutf8_copy-5495.patch @@ -0,0 +1,21 @@ +From 68c3802c1492c85cea35a2dcaeaada85cbb23c6f Mon Sep 17 00:00:00 2001 +From: zhailiangliang +Date: Wed, 13 Nov 2024 03:28:52 +0000 +Subject: [PATCH] fix memleak in function utf7toutf8_copy + +--- + fontforge/sfd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fontforge/sfd.c b/fontforge/sfd.c +index 4a38be915f..00ee231a34 100644 +--- a/fontforge/sfd.c ++++ b/fontforge/sfd.c +@@ -449,6 +449,7 @@ return( NULL ); + + ucs2_str = (unichar_t *) malloc((strlen(_str)+1)*sizeof(unichar_t)); + utf162u_strcpy(ucs2_str, utf16buf); ++ free(utf16buf); + utf8_buf = u2utf8_copy(ucs2_str); /* Convert from ucs2 to utf8 */ + free(ucs2_str); + diff --git a/fontforge.spec b/fontforge.spec index 63dbc4f..04fe4d8 100644 --- a/fontforge.spec +++ b/fontforge.spec @@ -2,7 +2,7 @@ Name: fontforge Version: 20230101 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Outline and bitmap font editor License: GPL-3.0-or-later @@ -14,6 +14,10 @@ Patch0: 0001-Fix-errors-in-French-and-Italian-translations.patch # Fixes CVE-2024-25081 and CVE-2024-25082 Patch1: https://patch-diff.githubusercontent.com/raw/fontforge/fontforge/pull/5367.patch#/Fix_Splinefont_shell_invocation.patch Patch2: pyconfig.patch +# https://github.com/fontforge/fontforge/pull/5491 +Patch3: fix_memleak_in_function_DlgCreate8-5491.patch +# https://github.com/fontforge/fontforge/pull/5495 +Patch4: fix_memleak_in_function_utf7toutf8_copy-5495.patch Requires: xdg-utils Requires: (autotrace or potrace) @@ -132,6 +136,9 @@ popd %doc %{_pkgdocdir} %changelog +* Tue Oct 28 2025 Parag Nemade - 20230101-16 +- Resolves: CVE-2025-50949 and CVE-2025-50951 + * Thu Jan 16 2025 Fedora Release Engineering - 20230101-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 832420b909aca372652f551c871776cf4513bc68 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Tue, 28 Oct 2025 13:39:43 +0530 Subject: [PATCH 2/2] Move to use %autosetup macro so that we will not forget to apply patches --- ...eak_in_function_utf7toutf8_copy-5495.patch | 21 ------------------- fontforge.spec | 16 +++++++------- pyconfig.patch | 8 +++---- 3 files changed, 11 insertions(+), 34 deletions(-) delete mode 100644 fix_memleak_in_function_utf7toutf8_copy-5495.patch diff --git a/fix_memleak_in_function_utf7toutf8_copy-5495.patch b/fix_memleak_in_function_utf7toutf8_copy-5495.patch deleted file mode 100644 index 90493c2..0000000 --- a/fix_memleak_in_function_utf7toutf8_copy-5495.patch +++ /dev/null @@ -1,21 +0,0 @@ -From 68c3802c1492c85cea35a2dcaeaada85cbb23c6f Mon Sep 17 00:00:00 2001 -From: zhailiangliang -Date: Wed, 13 Nov 2024 03:28:52 +0000 -Subject: [PATCH] fix memleak in function utf7toutf8_copy - ---- - fontforge/sfd.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fontforge/sfd.c b/fontforge/sfd.c -index 4a38be915f..00ee231a34 100644 ---- a/fontforge/sfd.c -+++ b/fontforge/sfd.c -@@ -449,6 +449,7 @@ return( NULL ); - - ucs2_str = (unichar_t *) malloc((strlen(_str)+1)*sizeof(unichar_t)); - utf162u_strcpy(ucs2_str, utf16buf); -+ free(utf16buf); - utf8_buf = u2utf8_copy(ucs2_str); /* Convert from ucs2 to utf8 */ - free(ucs2_str); - diff --git a/fontforge.spec b/fontforge.spec index 04fe4d8..9826592 100644 --- a/fontforge.spec +++ b/fontforge.spec @@ -2,7 +2,7 @@ Name: fontforge Version: 20230101 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Outline and bitmap font editor License: GPL-3.0-or-later @@ -16,8 +16,6 @@ Patch1: https://patch-diff.githubusercontent.com/raw/fontforge/fontforge Patch2: pyconfig.patch # https://github.com/fontforge/fontforge/pull/5491 Patch3: fix_memleak_in_function_DlgCreate8-5491.patch -# https://github.com/fontforge/fontforge/pull/5495 -Patch4: fix_memleak_in_function_utf7toutf8_copy-5495.patch Requires: xdg-utils Requires: (autotrace or potrace) @@ -76,10 +74,7 @@ This package contains documentation files for %{name}. %prep -%setup -q -%patch -P 0 -p1 -%patch -P 1 -p1 -%patch -P 2 -p0 +%autosetup -p1 # Remove tests that requires Internet access sed -i '45d;82d;101d;127d' tests/CMakeLists.txt @@ -136,8 +131,11 @@ popd %doc %{_pkgdocdir} %changelog -* Tue Oct 28 2025 Parag Nemade - 20230101-16 -- Resolves: CVE-2025-50949 and CVE-2025-50951 +* Tue Oct 28 2025 Parag Nemade - 20230101-17 +- Move to use %%autosetup macro so that we will not forget to apply patches + +* Mon Oct 27 2025 Parag Nemade - 20230101-16 +- Resolves: CVE-2025-50949 * Thu Jan 16 2025 Fedora Release Engineering - 20230101-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/pyconfig.patch b/pyconfig.patch index cfd90f4..628902e 100644 --- a/pyconfig.patch +++ b/pyconfig.patch @@ -1,5 +1,5 @@ ---- pycontrib/FontCompare/setup.py~ 2022-12-31 23:25:21.000000000 -0600 -+++ pycontrib/FontCompare/setup.py 2024-06-14 15:14:14.119920623 -0500 +--- fontforge/pycontrib/FontCompare/setup.py~ 2022-12-31 23:25:21.000000000 -0600 ++++ fontforge/pycontrib/FontCompare/setup.py 2024-06-14 15:14:14.119920623 -0500 @@ -15,7 +15,6 @@ along with this program. If not, see . """ @@ -8,8 +8,8 @@ from setuptools import setup setup(name='Font Compare', version='1.0', ---- fontforge/python.c~ 2022-12-31 23:25:21.000000000 -0600 -+++ fontforge/python.c 2024-06-14 15:38:41.397897757 -0500 +--- fontforge/fontforge/python.c~ 2022-12-31 23:25:21.000000000 -0600 ++++ fontforge/fontforge/python.c 2024-06-14 15:38:41.397897757 -0500 @@ -19633,7 +19633,10 @@ if ( saved_progname ) free(saved_progname);