diff --git a/freetype-2.11.0-avoid-invalid-face-index.patch b/freetype-2.11.0-avoid-invalid-face-index.patch new file mode 100644 index 0000000..55c09bd --- /dev/null +++ b/freetype-2.11.0-avoid-invalid-face-index.patch @@ -0,0 +1,43 @@ +From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Thu, 17 Mar 2022 19:24:16 +0100 +Subject: [PATCH] [sfnt] Avoid invalid face index. + +Fixes #1138. + +* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): +Check `face_index` before decrementing. +--- + src/sfnt/sfobjs.c | 2 +- + src/sfnt/sfwoff2.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c +index f9d4d3858..9771c35df 100644 +--- a/src/sfnt/sfobjs.c ++++ b/src/sfnt/sfobjs.c +@@ -566,7 +566,7 @@ + face_index = FT_ABS( face_instance_index ) & 0xFFFF; + + /* value -(N+1) requests information on index N */ +- if ( face_instance_index < 0 ) ++ if ( face_instance_index < 0 && face_index > 0 ) + face_index--; + + if ( face_index >= face->ttc_header.count ) +diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c +index cb1e0664a..165b875e5 100644 +--- a/src/sfnt/sfwoff2.c ++++ b/src/sfnt/sfwoff2.c +@@ -2085,7 +2085,7 @@ + /* Validate requested face index. */ + *num_faces = woff2.num_fonts; + /* value -(N+1) requests information on index N */ +- if ( *face_instance_index < 0 ) ++ if ( *face_instance_index < 0 && face_index > 0 ) + face_index--; + + if ( face_index >= woff2.num_fonts ) +-- +2.35.1 + diff --git a/freetype-2.11.0-guard-face-size.patch b/freetype-2.11.0-guard-face-size.patch new file mode 100644 index 0000000..8a447ae --- /dev/null +++ b/freetype-2.11.0-guard-face-size.patch @@ -0,0 +1,27 @@ +From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:37:28 +0100 +Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. + +Fixes #1140. +--- + src/base/ftobjs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 6492a1517..282c9121a 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -3409,6 +3409,9 @@ + if ( !face ) + return FT_THROW( Invalid_Face_Handle ); + ++ if ( !face->size ) ++ return FT_THROW( Invalid_Size_Handle ); ++ + if ( !req || req->width < 0 || req->height < 0 || + req->type >= FT_SIZE_REQUEST_TYPE_MAX ) + return FT_THROW( Invalid_Argument ); +-- +2.35.1 + diff --git a/freetype-2.11.0-no-op-rendering.patch b/freetype-2.11.0-no-op-rendering.patch new file mode 100644 index 0000000..d089019 --- /dev/null +++ b/freetype-2.11.0-no-op-rendering.patch @@ -0,0 +1,41 @@ +From 6e9d8d314ff6ab23177b9162c0b96616460bb84e Mon Sep 17 00:00:00 2001 +From: Alexei Podtelezhnikov +Date: Fri, 20 Aug 2021 16:01:32 -0400 +Subject: [PATCH] [base] Restore quiet no-op rendering of bitmap glyphs. + +Fixes #1076. + +* src/base/ftobjs.c (FT_Render_Glyph_Internal): Discard an error when +rendering a bitmap glyph. +--- + src/base/ftobjs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 342ac4a27..7b40c6421 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -4703,7 +4703,7 @@ + else + renderer = FT_Lookup_Renderer( library, slot->format, &node ); + +- error = FT_ERR( Unimplemented_Feature ); ++ error = FT_ERR( Cannot_Render_Glyph ); + while ( renderer ) + { + error = renderer->render( renderer, slot, render_mode, NULL ); +@@ -4719,6 +4719,11 @@ + /* format. */ + renderer = FT_Lookup_Renderer( library, slot->format, &node ); + } ++ ++ /* it is not an error if we cannot render a bitmat glyph */ ++ if ( FT_ERR_EQ( error, Cannot_Render_Glyph ) && ++ slot->format == FT_GLYPH_FORMAT_BITMAP ) ++ error = FT_Err_Ok; + } + } + +-- +2.34.1 + diff --git a/freetype-2.11.0-properly-guard-face_index.patch b/freetype-2.11.0-properly-guard-face_index.patch new file mode 100644 index 0000000..92ae817 --- /dev/null +++ b/freetype-2.11.0-properly-guard-face_index.patch @@ -0,0 +1,46 @@ +From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 06:40:17 +0100 +Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard + `face_index`. + +We must ensure that the cast to `FT_Int` doesn't change the sign. + +Fixes #1139. +--- + src/base/ftobjs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 19 Mar 2022 09:30:45 +0100 +Subject: [PATCH 2/2] * src/base/ftobjs.c (ft_open_face_internal): Thinko. + +--- + src/base/ftobjs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c +index 2c0f0e6c9..10952a6c6 100644 +--- a/src/base/ftobjs.c ++++ b/src/base/ftobjs.c +@@ -2527,6 +2527,16 @@ + #endif + + ++ /* only use lower 31 bits together with sign bit */ ++ if ( face_index > 0 ) ++ face_index &= 0x7FFFFFFFL; ++ else ++ { ++ face_index = -face_index; ++ face_index &= 0x7FFFFFFFL; ++ face_index = -face_index; ++ } ++ + #ifdef FT_DEBUG_LEVEL_TRACE + FT_TRACE3(( "FT_Open_Face: " )); + if ( face_index < 0 ) +-- +2.35.1 + diff --git a/freetype.spec b/freetype.spec index 74c1069..d8967ab 100644 --- a/freetype.spec +++ b/freetype.spec @@ -4,7 +4,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.11.0 -Release: 1%{?dist} +Release: 6%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org Source: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.xz @@ -27,6 +27,14 @@ Patch5: freetype-2.10.0-internal-outline.patch # Revert ABI/API change Patch6: freetype-2.10.1-debughook.patch +Patch7: freetype-2.11.0-no-op-rendering.patch + +Patch8: freetype-2.11.0-avoid-invalid-face-index.patch + +Patch9: freetype-2.11.0-properly-guard-face_index.patch + +Patch10: freetype-2.11.0-guard-face-size.patch + BuildRequires: gcc BuildRequires: libX11-devel BuildRequires: libpng-devel @@ -89,6 +97,10 @@ popd %patch4 -p1 -b .multilib %patch5 -p1 -b .internal-outline %patch6 -p1 -b .debughook +%patch7 -p1 -b .no-op-rendering +%patch8 -p1 -b .avoid-invalid-face-index +%patch9 -p1 -b .properly-guard-face_index +%patch10 -p1 -b .guard-face-size %build @@ -230,6 +242,26 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Tue May 3 2022 Marek Kasik - 2.11.0-6 +- Guard face->size +- Resolves: #2079181 + +* Tue May 3 2022 Marek Kasik - 2.11.0-5 +- Properly guard "face_index" +- Resolves: #2079255 + +* Tue May 3 2022 Marek Kasik - 2.11.0-4 +- Avoid invalid face index +- Resolves: #2079203 + +* Fri Jan 21 2022 Diego Herrera - 2.11.0-3 +- Apply no-op-rendering patch +- Resolves: #2043396 + +* Fri Jan 21 2022 Marek Kasik - 2.11.0-2 +- Discard an error when rendering a bitmap glyph +- Resolves: #2043396 + * Thu Jul 22 2021 Marek Kasik - 2.11.0-1 - Update to 2.11.0