From 08b417b2fcd3ad0610132b2c7349d680a0ad8358 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Tue, 2 May 2017 15:13:32 +0200 Subject: [PATCH 1/6] Better protect `flex' handling (CVE-2017-8105) Resolves: #1446502 --- freetype-2.7.1-protect-flex-handling.patch | 47 ++++++++++++++++++++++ freetype.spec | 12 ++++-- 2 files changed, 56 insertions(+), 3 deletions(-) create mode 100644 freetype-2.7.1-protect-flex-handling.patch diff --git a/freetype-2.7.1-protect-flex-handling.patch b/freetype-2.7.1-protect-flex-handling.patch new file mode 100644 index 0000000..01ff261 --- /dev/null +++ b/freetype-2.7.1-protect-flex-handling.patch @@ -0,0 +1,47 @@ +From f958c48ee431bef8d4d466b40c9cb2d4dbcb7791 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Fri, 24 Mar 2017 09:15:10 +0100 +Subject: [PATCH] [psaux] Better protect `flex' handling. + +Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 + +* src/psaux/t1decode.c (t1_decoder_parse_charstrings) +: Since there is not a single flex operator but a +series of subroutine calls, malformed fonts can call arbitrary other +operators after the start of a flex, possibly adding points. For +this reason we have to check the available number of points before +inserting a point. +--- + ChangeLog | 15 +++++++++++++++ + src/psaux/t1decode.c | 9 +++++++++ + 2 files changed, 24 insertions(+) + +diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c +index af7b465e..7dd45135 100644 +--- a/src/psaux/t1decode.c ++++ b/src/psaux/t1decode.c +@@ -780,10 +780,19 @@ + /* point without adding any point to the outline */ + idx = decoder->num_flex_vectors++; + if ( idx > 0 && idx < 7 ) ++ { ++ /* in malformed fonts it is possible to have other */ ++ /* opcodes in the middle of a flex (which don't */ ++ /* increase `num_flex_vectors'); we thus have to */ ++ /* check whether we can add a point */ ++ if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) ) ++ goto Syntax_Error; ++ + t1_builder_add_point( builder, + x, + y, + (FT_Byte)( idx == 3 || idx == 6 ) ); ++ } + } + break; + +-- +2.12.2 + diff --git a/freetype.spec b/freetype.spec index 21d2261..4c39631 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 4%{?dist} +Release: 5%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -31,6 +31,9 @@ Patch92: freetype-2.5.3-freetype-config-prefix.patch Patch93: freetype-2.6.5-libtool.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1446500 +Patch94: freetype-2.7.1-protect-flex-handling.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -89,10 +92,9 @@ pushd ft2demos-%{version} popd %patch88 -p1 -b .multilib - %patch92 -p1 -b .freetype-config-prefix - %patch93 -p1 -b .libtool +%patch94 -p1 -b .protect-flex-handling %build @@ -208,6 +210,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Tue May 2 2017 Marek Kasik - 2.7.1-5 +- Better protect `flex' handling (CVE-2017-8105) +- Resolves: #1446502 + * Mon Apr 10 2017 Marek Kasik - 2.7.1-4 - Revert previous commit - Related: #1437999 From d3647a0d5dd9e39ced0ffbe119c3078bfb86a7bf Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Tue, 2 May 2017 17:04:51 +0200 Subject: [PATCH 2/6] Add safety guard (CVE-2017-8287) Resolves: #1446075 --- freetype-2.7.1-safety-guard.patch | 36 +++++++++++++++++++++++++++++++ freetype.spec | 10 ++++++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 freetype-2.7.1-safety-guard.patch diff --git a/freetype-2.7.1-safety-guard.patch b/freetype-2.7.1-safety-guard.patch new file mode 100644 index 0000000..65ee149 --- /dev/null +++ b/freetype-2.7.1-safety-guard.patch @@ -0,0 +1,36 @@ +From 3774fc08b502c3e685afca098b6e8a195aded6a0 Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sun, 26 Mar 2017 08:32:09 +0200 +Subject: [PATCH] * src/psaux/psobjs.c (t1_builder_close_contour): Add safety + guard. + +Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 +--- + ChangeLog | 8 ++++++++ + src/psaux/psobjs.c | 8 ++++++++ + 2 files changed, 16 insertions(+) + +diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c +index d18e821a..0baf8368 100644 +--- a/src/psaux/psobjs.c ++++ b/src/psaux/psobjs.c +@@ -1718,6 +1718,14 @@ + first = outline->n_contours <= 1 + ? 0 : outline->contours[outline->n_contours - 2] + 1; + ++ /* in malformed fonts it can happen that a contour was started */ ++ /* but no points were added */ ++ if ( outline->n_contours && first == outline->n_points ) ++ { ++ outline->n_contours--; ++ return; ++ } ++ + /* We must not include the last point in the path if it */ + /* is located on the first point. */ + if ( outline->n_points > 1 ) +-- +2.12.2 + diff --git a/freetype.spec b/freetype.spec index 4c39631..8d6e79f 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 5%{?dist} +Release: 6%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -34,6 +34,9 @@ Patch93: freetype-2.6.5-libtool.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1446500 Patch94: freetype-2.7.1-protect-flex-handling.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1446073 +Patch95: freetype-2.7.1-safety-guard.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -95,6 +98,7 @@ popd %patch92 -p1 -b .freetype-config-prefix %patch93 -p1 -b .libtool %patch94 -p1 -b .protect-flex-handling +%patch95 -p1 -b .safety-guard %build @@ -210,6 +214,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Tue May 2 2017 Marek Kasik - 2.7.1-6 +- Add safety guard (CVE-2017-8287) +- Resolves: #1446075 + * Tue May 2 2017 Marek Kasik - 2.7.1-5 - Better protect `flex' handling (CVE-2017-8105) - Resolves: #1446502 From 7265f7f78408b278e800bbebeb3c6e5914d58691 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Tue, 2 May 2017 17:24:06 +0200 Subject: [PATCH 3/6] Fix numbers of tracking bugs --- freetype.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/freetype.spec b/freetype.spec index 8d6e79f..cf886f6 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 6%{?dist} +Release: 7%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -214,13 +214,16 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Tue May 2 2017 Marek Kasik - 2.7.1-7 +- Fix numbers of tracking bugs + * Tue May 2 2017 Marek Kasik - 2.7.1-6 - Add safety guard (CVE-2017-8287) -- Resolves: #1446075 +- Resolves: #1446074 * Tue May 2 2017 Marek Kasik - 2.7.1-5 - Better protect `flex' handling (CVE-2017-8105) -- Resolves: #1446502 +- Resolves: #1446501 * Mon Apr 10 2017 Marek Kasik - 2.7.1-4 - Revert previous commit From ff3dccc995e987b2036b0e3c079749ea5cae2f84 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Wed, 24 May 2017 12:47:16 +0200 Subject: [PATCH 4/6] Accept ISO646.1991-IRV as a Unicode charmap in PCF and BDF drivers Resolves: #1451795 --- freetype-2.7.1-pcf-encoding.patch | 58 +++++++++++++++++++++++++++++++ freetype.spec | 10 +++++- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 freetype-2.7.1-pcf-encoding.patch diff --git a/freetype-2.7.1-pcf-encoding.patch b/freetype-2.7.1-pcf-encoding.patch new file mode 100644 index 0000000..fd1c706 --- /dev/null +++ b/freetype-2.7.1-pcf-encoding.patch @@ -0,0 +1,58 @@ +From 082f2faf5007812bac6a1f783c7dcc6f49d761fe Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Wed, 24 May 2017 07:40:46 +0200 +Subject: [PATCH] [bdf, pcf] Support ISO646.1991-IRV character encoding (aka + ASCII). +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Marek Kašík , cf. + + https://bugzilla.redhat.com/show_bug.cgi?id=1451795 + +* src/bdf/bdfdrivr.c (BDF_Face_Init), src/pcf/pcfdrivr.c +(PCF_Face_Init): Implement it. +--- + ChangeLog | 11 +++++++++++ + src/bdf/bdfdrivr.c | 6 +++++- + src/pcf/pcfdrivr.c | 6 +++++- + 3 files changed, 21 insertions(+), 2 deletions(-) + +diff --git a/src/bdf/bdfdrivr.c b/src/bdf/bdfdrivr.c +index a2242be0..c0a5a5c5 100644 +--- a/src/bdf/bdfdrivr.c ++++ b/src/bdf/bdfdrivr.c +@@ -545,7 +545,11 @@ THE SOFTWARE. + if ( !ft_strcmp( s, "10646" ) || + ( !ft_strcmp( s, "8859" ) && + !ft_strcmp( face->charset_encoding, "1" ) ) ) +- unicode_charmap = 1; ++ unicode_charmap = 1; ++ /* another name for ASCII */ ++ else if ( !ft_strcmp( s, "646.1991" ) && ++ !ft_strcmp( face->charset_encoding, "IRV" ) ) ++ unicode_charmap = 1; + } + + { +diff --git a/src/pcf/pcfdrivr.c b/src/pcf/pcfdrivr.c +index 9f4d36d1..50530941 100644 +--- a/src/pcf/pcfdrivr.c ++++ b/src/pcf/pcfdrivr.c +@@ -387,7 +387,11 @@ THE SOFTWARE. + if ( !ft_strcmp( s, "10646" ) || + ( !ft_strcmp( s, "8859" ) && + !ft_strcmp( face->charset_encoding, "1" ) ) ) +- unicode_charmap = 1; ++ unicode_charmap = 1; ++ /* another name for ASCII */ ++ else if ( !ft_strcmp( s, "646.1991" ) && ++ !ft_strcmp( face->charset_encoding, "IRV" ) ) ++ unicode_charmap = 1; + } + } + +-- +2.13.0 + diff --git a/freetype.spec b/freetype.spec index cf886f6..88cc3ff 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 7%{?dist} +Release: 8%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -37,6 +37,9 @@ Patch94: freetype-2.7.1-protect-flex-handling.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1446073 Patch95: freetype-2.7.1-safety-guard.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1451795 +Patch96: freetype-2.7.1-pcf-encoding.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -99,6 +102,7 @@ popd %patch93 -p1 -b .libtool %patch94 -p1 -b .protect-flex-handling %patch95 -p1 -b .safety-guard +%patch96 -p1 -b .pcf-encoding %build @@ -214,6 +218,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Wed May 24 2017 Marek Kasik - 2.7.1-8 +- Accept ISO646.1991-IRV as a Unicode charmap in PCF and BDF drivers +- Resolves: #1451795 + * Tue May 2 2017 Marek Kasik - 2.7.1-7 - Fix numbers of tracking bugs From f002a31dad1b67862283ee6364dd99e07eced8a1 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Thu, 1 Jun 2017 14:09:35 +0200 Subject: [PATCH 5/6] Adjust loop counter maximum for TrueType fonts Resolves: #1456585 --- freetype-2.7.1-loop-counter.patch | 48 +++++++++++++++++++++++++++++++ freetype.spec | 10 ++++++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 freetype-2.7.1-loop-counter.patch diff --git a/freetype-2.7.1-loop-counter.patch b/freetype-2.7.1-loop-counter.patch new file mode 100644 index 0000000..4904f90 --- /dev/null +++ b/freetype-2.7.1-loop-counter.patch @@ -0,0 +1,48 @@ +--- freetype-2.7.1/src/truetype/ttinterp.c ++++ freetype-2.7.1/src/truetype/ttinterp.c +@@ -7605,21 +7605,34 @@ + exc->twilight.n_points = (FT_UShort)num_twilight_points; + } + +- /* Set up loop detectors. We restrict the number of LOOPCALL loops */ +- /* and the number of JMPR, JROT, and JROF calls with a negative */ +- /* argument to values that depend on the size of the CVT table and */ +- /* the number of points in the current glyph (if applicable). */ +- /* */ +- /* The idea is that in real-world bytecode you either iterate over */ +- /* all CVT entries, or over all points (or contours) of a glyph, and */ +- /* such iterations don't happen very often. */ ++ /* Set up loop detectors. We restrict the number of LOOPCALL loops */ ++ /* and the number of JMPR, JROT, and JROF calls with a negative */ ++ /* argument to values that depend on various parameters like the */ ++ /* size of the CVT table or the number of points in the current */ ++ /* glyph (if applicable). */ ++ /* */ ++ /* The idea is that in real-world bytecode you either iterate over */ ++ /* all CVT entries (in the `prep' table), or over all points (or */ ++ /* contours, in the `glyf' table) of a glyph, and such iterations */ ++ /* don't happen very often. */ + exc->loopcall_counter = 0; + exc->neg_jump_counter = 0; + + /* The maximum values are heuristic. */ +- exc->loopcall_counter_max = FT_MAX( 100, +- 10 * ( exc->pts.n_points + +- exc->cvtSize ) ); ++ if ( exc->pts.n_points ) ++ exc->loopcall_counter_max = FT_MAX( 50, ++ 10 * exc->pts.n_points ) + ++ FT_MAX( 50, ++ exc->cvtSize / 10 ); ++ else ++ exc->loopcall_counter_max = 300 + 8 * exc->cvtSize; ++ ++ /* as a protection against an unreasonable number of CVT entries */ ++ /* we assume at most 100 control values per glyph for the counter */ ++ if ( exc->loopcall_counter_max > ++ 100 * (FT_ULong)exc->face->root.num_glyphs ) ++ exc->loopcall_counter_max = 100 * (FT_ULong)exc->face->root.num_glyphs; ++ + FT_TRACE5(( "TT_RunIns: Limiting total number of loops in LOOPCALL" + " to %d\n", exc->loopcall_counter_max )); + diff --git a/freetype.spec b/freetype.spec index 88cc3ff..02a65b2 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 8%{?dist} +Release: 9%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -40,6 +40,9 @@ Patch95: freetype-2.7.1-safety-guard.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1451795 Patch96: freetype-2.7.1-pcf-encoding.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1456585 +Patch97: freetype-2.7.1-loop-counter.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -103,6 +106,7 @@ popd %patch94 -p1 -b .protect-flex-handling %patch95 -p1 -b .safety-guard %patch96 -p1 -b .pcf-encoding +%patch97 -p1 -b .loop-counter %build @@ -218,6 +222,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Thu Jun 1 2017 Marek Kasik - 2.7.1-9 +- Adjust loop counter maximum for TrueType fonts +- Resolves: #1456585 + * Wed May 24 2017 Marek Kasik - 2.7.1-8 - Accept ISO646.1991-IRV as a Unicode charmap in PCF and BDF drivers - Resolves: #1451795 From 325f38f36e86dffc62bfe72ec110781754612033 Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Fri, 16 Feb 2018 11:47:04 +0100 Subject: [PATCH 6/6] Avoid NULL reference Resolves: #1544776 --- freetype-2.7.1-getvariation.patch | 39 +++++++++++++++++++++++++++++++ freetype.spec | 10 +++++++- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 freetype-2.7.1-getvariation.patch diff --git a/freetype-2.7.1-getvariation.patch b/freetype-2.7.1-getvariation.patch new file mode 100644 index 0000000..550676e --- /dev/null +++ b/freetype-2.7.1-getvariation.patch @@ -0,0 +1,39 @@ +From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 27 Jan 2018 14:43:43 +0100 +Subject: [PATCH] * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL + reference. + +Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 +--- + src/truetype/ttinterp.c | 12 ++++++++++-- + 1 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c +index d855aaaa9..551f14a2e 100644 +--- a/src/truetype/ttinterp.c ++++ b/src/truetype/ttinterp.c +@@ -7456,8 +7456,16 @@ + return; + } + +- for ( i = 0; i < num_axes; i++ ) +- args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ if ( coords ) ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ } ++ else ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = 0; ++ } + } + + +-- +2.14.3 + diff --git a/freetype.spec b/freetype.spec index 02a65b2..27f585b 100644 --- a/freetype.spec +++ b/freetype.spec @@ -7,7 +7,7 @@ Summary: A free and portable font rendering engine Name: freetype Version: 2.7.1 -Release: 9%{?dist} +Release: 10%{?dist} License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement Group: System Environment/Libraries URL: http://www.freetype.org @@ -43,6 +43,9 @@ Patch96: freetype-2.7.1-pcf-encoding.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1456585 Patch97: freetype-2.7.1-loop-counter.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1544776 +Patch98: freetype-2.7.1-getvariation.patch + BuildRequires: libX11-devel BuildRequires: libpng-devel BuildRequires: zlib-devel @@ -107,6 +110,7 @@ popd %patch95 -p1 -b .safety-guard %patch96 -p1 -b .pcf-encoding %patch97 -p1 -b .loop-counter +%patch98 -p1 -b .getvariation %build @@ -222,6 +226,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la} %{_mandir}/man1/* %changelog +* Fri Feb 16 2018 Marek Kasik - 2.7.1-10 +- Avoid NULL reference +- Resolves: #1544776 + * Thu Jun 1 2017 Marek Kasik - 2.7.1-9 - Adjust loop counter maximum for TrueType fonts - Resolves: #1456585