Avoid NULL reference

Resolves: #1544776

freetype-2.7.1-getvariation.patch

@@ -0,0 +1,39 @@
+From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Sat, 27 Jan 2018 14:43:43 +0100
+Subject: [PATCH] * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL
+ reference.
+
+Reported as
+
+  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736
+---
+ src/truetype/ttinterp.c | 12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
+index d855aaaa9..551f14a2e 100644
+--- a/src/truetype/ttinterp.c
++++ b/src/truetype/ttinterp.c
+@@ -7456,8 +7456,16 @@
+       return;
+     }
+ 
+-    for ( i = 0; i < num_axes; i++ )
+-      args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
++    if ( coords )
++    {
++      for ( i = 0; i < num_axes; i++ )
++        args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
++    }
++    else
++    {
++      for ( i = 0; i < num_axes; i++ )
++        args[i] = 0;
++    }
+   }
+ 
+ 
+-- 
+2.14.3
+

freetype-2.7.1-loop-counter.patch

@@ -0,0 +1,48 @@
+--- freetype-2.7.1/src/truetype/ttinterp.c
++++ freetype-2.7.1/src/truetype/ttinterp.c
+@@ -7605,21 +7605,34 @@
+       exc->twilight.n_points = (FT_UShort)num_twilight_points;
+     }
+ 
+-    /* Set up loop detectors.  We restrict the number of LOOPCALL loops  */
+-    /* and the number of JMPR, JROT, and JROF calls with a negative      */
+-    /* argument to values that depend on the size of the CVT table and   */
+-    /* the number of points in the current glyph (if applicable).        */
+-    /*                                                                   */
+-    /* The idea is that in real-world bytecode you either iterate over   */
+-    /* all CVT entries, or over all points (or contours) of a glyph, and */
+-    /* such iterations don't happen very often.                          */
++    /* Set up loop detectors.  We restrict the number of LOOPCALL loops */
++    /* and the number of JMPR, JROT, and JROF calls with a negative     */
++    /* argument to values that depend on various parameters like the    */
++    /* size of the CVT table or the number of points in the current     */
++    /* glyph (if applicable).                                           */
++    /*                                                                  */
++    /* The idea is that in real-world bytecode you either iterate over  */
++    /* all CVT entries (in the `prep' table), or over all points (or    */
++    /* contours, in the `glyf' table) of a glyph, and such iterations   */
++    /* don't happen very often.                                         */
+     exc->loopcall_counter = 0;
+     exc->neg_jump_counter = 0;
+ 
+     /* The maximum values are heuristic. */
+-    exc->loopcall_counter_max = FT_MAX( 100,
+-                                        10 * ( exc->pts.n_points +
+-                                               exc->cvtSize ) );
++    if ( exc->pts.n_points )
++      exc->loopcall_counter_max = FT_MAX( 50,
++                                          10 * exc->pts.n_points ) +
++                                  FT_MAX( 50,
++                                          exc->cvtSize / 10 );
++    else
++      exc->loopcall_counter_max = 300 + 8 * exc->cvtSize;
++
++    /* as a protection against an unreasonable number of CVT entries  */
++    /* we assume at most 100 control values per glyph for the counter */
++    if ( exc->loopcall_counter_max >
++         100 * (FT_ULong)exc->face->root.num_glyphs )
++      exc->loopcall_counter_max = 100 * (FT_ULong)exc->face->root.num_glyphs;
++
+     FT_TRACE5(( "TT_RunIns: Limiting total number of loops in LOOPCALL"
+                 " to %d\n", exc->loopcall_counter_max ));
+ 

freetype-2.7.1-pcf-encoding.patch

@@ -0,0 +1,58 @@
+From 082f2faf5007812bac6a1f783c7dcc6f49d761fe Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Wed, 24 May 2017 07:40:46 +0200
+Subject: [PATCH] [bdf, pcf] Support ISO646.1991-IRV character encoding (aka
+ ASCII).
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Marek Kašík <mkasik@redhat.com>, cf.
+
+  https://bugzilla.redhat.com/show_bug.cgi?id=1451795
+
+* src/bdf/bdfdrivr.c (BDF_Face_Init), src/pcf/pcfdrivr.c
+(PCF_Face_Init): Implement it.
+---
+ ChangeLog          | 11 +++++++++++
+ src/bdf/bdfdrivr.c |  6 +++++-
+ src/pcf/pcfdrivr.c |  6 +++++-
+ 3 files changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/src/bdf/bdfdrivr.c b/src/bdf/bdfdrivr.c
+index a2242be0..c0a5a5c5 100644
+--- a/src/bdf/bdfdrivr.c
++++ b/src/bdf/bdfdrivr.c
+@@ -545,7 +545,11 @@ THE SOFTWARE.
+               if ( !ft_strcmp( s, "10646" )                      ||
+                    ( !ft_strcmp( s, "8859" ) &&
+                      !ft_strcmp( face->charset_encoding, "1" ) ) )
+-              unicode_charmap = 1;
++                unicode_charmap = 1;
++              /* another name for ASCII */
++              else if ( !ft_strcmp( s, "646.1991" )                 &&
++                        !ft_strcmp( face->charset_encoding, "IRV" ) )
++                unicode_charmap = 1;
+             }
+ 
+             {
+diff --git a/src/pcf/pcfdrivr.c b/src/pcf/pcfdrivr.c
+index 9f4d36d1..50530941 100644
+--- a/src/pcf/pcfdrivr.c
++++ b/src/pcf/pcfdrivr.c
+@@ -387,7 +387,11 @@ THE SOFTWARE.
+           if ( !ft_strcmp( s, "10646" )                      ||
+                ( !ft_strcmp( s, "8859" ) &&
+                  !ft_strcmp( face->charset_encoding, "1" ) ) )
+-          unicode_charmap = 1;
++            unicode_charmap = 1;
++          /* another name for ASCII */
++          else if ( !ft_strcmp( s, "646.1991" )                 &&
++                    !ft_strcmp( face->charset_encoding, "IRV" ) )
++            unicode_charmap = 1;
+         }
+       }
+ 
+-- 
+2.13.0
+

freetype-2.7.1-protect-flex-handling.patch

@@ -0,0 +1,47 @@
+From f958c48ee431bef8d4d466b40c9cb2d4dbcb7791 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Fri, 24 Mar 2017 09:15:10 +0100
+Subject: [PATCH] [psaux] Better protect `flex' handling.
+
+Reported as
+
+  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935
+
+* src/psaux/t1decode.c (t1_decoder_parse_charstrings)
+<callothersubr>: Since there is not a single flex operator but a
+series of subroutine calls, malformed fonts can call arbitrary other
+operators after the start of a flex, possibly adding points.  For
+this reason we have to check the available number of points before
+inserting a point.
+---
+ ChangeLog            | 15 +++++++++++++++
+ src/psaux/t1decode.c |  9 +++++++++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c
+index af7b465e..7dd45135 100644
+--- a/src/psaux/t1decode.c
++++ b/src/psaux/t1decode.c
+@@ -780,10 +780,19 @@
+             /* point without adding any point to the outline    */
+             idx = decoder->num_flex_vectors++;
+             if ( idx > 0 && idx < 7 )
++            {
++              /* in malformed fonts it is possible to have other */
++              /* opcodes in the middle of a flex (which don't    */
++              /* increase `num_flex_vectors'); we thus have to   */
++              /* check whether we can add a point                */
++              if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) )
++                goto Syntax_Error;
++
+               t1_builder_add_point( builder,
+                                     x,
+                                     y,
+                                     (FT_Byte)( idx == 3 || idx == 6 ) );
++            }
+           }
+           break;
+ 
+-- 
+2.12.2
+

freetype-2.7.1-safety-guard.patch

@@ -0,0 +1,36 @@
+From 3774fc08b502c3e685afca098b6e8a195aded6a0 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Sun, 26 Mar 2017 08:32:09 +0200
+Subject: [PATCH] * src/psaux/psobjs.c (t1_builder_close_contour): Add safety
+ guard.
+
+Reported as
+
+  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941
+---
+ ChangeLog          | 8 ++++++++
+ src/psaux/psobjs.c | 8 ++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
+index d18e821a..0baf8368 100644
+--- a/src/psaux/psobjs.c
++++ b/src/psaux/psobjs.c
+@@ -1718,6 +1718,14 @@
+     first = outline->n_contours <= 1
+             ? 0 : outline->contours[outline->n_contours - 2] + 1;
+ 
++    /* in malformed fonts it can happen that a contour was started */
++    /* but no points were added                                    */
++    if ( outline->n_contours && first == outline->n_points )
++    {
++      outline->n_contours--;
++      return;
++    }
++
+     /* We must not include the last point in the path if it */
+     /* is located on the first point.                       */
+     if ( outline->n_points > 1 )
+-- 
+2.12.2
+

freetype.spec

@@ -7,7 +7,7 @@
 Summary: A free and portable font rendering engine
 Name: freetype
 Version: 2.7.1
-Release: 4%{?dist}
+Release: 10%{?dist}
 License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement
 Group: System Environment/Libraries
 URL: http://www.freetype.org
@@ -31,6 +31,21 @@ Patch92:  freetype-2.5.3-freetype-config-prefix.patch
 
 Patch93:  freetype-2.6.5-libtool.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1446500
+Patch94:  freetype-2.7.1-protect-flex-handling.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1446073
+Patch95:  freetype-2.7.1-safety-guard.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1451795
+Patch96:  freetype-2.7.1-pcf-encoding.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1456585
+Patch97:  freetype-2.7.1-loop-counter.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1544776
+Patch98:  freetype-2.7.1-getvariation.patch
+
 BuildRequires: libX11-devel
 BuildRequires: libpng-devel
 BuildRequires: zlib-devel
@@ -89,10 +104,13 @@ pushd ft2demos-%{version}
 popd
 
 %patch88 -p1 -b .multilib
-
 %patch92 -p1 -b .freetype-config-prefix
-
 %patch93 -p1 -b .libtool
+%patch94 -p1 -b .protect-flex-handling
+%patch95 -p1 -b .safety-guard
+%patch96 -p1 -b .pcf-encoding
+%patch97 -p1 -b .loop-counter
+%patch98 -p1 -b .getvariation
 
 %build
 
@@ -208,6 +226,29 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la}
 %{_mandir}/man1/*
 
 %changelog
+* Fri Feb 16 2018 Marek Kasik <mkasik@redhat.com> - 2.7.1-10
+- Avoid NULL reference
+- Resolves: #1544776
+
+* Thu Jun  1 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-9
+- Adjust loop counter maximum for TrueType fonts
+- Resolves: #1456585
+
+* Wed May 24 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-8
+- Accept ISO646.1991-IRV as a Unicode charmap in PCF and BDF drivers
+- Resolves: #1451795
+
+* Tue May  2 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-7
+- Fix numbers of tracking bugs
+
+* Tue May  2 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-6
+- Add safety guard (CVE-2017-8287)
+- Resolves: #1446074
+
+* Tue May  2 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-5
+- Better protect `flex' handling (CVE-2017-8105)
+- Resolves: #1446501
+
 * Mon Apr 10 2017 Marek Kasik <mkasik@redhat.com> - 2.7.1-4
 - Revert previous commit
 - Related: #1437999