Avoid NULL reference

Resolves: #1544776

0077-truetype-Fix-loading-of-named-instances.patch

@@ -0,0 +1,67 @@
+From 55bbb98f5c5a89230127d6b998a6e23e634b5d0e Mon Sep 17 00:00:00 2001
+From: Behdad Esfahbod <behdad@behdad.org>
+Date: Tue, 1 Aug 2017 09:17:02 +0200
+Subject: [PATCH 077/132] [truetype] Fix loading of named instances.
+
+* src/truetype/ttgxvar.c (TT_Get_MM_Var): Preserve file position
+while loading the `avar' table.
+---
+ ChangeLog               |  7 +++++++
+ include/freetype/ftmm.h |  2 +-
+ src/truetype/ttgxvar.c  | 11 ++++++++++-
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/include/freetype/ftmm.h b/include/freetype/ftmm.h
+index c41b80ea6..1f48a4945 100644
+--- a/include/freetype/ftmm.h
++++ b/include/freetype/ftmm.h
+@@ -178,7 +178,7 @@ FT_BEGIN_HEADER
+   /*    strid  :: The entry in `name' table identifying this instance.     */
+   /*                                                                       */
+   /*    psid   :: The entry in `name' table identifying a PostScript name  */
+-  /*              for this instance.                                       */
++  /*              for this instance.  Value 0 indicates a missing entry.   */
+   /*                                                                       */
+   typedef struct  FT_Var_Named_Style_
+   {
+diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
+index 68458362e..df42b3bfd 100644
+--- a/src/truetype/ttgxvar.c
++++ b/src/truetype/ttgxvar.c
+@@ -2139,8 +2139,16 @@
+         goto Exit;
+ 
+       if ( fvar_head.instanceCount && !face->blend->avar_loaded )
++      {
++        FT_ULong  offset = FT_STREAM_POS();
++
++
+         ft_var_load_avar( face );
+ 
++        if ( FT_STREAM_SEEK( offset ) )
++          goto Exit;
++      }
++
+       ns  = mmvar->namedstyle;
+       nsc = face->blend->normalized_stylecoords;
+       for ( i = 0; i < fvar_head.instanceCount; i++, ns++ )
+@@ -2157,6 +2165,7 @@
+         for ( j = 0; j < fvar_head.axisCount; j++, c++ )
+           *c = FT_GET_LONG();
+ 
++        /* valid psid values are 6 and [256;32767] */
+         if ( usePsName )
+           ns->psid = FT_GET_USHORT();
+ 
+@@ -2174,7 +2183,7 @@
+         SFNT_Service  sfnt = (SFNT_Service)face->sfnt;
+ 
+         FT_Int   found, dummy1, dummy2;
+-        FT_UInt  strid = 0xFFFFFFFFUL;
++        FT_UInt  strid = ~0U;
+ 
+ 
+         /* the default instance is missing in array the   */
+-- 
+2.13.5
+

0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch

@@ -0,0 +1,45 @@
+From 7e50824288fac5a36c2938fdb3e1c949ea53f982 Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Tue, 1 Aug 2017 12:44:35 +0200
+Subject: [PATCH 079/132] * src/truetype/ttgxvar.c (TT_Get_MM_Var): Fix thinko.
+
+---
+ ChangeLog               | 4 ++++
+ include/freetype/ftmm.h | 3 ++-
+ src/truetype/ttgxvar.c  | 4 +++-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/include/freetype/ftmm.h b/include/freetype/ftmm.h
+index 1f48a4945..b1bc1ed82 100644
+--- a/include/freetype/ftmm.h
++++ b/include/freetype/ftmm.h
+@@ -178,7 +178,8 @@ FT_BEGIN_HEADER
+   /*    strid  :: The entry in `name' table identifying this instance.     */
+   /*                                                                       */
+   /*    psid   :: The entry in `name' table identifying a PostScript name  */
+-  /*              for this instance.  Value 0 indicates a missing entry.   */
++  /*              for this instance.  Value 0xFFFF indicates a missing     */
++  /*              entry.                                                   */
+   /*                                                                       */
+   typedef struct  FT_Var_Named_Style_
+   {
+diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
+index df42b3bfd..5a87df139 100644
+--- a/src/truetype/ttgxvar.c
++++ b/src/truetype/ttgxvar.c
+@@ -2165,9 +2165,11 @@
+         for ( j = 0; j < fvar_head.axisCount; j++, c++ )
+           *c = FT_GET_LONG();
+ 
+-        /* valid psid values are 6 and [256;32767] */
++        /* valid psid values are 6, [256;32767], and 0xFFFF */
+         if ( usePsName )
+           ns->psid = FT_GET_USHORT();
++        else
++          ns->psid = 0xFFFF;
+ 
+         ft_var_to_normalized( face,
+                               fvar_head.axisCount,
+-- 
+2.13.5
+

freetype-2.8-getvariation.patch

@@ -0,0 +1,39 @@
+From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Sat, 27 Jan 2018 14:43:43 +0100
+Subject: [PATCH] * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL
+ reference.
+
+Reported as
+
+  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736
+---
+ src/truetype/ttinterp.c | 12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
+index d855aaaa9..551f14a2e 100644
+--- a/src/truetype/ttinterp.c
++++ b/src/truetype/ttinterp.c
+@@ -7470,8 +7470,16 @@
+       return;
+     }
+ 
+-    for ( i = 0; i < num_axes; i++ )
+-      args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
++    if ( coords )
++    {
++      for ( i = 0; i < num_axes; i++ )
++        args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
++    }
++    else
++    {
++      for ( i = 0; i < num_axes; i++ )
++        args[i] = 0;
++    }
+   }
+ 
+ 
+-- 
+2.14.3
+

freetype-2.8-multilib.patch

@@ -0,0 +1,65 @@
+--- freetype-2.8/builds/unix/freetype-config.in
++++ freetype-2.8/builds/unix/freetype-config.in
+@@ -13,45 +13,25 @@ LC_ALL=C
+ export LC_ALL
+ 
+ 
+-# if `pkg-config' is available, use values from `freetype2.pc'
+-pkg-config --version >/dev/null 2>&1
+-if test $? -eq 0 ; then
+-  # note that option `--variable' is not affected by the
+-  # PKG_CONFIG_SYSROOT_DIR environment variable
+-  if test "x$SYSROOT" != "x" ; then
+-    PKG_CONFIG_SYSROOT_DIR="$SYSROOT"
+-    export PKG_CONFIG_SYSROOT_DIR
+-  fi
+-
+-  prefix=`pkg-config --variable prefix freetype2`
+-  exec_prefix=`pkg-config --variable exec_prefix freetype2`
+-
+-  includedir=`pkg-config --variable includedir freetype2`
+-  libdir=`pkg-config --variable libdir freetype2`
+-
+-  version=`pkg-config --modversion freetype2`
+-
+-  cflags=`pkg-config --cflags freetype2`
+-  dynamic_libs=`pkg-config --libs freetype2`
+-  static_libs=`pkg-config --static --libs freetype2`
+-else
+-  prefix="%prefix%"
+-  exec_prefix="%exec_prefix%"
+-
+-  includedir="%includedir%"
+-  libdir="%libdir%"
+-
+-  version=%ft_version%
+-
+-  cflags="-I${SYSROOT}$includedir/freetype2"
+-  dynamic_libs="-lfreetype"
+-  static_libs="%LIBSSTATIC_CONFIG%"
+-  if test "${SYSROOT}$libdir" != "/usr/lib"   &&
+-     test "${SYSROOT}$libdir" != "/usr/lib64" ; then
+-    libs_L="-L${SYSROOT}$libdir"
+-  fi
++# note that option `--variable' is not affected by the
++# PKG_CONFIG_SYSROOT_DIR environment variable
++if test "x$SYSROOT" != "x" ; then
++  PKG_CONFIG_SYSROOT_DIR="$SYSROOT"
++  export PKG_CONFIG_SYSROOT_DIR
+ fi
+ 
++prefix=`pkg-config --variable prefix freetype2`
++exec_prefix=`pkg-config --variable exec_prefix freetype2`
++
++includedir=`pkg-config --variable includedir freetype2`
++libdir=`pkg-config --variable libdir freetype2`
++
++version=`pkg-config --modversion freetype2`
++
++cflags=`pkg-config --cflags freetype2`
++dynamic_libs=`pkg-config --libs freetype2`
++static_libs=`pkg-config --static --libs freetype2`
++
+ orig_prefix=$prefix
+ orig_exec_prefix=$exec_prefix
+ 

freetype.spec

@@ -7,7 +7,7 @@
 Summary: A free and portable font rendering engine
 Name: freetype
 Version: 2.8
-Release: 5%{?dist}
+Release: 8%{?dist}
 License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement
 Group: System Environment/Libraries
 URL: http://www.freetype.org
@@ -29,6 +29,14 @@ Patch4:  freetype-2.8-pcf-encoding.patch
 
 Patch5:  freetype-2.8-loop-counter.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1497443
+Patch6:  freetype-2.8-multilib.patch
+
+Patch7:  0077-truetype-Fix-loading-of-named-instances.patch
+Patch8:  0079-src-truetype-ttgxvar.c-TT_Get_MM_Var-Fix-thinko.patch
+
+Patch9:  freetype-2.8-getvariation.patch
+
 BuildRequires: libX11-devel
 BuildRequires: libpng-devel
 BuildRequires: zlib-devel
@@ -64,6 +72,7 @@ small utilities showing various capabilities of the FreeType library.
 Summary: FreeType development libraries and header files
 Group: Development/Libraries
 Requires: %{name} = %{version}-%{release}
+Requires: pkgconf%{?_isa}
 
 %description devel
 The freetype-devel package includes the static libraries and header files
@@ -89,6 +98,10 @@ popd
 %patch3 -p1 -b .libtool
 %patch4 -p1 -b .pcf-encoding
 %patch5 -p1 -b .loop-counter
+%patch6 -p1 -b .multilib
+%patch7 -p1 -b .named-instances
+%patch8 -p1 -b .named-instances2
+%patch9 -p1 -b .getvariation
 
 %build
 
@@ -202,6 +215,17 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la}
 %{_mandir}/man1/*
 
 %changelog
+* Fri Feb 16 2018 Marek Kasik <mkasik@redhat.com> - 2.8-8
+- Avoid NULL reference
+- Resolves: #1544776
+
+* Thu Dec 21 2017 Marek Kasik <mkasik@redhat.com> - 2.8-7
+- Fix loading of named instances (TrueType)
+
+* Mon Oct  9 2017 Marek Kasik <mkasik@redhat.com> - 2.8-6
+- Require pkgconf so we can make freetype-config multilib compatible again
+- Resolves: #1497443
+
 * Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild