Test bitmap size earlier for PNGs

Fix memory leak in pngshim.c Resolves: #1890211
2020-10-23 15:46:57 +02:00
8 changed files with 561 additions and 188 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,84 @@
-/freetype-*.tar.xz
-/freetype-doc-*.tar.xz
-/ft2demos-*.tar.xz
+ft2demos-2.3.12.tar.bz2
+freetype-doc-2.3.12.tar.bz2
+freetype-2.3.12.tar.bz2
+freetype-2.4.2.tar.bz2
+freetype-doc-2.4.2.tar.bz2
+ft2demos-2.4.2.tar.bz2
+/freetype-2.4.3.tar.bz2
+/freetype-doc-2.4.3.tar.bz2
+/ft2demos-2.4.3.tar.bz2
+/freetype-2.4.4.tar.bz2
+/freetype-doc-2.4.4.tar.bz2
+/ft2demos-2.4.4.tar.bz2
+/freetype-2.4.5.tar.bz2
+/freetype-doc-2.4.5.tar.bz2
+/ft2demos-2.4.5.tar.bz2
+/freetype-2.4.6.tar.bz2
+/freetype-doc-2.4.6.tar.bz2
+/ft2demos-2.4.6.tar.bz2
+/freetype-2.4.7.tar.bz2
+/freetype-doc-2.4.7.tar.bz2
+/ft2demos-2.4.7.tar.bz2
+/freetype-2.4.8.tar.bz2
+/freetype-doc-2.4.8.tar.bz2
+/ft2demos-2.4.8.tar.bz2
+/freetype-2.4.9.tar.bz2
+/freetype-doc-2.4.9.tar.bz2
+/ft2demos-2.4.9.tar.bz2
+/freetype-2.4.10.tar.bz2
+/freetype-doc-2.4.10.tar.bz2
+/ft2demos-2.4.10.tar.bz2
+/freetype-2.4.11.tar.bz2
+/freetype-doc-2.4.11.tar.bz2
+/ft2demos-2.4.11.tar.bz2
+/freetype-2.4.12.tar.bz2
+/freetype-doc-2.4.12.tar.bz2
+/ft2demos-2.4.12.tar.bz2
+/freetype-2.5.0.tar.bz2
+/freetype-doc-2.5.0.tar.bz2
+/ft2demos-2.5.0.tar.bz2
+/freetype-2.5.2.tar.bz2
+/freetype-doc-2.5.2.tar.bz2
+/ft2demos-2.5.2.tar.bz2
+/freetype-2.5.3.tar.bz2
+/freetype-doc-2.5.3.tar.bz2
+/ft2demos-2.5.3.tar.bz2
+/freetype-2.5.4.tar.bz2
+/freetype-doc-2.5.4.tar.bz2
+/ft2demos-2.5.4.tar.bz2
+/freetype-2.5.5.tar.bz2
+/freetype-doc-2.5.5.tar.bz2
+/ft2demos-2.5.5.tar.bz2
+/freetype-2.6.tar.bz2
+/freetype-doc-2.6.tar.bz2
+/ft2demos-2.6.tar.bz2
+/freetype-2.6.1.tar.bz2
+/freetype-doc-2.6.1.tar.bz2
+/ft2demos-2.6.1.tar.bz2
+/freetype-2.6.2.tar.bz2
+/freetype-doc-2.6.2.tar.bz2
+/ft2demos-2.6.2.tar.bz2
+/freetype-2.6.3.tar.bz2
+/freetype-doc-2.6.3.tar.bz2
+/ft2demos-2.6.3.tar.bz2
+/freetype-2.6.5.tar.bz2
+/freetype-doc-2.6.5.tar.bz2
+/ft2demos-2.6.5.tar.bz2
+/freetype-2.7.tar.bz2
+/freetype-doc-2.7.tar.bz2
+/ft2demos-2.7.tar.bz2
+/freetype-2.7.1.tar.bz2
+/freetype-doc-2.7.1.tar.bz2
+/ft2demos-2.7.1.tar.bz2
+/freetype-2.8.tar.bz2
+/freetype-doc-2.8.tar.bz2
+/ft2demos-2.8.tar.bz2
+/freetype-2.9.tar.bz2
+/freetype-doc-2.9.tar.bz2
+/ft2demos-2.9.tar.bz2
+/freetype-2.9.1.tar.bz2
+/freetype-doc-2.9.1.tar.bz2
+/ft2demos-2.9.1.tar.bz2
+/freetype-2.10.0.tar.bz2
+/freetype-doc-2.10.0.tar.bz2
+/ft2demos-2.10.0.tar.bz2
--- a/0001-pcf-Fix-handling-of-undefined-glyph-56067.patch
+++ b/0001-pcf-Fix-handling-of-undefined-glyph-56067.patch
@ -0,0 +1,324 @@
+From c149f7397e484c97f45fb75fa1c7fdda2fc646cd Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Wed, 17 Apr 2019 07:49:17 +0200
+Subject: [PATCH] [pcf] Fix handling of undefined glyph (#56067).
+
+This commit fixes the changes from 2018-07-21, which broke charmap
+iteration.  We now add the default character as a new glyph with
+index 0, thus increasing the number of glyphs by one (as before).
+
+* src/pcf/pcfread.c (pcf_get_metrics): Adjust to new artificial
+glyph with index 0.
+Limit number of elements to 65534.
+(pcf_get_bitmaps): Ditto.
+Unify two loops into one; this avoids allocation of an intermediate
+array.
+(pcf_get_encodings): Don't flip indices but copy glyph metrics of
+default character to index 0.
+Also handle invalid default character.
+
+* docs/CHANGES: Updated.
+---
+ src/pcf/pcf.h      |   3 +-
+ src/pcf/pcfdrivr.c |  12 ++--
+ src/pcf/pcfread.c  | 161 ++++++++++++++++++++++++---------------------
+ 3 files changed, 93 insertions(+), 83 deletions(-)
+
+diff --git a/src/pcf/pcf.h b/src/pcf/pcf.h
+index 529dd3adf..33be4bcd8 100644
+--- a/src/pcf/pcf.h
+++ b/src/pcf/pcf.h
+@@ -99,7 +99,8 @@ FT_BEGIN_HEADER
+     FT_Short  ascent;
+     FT_Short  descent;
+     FT_Short  attributes;
+-    FT_ULong  bits;
+
+    FT_ULong  bits;  /* offset into the PCF_BITMAPS table */
+ 
+   } PCF_MetricRec, *PCF_Metric;
+ 
+diff --git a/src/pcf/pcfdrivr.c b/src/pcf/pcfdrivr.c
+index 54bbb9d11..b39592c79 100644
+--- a/src/pcf/pcfdrivr.c
+++ b/src/pcf/pcfdrivr.c
+@@ -122,9 +122,9 @@ THE SOFTWARE.
+          charcodeCol > enc->lastCol  )
+       return 0;
+ 
+-    return (FT_UInt)enc->offset[ ( charcodeRow - enc->firstRow ) *
+-                                 ( enc->lastCol - enc->firstCol + 1 ) +
+-                                   charcodeCol - enc->firstCol          ];
+    return (FT_UInt)enc->offset[( charcodeRow - enc->firstRow ) *
+                                  ( enc->lastCol - enc->firstCol + 1 ) +
+                                charcodeCol - enc->firstCol];
+   }
+ 
+ 
+@@ -160,9 +160,9 @@ THE SOFTWARE.
+ 
+       charcode = (FT_UInt32)( charcodeRow * 256 + charcodeCol );
+ 
+-      result = (FT_UInt)enc->offset[ ( charcodeRow - enc->firstRow ) *
+-                                     ( enc->lastCol - enc->firstCol + 1 ) +
+-                                       charcodeCol - enc->firstCol          ];
+      result = (FT_UInt)enc->offset[( charcodeRow - enc->firstRow ) *
+                                      ( enc->lastCol - enc->firstCol + 1 ) +
+                                    charcodeCol - enc->firstCol];
+       if ( result != 0xFFFFU )
+         break;
+     }
+diff --git a/src/pcf/pcfread.c b/src/pcf/pcfread.c
+index 71143ecfb..3692eeff1 100644
+--- a/src/pcf/pcfread.c
+++ b/src/pcf/pcfread.c
+@@ -743,33 +743,39 @@ THE SOFTWARE.
+     if ( !orig_nmetrics )
+       return FT_THROW( Invalid_Table );
+ 
+-    /* PCF is a format from ancient times; Unicode was in its       */
+-    /* infancy, and widely used two-byte character sets for CJK     */
+-    /* scripts (Big 5, GB 2312, JIS X 0208, etc.) did have at most  */
+-    /* 15000 characters.  Even the more exotic CNS 11643 and CCCII  */
+-    /* standards, which were essentially three-byte character sets, */
+-    /* provided less then 65536 assigned characters.                */
+-    /*                                                              */
+-    /* While technically possible to have a larger number of glyphs */
+-    /* in PCF files, we thus limit the number to 65536.             */
+-    if ( orig_nmetrics > 65536 )
+    /*
+     * PCF is a format from ancient times; Unicode was in its infancy, and
+     * widely used two-byte character sets for CJK scripts (Big 5, GB 2312,
+     * JIS X 0208, etc.) did have at most 15000 characters.  Even the more
+     * exotic CNS 11643 and CCCII standards, which were essentially
+     * three-byte character sets, provided less then 65536 assigned
+     * characters.
+     *
+     * While technically possible to have a larger number of glyphs in PCF
+     * files, we thus limit the number to 65535, taking into account that we
+     * synthesize the metrics of glyph 0 to be a copy of the `default
+     * character', and that 0xFFFF in the encodings array indicates a
+     * missing glyph.
+     */
+    if ( orig_nmetrics > 65534 )
+     {
+       FT_TRACE0(( "pcf_get_metrics:"
+-                  " only loading first 65536 metrics\n" ));
+-      nmetrics = 65536;
+                  " only loading first 65534 metrics\n" ));
+      nmetrics = 65534;
+     }
+     else
+       nmetrics = orig_nmetrics;
+ 
+-    face->nmetrics = nmetrics;
+    face->nmetrics = nmetrics + 1;
+ 
+-    if ( FT_NEW_ARRAY( face->metrics, nmetrics ) )
+    if ( FT_NEW_ARRAY( face->metrics, face->nmetrics ) )
+       return error;
+ 
+-    metrics = face->metrics;
+    /* we handle glyph index 0 later on */
+    metrics = face->metrics + 1;
+ 
+     FT_TRACE4(( "\n" ));
+-    for ( i = 0; i < nmetrics; i++, metrics++ )
+    for ( i = 1; i < face->nmetrics; i++, metrics++ )
+     {
+       FT_TRACE5(( "  idx %ld:", i ));
+       error = pcf_get_metric( stream, format, metrics );
+@@ -808,12 +814,10 @@ THE SOFTWARE.
+   pcf_get_bitmaps( FT_Stream  stream,
+                    PCF_Face   face )
+   {
+-    FT_Error   error;
+-    FT_Memory  memory  = FT_FACE( face )->memory;
+-    FT_ULong*  offsets = NULL;
+-    FT_ULong   bitmapSizes[GLYPHPADOPTIONS];
+-    FT_ULong   format, size;
+-    FT_ULong   nbitmaps, orig_nbitmaps, i, sizebitmaps = 0;
+    FT_Error  error;
+    FT_ULong  bitmapSizes[GLYPHPADOPTIONS];
+    FT_ULong  format, size, pos;
+    FT_ULong  nbitmaps, orig_nbitmaps, i, sizebitmaps = 0;
+ 
+ 
+     error = pcf_seek_to_table_type( stream,
+@@ -859,31 +863,46 @@ THE SOFTWARE.
+     FT_TRACE4(( "  number of bitmaps: %ld\n", orig_nbitmaps ));
+ 
+     /* see comment in `pcf_get_metrics' */
+-    if ( orig_nbitmaps > 65536 )
+    if ( orig_nbitmaps > 65534 )
+     {
+       FT_TRACE0(( "pcf_get_bitmaps:"
+-                  " only loading first 65536 bitmaps\n" ));
+-      nbitmaps = 65536;
+                  " only loading first 65534 bitmaps\n" ));
+      nbitmaps = 65534;
+     }
+     else
+       nbitmaps = orig_nbitmaps;
+ 
+-    if ( nbitmaps != face->nmetrics )
+    /* no extra bitmap for glyph 0 */
+    if ( nbitmaps != face->nmetrics - 1 )
+       return FT_THROW( Invalid_File_Format );
+ 
+-    if ( FT_NEW_ARRAY( offsets, nbitmaps ) )
+-      return error;
+    /* start position of bitmap data */
+    pos = stream->pos + nbitmaps * 4 + 4 * 4;
+ 
+     FT_TRACE5(( "\n" ));
+-    for ( i = 0; i < nbitmaps; i++ )
+    for ( i = 1; i <= nbitmaps; i++ )
+     {
+      FT_ULong  offset;
+
+
+       if ( PCF_BYTE_ORDER( format ) == MSBFirst )
+-        (void)FT_READ_ULONG( offsets[i] );
+        (void)FT_READ_ULONG( offset );
+       else
+-        (void)FT_READ_ULONG_LE( offsets[i] );
+        (void)FT_READ_ULONG_LE( offset );
+ 
+       FT_TRACE5(( "  bitmap %lu: offset %lu (0x%lX)\n",
+-                  i, offsets[i], offsets[i] ));
+                  i, offset, offset ));
+
+      /* right now, we only check the offset with a rough estimate; */
+      /* actual bitmaps are only loaded on demand                   */
+      if ( offset > size )
+      {
+        FT_TRACE0(( "pcf_get_bitmaps:"
+                    " invalid offset to bitmap data of glyph %lu\n", i ));
+        face->metrics[i].bits = pos;
+      }
+      else
+        face->metrics[i].bits = pos + offset;
+     }
+     if ( error )
+       goto Bail;
+@@ -910,24 +929,9 @@ THE SOFTWARE.
+ 
+     FT_UNUSED( sizebitmaps );       /* only used for debugging */
+ 
+-    /* right now, we only check the bitmap offsets; */
+-    /* actual bitmaps are only loaded on demand     */
+-    for ( i = 0; i < nbitmaps; i++ )
+-    {
+-      /* rough estimate */
+-      if ( offsets[i] > size )
+-      {
+-        FT_TRACE0(( "pcf_get_bitmaps:"
+-                    " invalid offset to bitmap data of glyph %lu\n", i ));
+-      }
+-      else
+-        face->metrics[i].bits = stream->pos + offsets[i];
+-    }
+-
+     face->bitmapsFormat = format;
+ 
+   Bail:
+-    FT_FREE( offsets );
+     return error;
+   }
+ 
+@@ -1062,41 +1066,52 @@ THE SOFTWARE.
+       defaultCharCol = enc->firstCol;
+     }
+ 
+-    /* FreeType mandates that glyph index 0 is the `undefined glyph',  */
+-    /* which PCF calls the `default character'.  For this reason, we   */
+-    /* swap the positions of glyph index 0 and the index corresponding */
+-    /* to `defaultChar' in case they are different.                    */
+-
+-    /* `stream->cursor' still points at the beginning of the frame; */
+-    /* we can thus easily get the offset to the default character   */
+    /*
+     * FreeType mandates that glyph index 0 is the `undefined glyph', which
+     * PCF calls the `default character'.  However, FreeType needs glyph
+     * index 0 to be used for the undefined glyph only, which is is not the
+     * case for PCF.  For this reason, we add one slot for glyph index 0 and
+     * simply copy the default character to it.
+     *
+     * `stream->cursor' still points to the beginning of the frame; we can
+     * thus easily get the offset to the default character.
+     */
+     pos = stream->cursor +
+             2 * ( ( defaultCharRow - enc->firstRow ) *
+-                  ( enc->lastCol - enc->firstCol + 1 ) +
+-                    defaultCharCol - enc->firstCol       );
+                    ( enc->lastCol - enc->firstCol + 1 ) +
+                  defaultCharCol - enc->firstCol );
+ 
+     if ( PCF_BYTE_ORDER( format ) == MSBFirst )
+       defaultCharEncodingOffset = FT_PEEK_USHORT( pos );
+     else
+       defaultCharEncodingOffset = FT_PEEK_USHORT_LE( pos );
+ 
+-    if ( defaultCharEncodingOffset >= face->nmetrics )
+    if ( defaultCharEncodingOffset == 0xFFFF )
+     {
+       FT_TRACE0(( "pcf_get_encodings:"
+-                  " Invalid glyph index for default character,"
+-                  " setting to zero\n" ));
+-      defaultCharEncodingOffset = 0;
+                  " No glyph for default character,\n"
+                  "                  "
+                  " setting it to the first glyph of the font\n" ));
+      defaultCharEncodingOffset = 1;
+     }
+-
+-    if ( defaultCharEncodingOffset )
+    else
+     {
+-      /* do the swapping */
+-      PCF_MetricRec  tmp = face->metrics[defaultCharEncodingOffset];
+-
+      defaultCharEncodingOffset++;
+ 
+-      face->metrics[defaultCharEncodingOffset] = face->metrics[0];
+-      face->metrics[0]                         = tmp;
+      if ( defaultCharEncodingOffset >= face->nmetrics )
+      {
+        FT_TRACE0(( "pcf_get_encodings:"
+                    " Invalid glyph index for default character,\n"
+                    "                  "
+                    " setting it to the first glyph of the font\n" ));
+        defaultCharEncodingOffset = 1;
+      }
+     }
+ 
+    /* copy metrics of default character to index 0 */
+    face->metrics[0] = face->metrics[defaultCharEncodingOffset];
+
+    /* now loop over all values */
+     offset = enc->offset;
+     for ( i = enc->firstRow; i <= enc->lastRow; i++ )
+     {
+@@ -1111,15 +1126,9 @@ THE SOFTWARE.
+         else
+           encodingOffset = FT_GET_USHORT_LE();
+ 
+-        if ( encodingOffset != 0xFFFFU )
+-        {
+-          if ( encodingOffset == defaultCharEncodingOffset )
+-            encodingOffset = 0;
+-          else if ( encodingOffset == 0 )
+-            encodingOffset = defaultCharEncodingOffset;
+-        }
+-
+-        *offset++ = encodingOffset;
+        /* everything is off by 1 due to the artificial glyph 0 */
+        *offset++ = encodingOffset == 0xFFFF ? 0xFFFF
+                                             : encodingOffset + 1;
+       }
+     }
+     FT_Stream_ExitFrame( stream );
+-- 
+2.22.0
+
--- a/freetype-2.10.0-png-bitmap-size.patch
+++ b/freetype-2.10.0-png-bitmap-size.patch
@ -0,0 +1,48 @@
+From a3bab162b2ae616074c8877a04556932998aeacd Mon Sep 17 00:00:00 2001
+From: Werner Lemberg <wl@gnu.org>
+Date: Mon, 19 Oct 2020 23:45:28 +0200
+Subject: [PATCH] [sfnt] Fix heap buffer overflow (#59308).
+
+This is CVE-2020-15999.
+
+* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.
+---
+ ChangeLog          |  8 ++++++++
+ src/sfnt/pngshim.c | 14 +++++++-------
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
+index 2e64e5846..f55016122 100644
+--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
+@@ -332,6 +332,13 @@
+ 
+     if ( populate_map_and_metrics )
+     {
+      /* reject too large bitmaps similarly to the rasterizer */
+      if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto DestroyExit;
+      }
+
+       metrics->width  = (FT_UShort)imgWidth;
+       metrics->height = (FT_UShort)imgHeight;
+ 
+@@ -340,13 +347,6 @@
+       map->pixel_mode = FT_PIXEL_MODE_BGRA;
+       map->pitch      = (int)( map->width * 4 );
+       map->num_grays  = 256;
+-
+-      /* reject too large bitmaps similarly to the rasterizer */
+-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+-      {
+-        error = FT_THROW( Array_Too_Large );
+-        goto DestroyExit;
+-      }
+     }
+ 
+     /* convert palette/gray image to rgb */
+-- 
+2.26.2
+
--- a/freetype-2.10.0-png-memory-leak.patch
+++ b/freetype-2.10.0-png-memory-leak.patch
@ -0,0 +1,28 @@
+From 007c109b4594c5e63948bd08b4d5011ad76ffb10 Mon Sep 17 00:00:00 2001
+From: Ben Wagner <bungeman@google.com>
+Date: Fri, 23 Oct 2020 08:29:14 +0200
+Subject: [PATCH] * src/sfnt/pngshim.c (Load_SBit_Png): Fix memory leak
+ (#59322).
+
+The issue is that `rows` is allocated but will not be freed in the
+event that the call to `png_read_image` fails and calls `longjmp`.
+---
+ ChangeLog          | 7 +++++++
+ src/sfnt/pngshim.c | 1 +
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
+index f55016122..d4e43a9f4 100644
+--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
+@@ -443,6 +443,7 @@
+     png_read_end( png, info );
+ 
+   DestroyExit:
+    FT_FREE( rows );
+     png_destroy_read_struct( &png, &info, NULL );
+     FT_Stream_Close( &stream );
+ 
+-- 
+2.26.2
+
--- a/freetype-2.3.0-enable-spr.patch
+++ b/freetype-2.3.0-enable-spr.patch
@ -1,8 +1,8 @@
 --- freetype-2.3.0/include/freetype/config/ftoption.h.spf	2007-01-18 14:27:34.000000000 -0500
 +++ freetype-2.3.0/include/freetype/config/ftoption.h	2007-01-18 14:27:48.000000000 -0500
@@ -92,7 +92,7 @@
-    * When this macro is not defined, FreeType offers alternative LCD
-    * rendering technology that produces excellent output.
+    * macro is not defined, FreeType offers alternative LCD rendering
+    * technology that produces excellent output without LCD filtering.
    */
 -/* #define FT_CONFIG_OPTION_SUBPIXEL_RENDERING */
 +#define FT_CONFIG_OPTION_SUBPIXEL_RENDERING
--- a/freetype-2.5.2-more-demos.patch
+++ b/freetype-2.5.2-more-demos.patch
@ -0,0 +1,17 @@
+--- ft2demos-2.5.2/Makefile
+++ ft2demos-2.5.2/Makefile
+@@ -296,10 +296,10 @@ else
+   # The following programs are not compiled automatically; either comment
+   # out the affected line or use the program name as a Makefile target.
+   #
+-  # EXES += ftchkwd
+-  # EXES += ftmemchk
+-  # EXES += ftpatchk
+-  # EXES += fttimer
+  EXES += ftchkwd
+  EXES += ftmemchk
+  EXES += ftpatchk
+  EXES += fttimer
+   # EXES += testname
+ 
+   exes: $(EXES:%=$(BIN_DIR_2)/%$E)
--- a/freetype.spec
+++ b/freetype.spec
@ -1,21 +1,22 @@
 %{!?with_xfree86:%define with_xfree86 1}
-%bcond_with bootstrap

-Name: freetype
-Version: 2.14.3
-Release: 2%{?dist}
 Summary: A free and portable font rendering engine
-License: (FTL OR GPL-2.0-or-later) AND BSD-3-Clause AND MIT AND MIT-Modern-Variant AND LicenseRef-Fedora-Public-Domain AND Zlib
+Name: freetype
+Version: 2.10.0
+Release: 4%{?dist}
+License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement
 URL: http://www.freetype.org
-Source:  http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.xz
-Source1: http://download.savannah.gnu.org/releases/freetype/freetype-doc-%{version}.tar.xz
-Source2: http://download.savannah.gnu.org/releases/freetype/ft2demos-%{version}.tar.xz
+Source:  http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.tar.bz2
+Source1: http://download.savannah.gnu.org/releases/freetype/freetype-doc-%{version}.tar.bz2
+Source2: http://download.savannah.gnu.org/releases/freetype/ft2demos-%{version}.tar.bz2
 Source3: ftconfig.h

 # Enable subpixel rendering (ClearType)
 Patch0:  freetype-2.3.0-enable-spr.patch
 # Enable otvalid and gxvalid modules
 Patch1:  freetype-2.2.1-enable-valid.patch
+# Enable additional demos
+Patch2:  freetype-2.5.2-more-demos.patch

 Patch3:  freetype-2.6.5-libtool.patch

@ -23,16 +24,19 @@ Patch4:  freetype-2.8-multilib.patch

 Patch5:  freetype-2.10.0-internal-outline.patch

-BuildRequires: gcc
+# https://bugzilla.redhat.com/show_bug.cgi?id=1719132
+# https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c149f7397e484c97f45fb75fa1c7fdda2fc646cd
+Patch6:  0001-pcf-Fix-handling-of-undefined-glyph-56067.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1890210
+Patch7:  freetype-2.10.0-png-bitmap-size.patch
+Patch8:  freetype-2.10.0-png-memory-leak.patch
+
+BuildRequires:  gcc
 BuildRequires: libX11-devel
 BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 BuildRequires: bzip2-devel
-BuildRequires: brotli-devel
-BuildRequires: make
-%if %{without bootstrap}
-BuildRequires: harfbuzz-devel
-%endif

 Provides: %{name}-bytecode
 Provides: %{name}-subpixel
@ -74,12 +78,21 @@ FreeType.
 %prep
 %setup -q -b 1 -a 2

-%patch 0  -p1 -b .enable-spr
-%patch 1  -p1 -b .enable-valid
+%patch0  -p1 -b .enable-spr
+%patch1  -p1 -b .enable-valid

-%patch 3 -p1 -b .libtool
-%patch 4 -p1 -b .multilib
-%patch 5 -p1 -b .internal-outline
+pushd ft2demos-%{version}
+%patch2  -p1 -b .more-demos
+popd
+
+%patch3 -p1 -b .libtool
+%patch4 -p1 -b .multilib
+%patch5 -p1 -b .internal-outline
+
+%patch6 -p1 -b .undefined-pcf-glyph
+
+%patch7 -p1 -b .png-bitmap-size
+%patch8 -p1 -b .png-memory-leak

 %build

@ -88,15 +101,10 @@ FreeType.
           --with-bzip2=yes \
           --with-png=yes \
           --enable-freetype-config \
-%if %{without bootstrap}
-           --with-harfbuzz=yes \
-%else
-           --with-harfbuzz=no \
-%endif
-           --with-brotli=yes
+           --with-harfbuzz=no
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' builds/unix/libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' builds/unix/libtool
-%make_build
+make %{?_smp_mflags}

 %if %{with_xfree86}
 # Build demos
@ -105,37 +113,35 @@ make TOP_DIR=".."
 popd
 %endif

+# Convert FTL.txt and example3.cpp to UTF-8
+pushd docs
+iconv -f latin1 -t utf-8 < FTL.TXT > FTL.TXT.tmp && \
+touch -r FTL.TXT FTL.TXT.tmp && \
+mv FTL.TXT.tmp FTL.TXT
+
+iconv -f iso-8859-1 -t utf-8 < "tutorial/example3.cpp" > "tutorial/example3.cpp.utf8"
+touch -r tutorial/example3.cpp tutorial/example3.cpp.utf8 && \
+mv tutorial/example3.cpp.utf8 tutorial/example3.cpp
+popd
+
+
 %install

 %make_install gnulocaledir=$RPM_BUILD_ROOT%{_datadir}/locale

 {
-  for ftdemo in ftbench ftdump ftlint ftvalid ttdebug ; do
+  for ftdemo in ftbench ftchkwd ftmemchk ftpatchk fttimer ftdump ftlint ftmemchk ftvalid ; do
      builds/unix/libtool --mode=install install -m 755 ft2demos-%{version}/bin/$ftdemo $RPM_BUILD_ROOT/%{_bindir}
  done
 }
 %if %{with_xfree86}
 {
-  for ftdemo in ftdiff ftgamma ftgrid ftmulti ftsdf ftstring ftview ; do
+  for ftdemo in ftdiff ftgamma ftgrid ftmulti ftstring fttimer ftview ; do
      builds/unix/libtool --mode=install install -m 755 ft2demos-%{version}/bin/$ftdemo $RPM_BUILD_ROOT/%{_bindir}
  done
 }
 %endif

-# man pages for freetype-demos
-{
-  for ftdemo in ftbench ftdump ftlint ftvalid ttdebug ; do
-      builds/unix/libtool --mode=install install -m 644 ft2demos-%{version}/man/${ftdemo}.1 $RPM_BUILD_ROOT/%{_mandir}/man1
-  done
-}
-%if %{with_xfree86}
-{
-  for ftdemo in ftdiff ftgamma ftgrid ftmulti ftsdf ftstring ftview ; do
-      builds/unix/libtool --mode=install install -m 644 ft2demos-%{version}/man/${ftdemo}.1 $RPM_BUILD_ROOT/%{_mandir}/man1
-  done
-}
-%endif
-
 # fix multilib issues
 %define wordsize %{__isa_bits}

@ -161,36 +167,26 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la}

 %files
 %{!?_licensedir:%global license %%doc}
-%license LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT
+%license docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT
 %{_libdir}/libfreetype.so.*
 %doc README

 %files demos
 %{_bindir}/ftbench
+%{_bindir}/ftchkwd
+%{_bindir}/ftmemchk
+%{_bindir}/ftpatchk
+%{_bindir}/fttimer
 %{_bindir}/ftdump
 %{_bindir}/ftlint
 %{_bindir}/ftvalid
-%{_bindir}/ttdebug
-%{_mandir}/man1/ftbench.1.gz
-%{_mandir}/man1/ftdump.1.gz
-%{_mandir}/man1/ftlint.1.gz
-%{_mandir}/man1/ftvalid.1.gz
-%{_mandir}/man1/ttdebug.1.gz
 %if %{with_xfree86}
 %{_bindir}/ftdiff
 %{_bindir}/ftgamma
 %{_bindir}/ftgrid
 %{_bindir}/ftmulti
-%{_bindir}/ftsdf
 %{_bindir}/ftstring
 %{_bindir}/ftview
-%{_mandir}/man1/ftdiff.1.gz
-%{_mandir}/man1/ftgamma.1.gz
-%{_mandir}/man1/ftgrid.1.gz
-%{_mandir}/man1/ftmulti.1.gz
-%{_mandir}/man1/ftsdf.1.gz
-%{_mandir}/man1/ftstring.1.gz
-%{_mandir}/man1/ftview.1.gz
 %endif
 %doc ChangeLog README

@ -209,131 +205,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.{a,la}
 %{_mandir}/man1/*

 %changelog
-* Wed Jul 15 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.14.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Mon Apr 13 2026 Marek Kasik <mkasik@redhat.com> - 2.14.3-1
- Update to 2.14.3
- Resolves: #2443653
-
-* Thu Feb 19 2026 Alexei Podtelezhnikov <apodtele@gmail.com> - 2.14.1-3
- Various spec fixes:
-   * Remove redundant UTF-8 conversions
-   * Do not build outdated demos
-   * Build ftsdf and ttdebug demos
- Resolves: #2440529
-
-* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.14.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Wed Oct 15 2025 Marek Kasik <mkasik@redhat.com> - 2.14.1-1
- Update to 2.14.1
- Resolves: #2393704
-
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 08 2024 Peter Robinson <pbrobinson@fedoraproject.org> - 2.13.3-1
- Update to 2.13.3
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.2-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Feb  6 2024 Marek Kasik <mkasik@redhat.com> - 2.13.2-5
- Migrated to SPDX license
-
-* Tue Jan 30 2024 Marek Kasik <mkasik@redhat.com> - 2.13.2-4
- Remove a patch which causes FTBFS
- Resolves: #2261113
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Jan 16 2024 Marek Kasik <mkasik@redhat.com> - 2.13.2-1
- Update to 2.13.2
- Resolves: #2217137
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.13.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Jun 27 2023 Marek Kasik <mkasik@redhat.com> - 2.13.1-1
- Update to 2.13.1
- Resolves: #2217137
-
-* Sat Feb 25 2023 Marek Kasik <mkasik@redhat.com> - 2.13.0-1
- Update to 2.13.0
- Resolves: #2168496
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Fri Jul  8 2022 Marek Kasik <mkasik@redhat.com> - 2.12.1-2
- Clear correct flags for doc ownership
- Resolves: #2104570
-
-* Mon May  2 2022 Marek Kasik <mkasik@redhat.com> - 2.12.1-1
- Update to 2.12.1
- Resolves: #2080714
-
-* Mon Apr 25 2022 Marek Kasik <mkasik@redhat.com> - 2.12.0-1
- Update to 2.12.0
- Resolves: #2070686
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Sat Dec 4 2021 Diego Herrera <dherrera@redhat.com> - 2.11.1-1
- Update to 2.11.1
-
-* Thu Jul 22 2021 Marek Kasik <mkasik@redhat.com> - 2.11.0-1
- Update to 2.11.0
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.10.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Fri Feb 5 2021 Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
- Enable HarfBuzz support
- Add bootstrap without HarfBuzz
- Resolves: #1853937
- Resolves: #1906714
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.10.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Fri Oct 23 2020 Marek Kasik <mkasik@redhat.com> - 2.10.4-1
- Update to 2.10.4
+* Fri Oct 23 2020 Marek Kasik <maksik@redhat.com> - 2.10.0-4
 - Test bitmap size earlier for PNGs
 - Fix memory leak in pngshim.c
- Enable man pages for demos
- Resolves: #1887084, #1890211
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.10.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 2.10.2-2
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Wed Jul 15 2020 Marek Kasik <mkasik@redhat.com> - 2.10.2-1
- Update to 2.10.2
- Enable support for WOFF2 streams
- Resolves: #1725983
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.10.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Sat Oct 12 2019 Michael Kuhn <suraia@fedoraproject.org> - 2.10.1-1
- Update to 2.10.1
- Revert FT_DebugHook_Func ABI/API changes
+- Resolves: #1890211

 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.10.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
--- a/6
+++ b/6
@ -1,3 +1,3 @@
-SHA512 (freetype-2.14.3.tar.xz) = 43de86ea70b4b47f6efaae67f3440f65a24ffac29dc6d11203a9764e4f1a749ce1ba7645acd23525220b3ba12ddad8687b962b9f1254e2c0a86070854e85d5a0
-SHA512 (freetype-doc-2.14.3.tar.xz) = f5d9bdd5119d353533a17366bfbe6d847d079f908137b1353cb9b6ce2e9ae5998dcaf7c888eeceec22b162cdb14256c6e7fefd75057250321fbcd9fcafc068f4
-SHA512 (ft2demos-2.14.3.tar.xz) = e59c1266010330a8cbfd25dec096a72ce7539b64f9c057de062a281261b3ad658240f58e75b53d7a880d7ad5e020206316a6e9e82b03dec2e4d999f3f56cb39a
+SHA512 (freetype-2.10.0.tar.bz2) = dfad66f419ea9577f09932e0730c0c887bdcbdbc8152fa7477a0c39d69a5b68476761deed6864ddcc5cf18d100a7a3f728049768e24afcb04b1a74b25b6acf7e
+SHA512 (freetype-doc-2.10.0.tar.bz2) = e0902983030b7b67443ca88f29a8bb72662de706ddff81309c66b6738b26c5d11dbd00eb75795851ddcd9f93ce05981623884afad096c0defd08bd544f5266d6
+SHA512 (ft2demos-2.10.0.tar.bz2) = d48cbabd5cc673e0af2e0c4056dba95cee8e08092f881958c6908ea2d4da7104ca81b701d47a17640ac36cbdfd8aa274cc26353bb43f026f55c00d565f2ad641