From 7a21499d6c8740e1b9d420a99452125bf76b0023 Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Tue, 13 Jan 2026 20:24:32 +0000
Subject: [PATCH 1/3] Backport security fix for CVE-2026-22693 (fix
 RHBZ#2429278)

---
 ...ff8d990284f04d8768f35b0e20ae5f60daae.patch | 25 +++++++++++++++++++
 harfbuzz.spec                                 | 10 ++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 1265ff8d990284f04d8768f35b0e20ae5f60daae.patch

diff --git a/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch
new file mode 100644
index 0000000..81a02d6
--- /dev/null
+++ b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch
@@ -0,0 +1,25 @@
+From 1265ff8d990284f04d8768f35b0e20ae5f60daae Mon Sep 17 00:00:00 2001
+From: Behdad Esfahbod <behdad@behdad.org>
+Date: Fri, 9 Jan 2026 04:54:42 -0700
+Subject: [PATCH] [cmap] malloc fail test (#5710)
+
+Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+---
+ src/hb-ot-cmap-table.hh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
+index 32f705bb3c5..d08e66edaa2 100644
+--- a/src/hb-ot-cmap-table.hh
++++ b/src/hb-ot-cmap-table.hh
+@@ -1670,6 +1670,10 @@ struct SubtableUnicodesCache {
+   {
+     SubtableUnicodesCache* cache =
+         (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache));
++
++    if (unlikely (!cache))
++      return nullptr;
++
+     new (cache) SubtableUnicodesCache (source_table);
+     return cache;
+   }
diff --git a/harfbuzz.spec b/harfbuzz.spec
index f100dfa..dfc0ec8 100644
--- a/harfbuzz.spec
+++ b/harfbuzz.spec
@@ -7,6 +7,16 @@ License:        MIT-Modern-Variant
 URL:            https://github.com/harfbuzz/harfbuzz/
 Source0:        https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz
 
+# [cmap] malloc fail test (#5710)
+# https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae
+#
+# Fixes:
+#
+# Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
+# https://www.cve.org/CVERecord?id=CVE-2026-22693
+# https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+Patch:          https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch
+
 BuildRequires:  cairo-devel
 BuildRequires:  freetype-devel
 BuildRequires:  glib2-devel

From 2098470dff67ba1a026816bd76a0d06c992596ca Mon Sep 17 00:00:00 2001
From: Parag Nemade <pnemade AT redhat DOT com>
Date: Wed, 14 Jan 2026 17:50:28 +0530
Subject: [PATCH 2/3] Backport security fix for CVE-2026-22693 (fix
 RHBZ#2429278)

---
 harfbuzz.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/harfbuzz.spec b/harfbuzz.spec
index dfc0ec8..76a49e3 100644
--- a/harfbuzz.spec
+++ b/harfbuzz.spec
@@ -1,6 +1,6 @@
 Name:           harfbuzz
 Version:        11.5.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Text shaping library
 
 License:        MIT-Modern-Variant
@@ -120,6 +120,9 @@ This package contains Harfbuzz Cairo support library.
 %{_libdir}/libharfbuzz-cairo.so.*
 
 %changelog
+* Wed Jan 14 2026 Parag Nemade <pnemade AT redhat DOT com> - 11.5.1-2
+- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278)
+
 * Tue Sep 23 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.5.1-1
 - Update to 11.5.1 version (#2397450)
 

From 2bf11dcc86b41a51d2b2d6e400850c0272b39015 Mon Sep 17 00:00:00 2001
From: Parag Nemade <pnemade AT redhat DOT com>
Date: Wed, 14 Jan 2026 17:52:58 +0530
Subject: [PATCH 3/3] Backport security fix for CVE-2026-22693 (fix
 RHBZ#2429288)

---
 harfbuzz.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/harfbuzz.spec b/harfbuzz.spec
index 76a49e3..bb213da 100644
--- a/harfbuzz.spec
+++ b/harfbuzz.spec
@@ -121,7 +121,7 @@ This package contains Harfbuzz Cairo support library.
 
 %changelog
 * Wed Jan 14 2026 Parag Nemade <pnemade AT redhat DOT com> - 11.5.1-2
-- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278)
+- Backport security fix for CVE-2026-22693 (fix RHBZ#2429288)
 
 * Tue Sep 23 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.5.1-1
 - Update to 11.5.1 version (#2397450)