diff --git a/.gitignore b/.gitignore index e13cb52..2aff595 100644 --- a/.gitignore +++ b/.gitignore @@ -158,21 +158,3 @@ /harfbuzz-10.2.0.tar.xz /harfbuzz-10.3.0.tar.xz /harfbuzz-10.4.0.tar.xz -/harfbuzz-11.0.0.tar.xz -/harfbuzz-11.0.1.tar.xz -/harfbuzz-11.1.0.tar.xz -/harfbuzz-11.2.0.tar.xz -/harfbuzz-11.2.1.tar.xz -/harfbuzz-11.3.1.tar.xz -/harfbuzz-11.3.3.tar.xz -/harfbuzz-11.4.1.tar.xz -/harfbuzz-11.4.2.tar.xz -/harfbuzz-11.4.3.tar.xz -/harfbuzz-11.4.4.tar.xz -/harfbuzz-11.4.5.tar.xz -/harfbuzz-11.5.0.tar.xz -/harfbuzz-11.5.1.tar.xz -/harfbuzz-12.0.0.tar.xz -/harfbuzz-12.1.0.tar.xz -/harfbuzz-12.2.0.tar.xz -/harfbuzz-12.3.0.tar.xz diff --git a/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch new file mode 100644 index 0000000..81a02d6 --- /dev/null +++ b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch @@ -0,0 +1,25 @@ +From 1265ff8d990284f04d8768f35b0e20ae5f60daae Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod +Date: Fri, 9 Jan 2026 04:54:42 -0700 +Subject: [PATCH] [cmap] malloc fail test (#5710) + +Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww +--- + src/hb-ot-cmap-table.hh | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh +index 32f705bb3c5..d08e66edaa2 100644 +--- a/src/hb-ot-cmap-table.hh ++++ b/src/hb-ot-cmap-table.hh +@@ -1670,6 +1670,10 @@ struct SubtableUnicodesCache { + { + SubtableUnicodesCache* cache = + (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache)); ++ ++ if (unlikely (!cache)) ++ return nullptr; ++ + new (cache) SubtableUnicodesCache (source_table); + return cache; + } diff --git a/harfbuzz.spec b/harfbuzz.spec index 8f5f956..83a8823 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,12 +1,22 @@ Name: harfbuzz -Version: 12.3.0 -Release: 1%{?dist} +Version: 10.4.0 +Release: 2%{?dist} Summary: Text shaping library License: MIT-Modern-Variant URL: https://github.com/harfbuzz/harfbuzz/ Source0: https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz +# [cmap] malloc fail test (#5710) +# https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae +# +# Fixes: +# +# Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS +# https://www.cve.org/CVERecord?id=CVE-2026-22693 +# https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww +Patch: https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch + BuildRequires: cairo-devel BuildRequires: freetype-devel BuildRequires: glib2-devel @@ -86,6 +96,7 @@ This package contains Harfbuzz Cairo support library. %doc %{_datadir}/gtk-doc %{_bindir}/hb-info %{_bindir}/hb-view +%{_bindir}/hb-ot-shape-closure %{_bindir}/hb-shape %{_bindir}/hb-subset %{_includedir}/harfbuzz/ @@ -110,68 +121,8 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog -* Sun Dec 28 2025 Parag Nemade - 12.3.0-1 -- Update to 12.3.0 version (#2425647) - -* Fri Nov 07 2025 Parag Nemade - 12.2.0-1 -- Update to 12.2.0 version (#2412425) - -* Thu Oct 02 2025 Parag Nemade - 12.1.0-1 -- Update to 12.1.0 version (#2400640) - -* Sun Sep 28 2025 Parag Nemade - 12.0.0-1 -- Update to 12.0.0 version (#2399955) - -* Tue Sep 23 2025 Parag Nemade - 11.5.1-1 -- Update to 11.5.1 version (#2397450) - -* Sat Sep 13 2025 Parag Nemade - 11.5.0-1 -- Update to 11.5.0 version (#2394917) - -* Sun Aug 31 2025 Parag Nemade - 11.4.5-1 -- Update to 11.4.5 version (#2392114) - -* Tue Aug 26 2025 Parag Nemade - 11.4.4-1 -- Update to 11.4.4 version (#2390958) - -* Sat Aug 23 2025 Parag Nemade - 11.4.3-1 -- Update to 11.4.3 version (#2390520) - -* Thu Aug 21 2025 Parag Nemade - 11.4.2-1 -- Update to 11.4.2 version (#2390111) - -* Thu Aug 14 2025 Parag Nemade - 11.4.1-1 -- Update to 11.4.1 version (#2388377) - -* Wed Aug 06 2025 FrantiĊĦek Zatloukal - 11.3.3-2 -- Rebuilt for icu 77.1 - -* Sun Jul 27 2025 Parag Nemade - 11.3.3-1 -- Update to 11.3.3 version (#2382209) - -* Thu Jul 24 2025 Fedora Release Engineering - 11.3.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Mon Jul 21 2025 Parag Nemade - 11.3.1-1 -- Update to 11.3.1 version (#2382200) - -* Tue May 13 2025 Parag Nemade - 11.2.1-1 -- Update to 11.2.1 version (#2365793) - -* Tue Apr 29 2025 Parag Nemade - 11.2.0-1 -- Update to 11.2.0 version (#2362728) - -* Thu Apr 17 2025 Parag Nemade - 11.1.0-1 -- Update to 11.1.0 version (#2360473) - -* Sat Apr 05 2025 Parag Nemade - 11.0.1-2 -- Upstream removed hb-ot-shape-closure binary - -* Sat Apr 05 2025 Parag Nemade - 11.0.1-1 -- Update to 11.0.1 version (#2357571) - -* Mon Mar 24 2025 Parag Nemade - 11.0.0-1 -- Update to 11.0.0 version (#2354378) +* Wed Jan 14 2026 Parag Nemade - 10.4.0-2 +- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278) * Sat Mar 01 2025 Parag Nemade - 10.4.0-1 - Update to 10.4.0 version (#2349122) diff --git a/sources b/sources index 7199718..f287399 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (harfbuzz-12.3.0.tar.xz) = 7452379ee35b312cb83b5365e480dd2cc73813fa5eb489988ea7b02fa7e8137de66ea10ef71fcbbfb3275013247c46ede3f28ac9ef92c1213424ea0b0a077b03 +SHA512 (harfbuzz-10.4.0.tar.xz) = 73e202225aeef6174ebd3b8b226ad9d5afb48c40ecdc1bc26d1bc5f0cf1d832a8ffc2fe5b7ae3b7c8f848552dd57116d407f44120c6813b59dbe9faed0c346dc