Backport security fix for CVE-2026-22693 (fix RHBZ#2429278)

.gitignore

@@ -158,21 +158,3 @@
 /harfbuzz-10.2.0.tar.xz
 /harfbuzz-10.3.0.tar.xz
 /harfbuzz-10.4.0.tar.xz
-/harfbuzz-11.0.0.tar.xz
-/harfbuzz-11.0.1.tar.xz
-/harfbuzz-11.1.0.tar.xz
-/harfbuzz-11.2.0.tar.xz
-/harfbuzz-11.2.1.tar.xz
-/harfbuzz-11.3.1.tar.xz
-/harfbuzz-11.3.3.tar.xz
-/harfbuzz-11.4.1.tar.xz
-/harfbuzz-11.4.2.tar.xz
-/harfbuzz-11.4.3.tar.xz
-/harfbuzz-11.4.4.tar.xz
-/harfbuzz-11.4.5.tar.xz
-/harfbuzz-11.5.0.tar.xz
-/harfbuzz-11.5.1.tar.xz
-/harfbuzz-12.0.0.tar.xz
-/harfbuzz-12.1.0.tar.xz
-/harfbuzz-12.2.0.tar.xz
-/harfbuzz-12.3.0.tar.xz

1265ff8d990284f04d8768f35b0e20ae5f60daae.patch

@@ -0,0 +1,25 @@
+From 1265ff8d990284f04d8768f35b0e20ae5f60daae Mon Sep 17 00:00:00 2001
+From: Behdad Esfahbod <behdad@behdad.org>
+Date: Fri, 9 Jan 2026 04:54:42 -0700
+Subject: [PATCH] [cmap] malloc fail test (#5710)
+
+Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+---
+ src/hb-ot-cmap-table.hh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
+index 32f705bb3c5..d08e66edaa2 100644
+--- a/src/hb-ot-cmap-table.hh
++++ b/src/hb-ot-cmap-table.hh
+@@ -1670,6 +1670,10 @@ struct SubtableUnicodesCache {
+   {
+     SubtableUnicodesCache* cache =
+         (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache));
++
++    if (unlikely (!cache))
++      return nullptr;
++
+     new (cache) SubtableUnicodesCache (source_table);
+     return cache;
+   }

harfbuzz.spec

@@ -1,12 +1,22 @@
 Name:           harfbuzz
-Version:        12.3.0
-Release:        1%{?dist}
+Version:        10.4.0
+Release:        2%{?dist}
 Summary:        Text shaping library
 
 License:        MIT-Modern-Variant
 URL:            https://github.com/harfbuzz/harfbuzz/
 Source0:        https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz
 
+# [cmap] malloc fail test (#5710)
+# https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae
+#
+# Fixes:
+#
+# Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
+# https://www.cve.org/CVERecord?id=CVE-2026-22693
+# https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+Patch:          https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch
+
 BuildRequires:  cairo-devel
 BuildRequires:  freetype-devel
 BuildRequires:  glib2-devel
@@ -86,6 +96,7 @@ This package contains Harfbuzz Cairo support library.
 %doc %{_datadir}/gtk-doc
 %{_bindir}/hb-info
 %{_bindir}/hb-view
+%{_bindir}/hb-ot-shape-closure
 %{_bindir}/hb-shape
 %{_bindir}/hb-subset
 %{_includedir}/harfbuzz/
@@ -110,68 +121,8 @@ This package contains Harfbuzz Cairo support library.
 %{_libdir}/libharfbuzz-cairo.so.*
 
 %changelog
-* Sun Dec 28 2025 Parag Nemade <pnemade AT redhat DOT com> - 12.3.0-1
-- Update to 12.3.0 version (#2425647)
-
-* Fri Nov 07 2025 Parag Nemade <pnemade AT redhat DOT com> - 12.2.0-1
-- Update to 12.2.0 version (#2412425)
-
-* Thu Oct 02 2025 Parag Nemade <pnemade AT redhat DOT com> - 12.1.0-1
-- Update to 12.1.0 version (#2400640)
-
-* Sun Sep 28 2025 Parag Nemade <pnemade AT redhat DOT com> - 12.0.0-1
-- Update to 12.0.0 version (#2399955)
-
-* Tue Sep 23 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.5.1-1
-- Update to 11.5.1 version (#2397450)
-
-* Sat Sep 13 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.5.0-1
-- Update to 11.5.0 version (#2394917)
-
-* Sun Aug 31 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.4.5-1
-- Update to 11.4.5 version (#2392114)
-
-* Tue Aug 26 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.4.4-1
-- Update to 11.4.4 version (#2390958)
-
-* Sat Aug 23 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.4.3-1
-- Update to 11.4.3 version (#2390520)
-
-* Thu Aug 21 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.4.2-1
-- Update to 11.4.2 version (#2390111)
-
-* Thu Aug 14 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.4.1-1
-- Update to 11.4.1 version (#2388377)
-
-* Wed Aug 06 2025 František Zatloukal <fzatlouk@redhat.com> - 11.3.3-2
-- Rebuilt for icu 77.1
-
-* Sun Jul 27 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.3.3-1
-- Update to 11.3.3 version (#2382209)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 11.3.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jul 21 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.3.1-1
-- Update to 11.3.1 version (#2382200)
-
-* Tue May 13 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.2.1-1
-- Update to 11.2.1 version (#2365793)
-
-* Tue Apr 29 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.2.0-1
-- Update to 11.2.0 version (#2362728)
-
-* Thu Apr 17 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.1.0-1
-- Update to 11.1.0 version (#2360473)
-
-* Sat Apr 05 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.0.1-2
-- Upstream removed hb-ot-shape-closure binary
-
-* Sat Apr 05 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.0.1-1
-- Update to 11.0.1 version (#2357571)
-
-* Mon Mar 24 2025 Parag Nemade <pnemade AT redhat DOT com> - 11.0.0-1
-- Update to 11.0.0 version (#2354378)
+* Wed Jan 14 2026 Parag Nemade <pnemade AT redhat DOT com> - 10.4.0-2
+- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278)
 
 * Sat Mar 01 2025 Parag Nemade <pnemade AT redhat DOT com> - 10.4.0-1
 - Update to 10.4.0 version (#2349122)

sources

@@ -1 +1 @@
-SHA512 (harfbuzz-12.3.0.tar.xz) = 7452379ee35b312cb83b5365e480dd2cc73813fa5eb489988ea7b02fa7e8137de66ea10ef71fcbbfb3275013247c46ede3f28ac9ef92c1213424ea0b0a077b03
+SHA512 (harfbuzz-10.4.0.tar.xz) = 73e202225aeef6174ebd3b8b226ad9d5afb48c40ecdc1bc26d1bc5f0cf1d832a8ffc2fe5b7ae3b7c8f848552dd57116d407f44120c6813b59dbe9faed0c346dc