Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

- Various other fixes collected by Debian and contributed back upstream
  to the sfnt2woff-zopfli fork:
  https://github.com/bramstein/sfnt2woff-zopfli/pull/20

.gitignore

@@ -0,0 +1 @@
+woff-code-latest.zip

21.patch

@@ -0,0 +1,82 @@
+From a6a68208356f3d6e32bb3f32efbdb86cd9695f55 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sat, 10 May 2025 21:47:31 -0400
+Subject: [PATCH] Update GPL/LGPL license texts for remote-only FSF
+
+The FSF is now remote-only and no longer has a street address.
+
+The license texts LICENSE-WOFF-GPL and LICENSE-WOFF-LGPL are updated
+from https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt and
+https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt, respectively.
+---
+ LICENSE-WOFF-GPL  | 9 ++++-----
+ LICENSE-WOFF-LGPL | 9 ++++-----
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/LICENSE-WOFF-GPL b/LICENSE-WOFF-GPL
+index d159169..9efa6fb 100644
+--- a/LICENSE-WOFF-GPL
++++ b/LICENSE-WOFF-GPL
+@@ -2,7 +2,7 @@
+                        Version 2, June 1991
+ 
+  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
++ <https://fsf.org/>
+  Everyone is permitted to copy and distribute verbatim copies
+  of this license document, but changing it is not allowed.
+ 
+@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found.
+     GNU General Public License for more details.
+ 
+     You should have received a copy of the GNU General Public License along
+-    with this program; if not, write to the Free Software Foundation, Inc.,
+-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++    with this program; if not, see <https://www.gnu.org/licenses/>.
+ 
+ Also add information on how to contact you by electronic and paper mail.
+ 
+@@ -329,8 +328,8 @@ necessary.  Here is a sample; alter the names:
+   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+   `Gnomovision' (which makes passes at compilers) written by James Hacker.
+ 
+-  <signature of Ty Coon>, 1 April 1989
+-  Ty Coon, President of Vice
++  <signature of Moe Ghoul>, 1 April 1989
++  Moe Ghoul, President of Vice
+ 
+ This General Public License does not permit incorporating your program into
+ proprietary programs.  If your program is a subroutine library, you may
+diff --git a/LICENSE-WOFF-LGPL b/LICENSE-WOFF-LGPL
+index 4362b49..f6683e7 100644
+--- a/LICENSE-WOFF-LGPL
++++ b/LICENSE-WOFF-LGPL
+@@ -2,7 +2,7 @@
+                        Version 2.1, February 1999
+ 
+  Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
++ <https://fsf.org/>
+  Everyone is permitted to copy and distribute verbatim copies
+  of this license document, but changing it is not allowed.
+ 
+@@ -484,8 +484,7 @@ convey the exclusion of warranty; and each file should have at least the
+     Lesser General Public License for more details.
+ 
+     You should have received a copy of the GNU Lesser General Public
+-    License along with this library; if not, write to the Free Software
+-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
++    License along with this library; if not, see <https://www.gnu.org/licenses/>.
+ 
+ Also add information on how to contact you by electronic and paper mail.
+ 
+@@ -496,7 +495,7 @@ necessary.  Here is a sample; alter the names:
+   Yoyodyne, Inc., hereby disclaims all copyright interest in the
+   library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+ 
+-  <signature of Ty Coon>, 1 April 1990
+-  Ty Coon, President of Vice
++  <signature of Moe Ghoul>, 1 April 1990
++  Moe Ghoul, President of Vice
+ 
+ That's all there is to it!

CVE-2010-1028.patch

@@ -0,0 +1,48 @@
+Description: Fix CVE-2010-1028: WOFF heap corruption due to integer overflow
+Origin: mozilla-central, https://hg.mozilla.org/releases/mozilla-1.9.2/rev/827a6883442f
+Last-Update: 2013-04-09
+
+--- a/woff.c
++++ b/woff.c
+@@ -626,7 +626,7 @@
+   const woffHeader * header;
+   uint16_t numTables, i;
+   const woffDirEntry * dirEntry;
+-  uint32_t tableTotal = 0;
++  uint64_t tableTotal = 0;
+ 
+   if (!woffData || !woffLen) {
+     return eWOFF_bad_parameter;
+@@ -652,17 +652,17 @@
+ 
+   dirEntry = (const woffDirEntry *) (woffData + sizeof(woffHeader));
+   for (i = 0; i < numTables; ++i) {
+-    uint32_t offs = READ32BE(dirEntry->offset);
+-    uint32_t orig = READ32BE(dirEntry->origLen);
+-    uint32_t comp = READ32BE(dirEntry->compLen);
++    uint64_t offs = READ32BE(dirEntry->offset);
++    uint64_t orig = READ32BE(dirEntry->origLen);
++    uint64_t comp = READ32BE(dirEntry->compLen);
+     if (comp > orig || comp > woffLen || offs > woffLen - comp) {
+       return eWOFF_invalid;
+     }
+     orig = (orig + 3) & ~3;
+-    if (tableTotal > 0xffffffffU - orig) {
++    tableTotal += orig;
++    if (tableTotal > 0xffffffffU) {
+       return eWOFF_invalid;
+     }
+-    tableTotal += orig;
+     ++dirEntry;
+   }
+ 
+--- a/woff.h
++++ b/woff.h
+@@ -48,6 +48,7 @@
+ typedef unsigned char  uint8_t;
+ typedef unsigned short uint16_t;
+ typedef unsigned int   uint32_t;
++typedef unsigned __int64  uint64_t;
+ #else
+ #include <inttypes.h>
+ #endif

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: woff
-# $Id$
-NAME := woff
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

add-overflow-checks.patch

@@ -0,0 +1,126 @@
+Description: Add arithmetic overflow checks in woff encoding routines
+Origin: mozilla-central, https://hg.mozilla.org/mozilla-central/rev/69eb050f2c0a
+Last-Update: 2013-04-11
+
+--- a/woff.c
++++ b/woff.c
+@@ -89,10 +89,15 @@
+   const uint32_t * csumPtr;
+   const uint32_t * csumEnd;
+   uint32_t csum = 0;
+-  uint32_t length = LONGALIGN(READ32BE(dirEntry->length));
++  uint32_t length = READ32BE(dirEntry->length);
+   uint32_t offset = READ32BE(dirEntry->offset);
+   uint32_t tag;
+-  if ((offset & 3) != 0) {
++  if (LONGALIGN(length) < length) { /* overflow */
++    return csum;
++  } else {
++    length = LONGALIGN(length);
++  }
++  if ((offset & 3) != 0) { /* invalid - not properly aligned */
+     return csum;
+   }
+   if (length > sfntLen || offset > sfntLen - length) {
+@@ -224,6 +229,9 @@
+       if (tag == TABLE_TAG_DSIG) {
+         status |= eWOFF_warn_removed_DSIG;
+         removedDsigSize = READ32BE(sfntDir[tableIndex].length);
++        if (LONGALIGN(removedDsigSize) < removedDsigSize) {
++          FAIL(eWOFF_invalid);
++        }
+         continue;
+       }
+     }
+@@ -235,6 +243,7 @@
+   qsort(tableOrder, numTables, sizeof(tableOrderRec), compareOffsets);
+ 
+   /* initially, allocate space for header and directory */
++  /* cannot be too big because numTables is 16-bit */
+   tableOffset = sizeof(woffHeader) + numTables * sizeof(woffDirEntry);
+   woffData = (uint8_t *) malloc(tableOffset);
+   if (!woffData) {
+@@ -277,7 +286,15 @@
+     if (sourceLen > sfntLen || sourceOffset > sfntLen - sourceLen) {
+       FAIL(eWOFF_invalid);
+     }
+-    destLen = LONGALIGN(compressBound(sourceLen));
++    destLen = compressBound(sourceLen);
++    if (LONGALIGN(destLen) < destLen) {
++      /* something weird is going on if this overflows! */
++      FAIL(eWOFF_invalid);
++    }
++    destLen = LONGALIGN(destLen);
++    if (tableOffset + destLen < tableOffset) {
++      FAIL(eWOFF_invalid);
++    }
+     woffData = (uint8_t *) realloc(woffData, tableOffset + destLen);
+     if (!woffData) {
+       FAIL(eWOFF_out_of_memory);
+@@ -291,13 +308,19 @@
+     }
+     if (destLen < sourceLen) {
+       /* compressed table was smaller */
+-      tableOffset += destLen;
++      tableOffset += destLen; /* checked for potential overflow above */
+       WOFFDIR[newIndex].compLen = READ32BE(destLen);
+     } else {
+       /* compression didn't make it smaller, so store original data instead */
++      if (LONGALIGN(sourceLen) < sourceLen) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       destLen = sourceLen;
+       /* reallocate to ensure enough space for the table,
+          plus potential padding after it */
++      if (tableOffset + LONGALIGN(sourceLen) < tableOffset) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       woffData = (uint8_t *) realloc(woffData,
+                                      tableOffset + LONGALIGN(sourceLen));
+       if (!woffData) {
+@@ -306,6 +329,9 @@
+       /* copy the original data into place */
+       memcpy(woffData + tableOffset,
+              sfntData + READ32BE(sfntDir[oldIndex].offset), sourceLen);
++      if (tableOffset + sourceLen < tableOffset) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       tableOffset += sourceLen;
+       WOFFDIR[newIndex].compLen = WOFFDIR[newIndex].origLen;
+     }
+@@ -316,7 +342,13 @@
+     }
+ 
+     /* update total size of uncompressed OpenType with table size */
++    if (totalSfntSize + sourceLen < totalSfntSize) {
++      FAIL(eWOFF_invalid); /* overflow, bail out */
++    }
+     totalSfntSize += sourceLen;
++    if (LONGALIGN(totalSfntSize) < totalSfntSize) {
++      FAIL(eWOFF_invalid);
++    }
+     totalSfntSize = LONGALIGN(totalSfntSize);
+   }
+ 
+@@ -442,10 +474,20 @@
+ 
+   totalSize = tableLimit; /* already long-aligned */
+   if (metaCompLen) {
++    if (totalSize + metaCompLen < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
+     totalSize += metaCompLen;
+   }
+   if (privLen) {
+-    totalSize = LONGALIGN(totalSize) + privLen;
++    if (LONGALIGN(totalSize) < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
++    totalSize = LONGALIGN(totalSize);
++    if (totalSize + privLen < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
++    totalSize += privLen;
+   }
+   newData = malloc(totalSize);
+   if (!newData) {

changelog

@@ -0,0 +1,87 @@
+* Tue Nov 29 2022 Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-27
+- Clarify URL/Source situation, and do not claim to have a working source
+  archive URL
+- General tidying of spec file; use modern macros and install HTML format
+  description as documentation
+- Add hand-written man pages
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-26
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Sun Jun 05 2022 Benson Muite <benson_muite@emailplus.org> - 0.20091126-26
+- Source URL update
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-25
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-21
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-20
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Feb 19 2018 Parag Nemade <pnemade AT redhat DOT com> - 0.20091126-17
+- Add BuildRequires: gcc as per packaging guidelines
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-16
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Feb 11 2016 Parag Nemade <pnemade AT redhat DOT com>- 0.20091126-12
+- Clean the spec file
+
+* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.20091126-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.20091126-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Sun Nov 29 2009 Parag Nemade <pnemade@redhat.com>- 0.20091126-2.fc12
+- Added BR:zlib-devel
+
+* Fri Nov 27 2009 Parag Nemade <pnemade@redhat.com>- 0.20091126-1.fc12
+- Initial specfile for Fedora

fix-compiler-and-cppcheck-warnings.patch

@@ -0,0 +1,61 @@
+Description: fix some compiler and cppcheck warnings
+ - Remove two unused variables;
+ - Fix a memory leak when realloc() fails.
+Author: Dmitry Shachnev <mitya57@gmail.com>
+Forwarded: no
+Last-Update: 2013-04-11
+
+--- a/woff.c
++++ b/woff.c
+@@ -127,6 +127,7 @@
+            uint32_t * woffLen, uint32_t * pStatus)
+ {
+   uint8_t * woffData = NULL;
++  uint8_t * woffDataNew = NULL;
+   tableOrderRec * tableOrder = NULL;
+ 
+   uint32_t tableOffset;
+@@ -137,7 +138,6 @@
+   uint16_t tableIndex;
+   uint16_t order;
+   const sfntDirEntry * sfntDir;
+-  uint32_t tableBase;
+   uint32_t checkSumAdjustment = 0;
+   woffHeader * newHeader;
+   uint32_t tag = 0;
+@@ -295,8 +295,10 @@
+     if (tableOffset + destLen < tableOffset) {
+       FAIL(eWOFF_invalid);
+     }
+-    woffData = (uint8_t *) realloc(woffData, tableOffset + destLen);
+-    if (!woffData) {
++    woffDataNew = (uint8_t *) realloc(woffData, tableOffset + destLen);
++    if (woffDataNew) {
++      woffData = woffDataNew;
++    } else {
+       FAIL(eWOFF_out_of_memory);
+     }
+ 
+@@ -321,9 +323,11 @@
+       if (tableOffset + LONGALIGN(sourceLen) < tableOffset) {
+         FAIL(eWOFF_invalid); /* overflow, bail out */
+       }
+-      woffData = (uint8_t *) realloc(woffData,
+-                                     tableOffset + LONGALIGN(sourceLen));
+-      if (!woffData) {
++      woffDataNew = (uint8_t *) realloc(woffData,
++                                        tableOffset + LONGALIGN(sourceLen));
++      if (woffDataNew) {
++        woffData = woffDataNew;
++      } else {
+         FAIL(eWOFF_out_of_memory);
+       }
+       /* copy the original data into place */
+@@ -435,7 +439,6 @@
+   const woffHeader * origHeader;
+   const woffDirEntry * woffDir;
+   uint8_t * newData = NULL;
+-  uint8_t * tableData = NULL;
+   woffHeader * newHeader;
+   uint16_t numTables;
+   uint32_t tableLimit, totalSize, offset;

possible-double-free.patch

@@ -0,0 +1,11 @@
+diff -Naur a/woff.c b/woff.c
+--- a/woff.c	2009-09-25 09:54:13.000000000 -0400
++++ b/woff.c	2022-11-29 10:09:15.091798523 -0500
+@@ -354,6 +354,7 @@
+   newHeader->privLen = 0;
+ 
+   free(tableOrder);
++  tableOrder = 0;
+ 
+   if ((status & eWOFF_warn_checksum_mismatch) != 0) {
+     /* The original font had checksum errors, so we now decode our WOFF data

segfault-debian-bug-785795.patch

@@ -0,0 +1,39 @@
+diff -Naur a/woff.c b/woff.c
+--- a/woff.c	2009-09-25 09:54:13.000000000 -0400
++++ b/woff.c	2025-05-10 23:08:38.166716854 -0400
+@@ -174,6 +174,8 @@
+       }
+       head = (const sfntHeadTable *)(sfntData +
+                                      READ32BE(sfntDir[tableIndex].offset));
++      if ((uint8_t *)(head + 1) >= sfntData + sfntLen)
++       FAIL(eWOFF_invalid);
+     }
+   }
+   if (!head) {
+@@ -752,7 +754,7 @@
+   newHeader = (sfntHeader *) (sfntData);
+   newHeader->version = header->flavor;
+   newHeader->numTables = READ16BE(numTables);
+-  
++
+   /* calculate header fields for binary search */
+   searchRange = numTables;
+   searchRange |= (searchRange >> 1);
+@@ -1015,7 +1017,7 @@
+   if (pStatus) {
+     *pStatus = status;
+   }
+-  return NULL;    
++  return NULL;
+ }
+ 
+ const uint8_t *
+@@ -1070,7 +1072,7 @@
+   if (pStatus) {
+     *pStatus = status;
+   }
+-  return NULL;    
++  return NULL;
+ }
+ 
+ void

sfnt2woff.1

@@ -0,0 +1,35 @@
+.TH sfnt2woff "1" "November 2020" sfnt2woff\-zopfli "User Commands"
+.SH NAME
+sfnt2woff \- package OpenType
+.I otffile
+as WOFF, creating
+.IR otffile .woff
+.SH SYNOPSIS
+sfnt2woff
+.RB [ \-v
+.IR maj . min ]
+.RB [ \-m
+.IR metadata.xml ]
+.RB [ \-p
+.IR private.dat ]
+.I otffile
+.SH DESCRIPTION
+.PP
+Packages OpenType
+.I otffile
+as WOFF, creating
+.IR otffile .woff.
+.SH OPTIONS
+.TP
+\fB\-v\fR \fImaj\fR.\fImin
+set font version number (major and minor, both integers)
+.TP
+\fB\-m\fR \fImetadata.xml
+include metadata from
+.I metadata.xml
+(not validated)
+.TP
+\fB\-p\fR \fIprivate.dat
+include private data block
+.SH "SEE ALSO"
+.BR woff2sfnt (1)

sources

@@ -0,0 +1 @@
+1dcdbc9a7f48086185740c185d822279  woff-code-latest.zip

woff.rpmlintrc

@@ -0,0 +1,2 @@
+# Intentional, with a justifying spec-file comment
+addFilter(r" no-%check-section")

woff.spec

@@ -0,0 +1,111 @@
+Name:           woff
+Version:        0.20091126
+Release:        %autorelease
+Summary:        Encoding and decoding for Web Open Font Format (WOFF)
+
+License:        MPL-1.0 OR GPL-2.0-or-later OR LGPL-2.0-or-later
+# Note that the URL http://people.mozilla.org/~jkew/woff/, where the original
+# WOFF reference implementation sources were published, is no longer available.
+# A copy of that page can be found at
+# https://web.archive.org/web/20170630235618/https://people-mozilla.org/~jkew/woff/,
+# and the sources are mirrored at https://github.com/TheJessieKirk/sfnt2woff.
+%global original_url https://people-mozilla.org/~jkew/woff/
+# The URL is no longer active, so we reference an archived copy:
+URL:            https://web.archive.org/web/20170630235618/%{original_url}
+# There is no longer a working URL for this archive.
+Source0:        %{original_url}/woff-code-latest.zip
+# Hand-written for Fedora in groff_man(7) format based on --help output
+Source1:        sfnt2woff.1
+Source2:        woff2sfnt.1
+
+# It’s possible that tableOrder could be freed twice if a failure occurs. Set
+# the pointer null after freeing it to prevent this. There is no current
+# upstream to which this could be reported; however, this was reported to the
+# sfnt2woff-zopfli fork:
+#
+# Fix a possible double free in woffEncode()
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/18
+Patch:          possible-double-free.patch
+
+# Add full text of the three WOFF licenses:
+#   - LICENSE-WOFF-MPL, from
+#     https://www.mozilla.org/media/MPL/1.1/index.0c5913925d40.txt
+#   - LICENSE-WOFF-GPL, from
+#     https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
+#   - LICENSE-WOFF-LGPL, from
+#     https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt
+# https://github.com/bramstein/sfnt2woff-zopfli/commit/7e08f1c944142c8e37050d9e02d91ec326d60ba5
+Patch:          https://github.com/bramstein/sfnt2woff-zopfli/commit/7e08f1c944142c8e37050d9e02d91ec326d60ba5.patch
+# Update GPL/LGPL license texts for remote-only FS
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/21
+Patch:          https://github.com/bramstein/sfnt2woff-zopfli/pull/21.patch
+
+# Fix segfault due to https://bugs.debian.org/785795.
+#   Remaining Debian patch rollup
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/20
+# Since the patches from the sfnt2woff-zopfli do not apply directly, we link
+# the patches Debian uses for woff (which they call woff-tools) where possible;
+# see https://sources.debian.org/patches/woff-tools/0:2009.10.04-2.
+# - Fix segfault due to https://bugs.debian.org/785795
+#   https://github.com/bramstein/sfnt2woff-zopfli/pull/20/commits/51d74ebc4ab782f9e272fa4f135ee2375c991a5b
+#   Rebased from the sfnt2woff-zopfli fork onto the original woff release
+Patch:          segfault-debian-bug-785795.patch
+# - Add arithmetic overflow checks in woff encoding routines
+Patch:          https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/add-overflow-checks.patch
+# - Fix CVE-2010-1028: WOFF heap corruption due to integer overflow
+Patch:          https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/CVE-2010-1028.patch
+# - fix some compiler and cppcheck warnings
+Patch:          https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/fix-compiler-and-cppcheck-warnings.patch
+
+# https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval
+ExcludeArch:    %{ix86}
+
+BuildRequires:  make
+BuildRequires:  gcc
+
+BuildRequires:  zlib-devel
+
+%description
+Provides the sfnt2woff and woff2sfnt command-line tools for encoding and
+decoding Web Open Font Format (WOFF) files.
+
+%prep
+%autosetup -c -p1
+
+
+%build
+%make_build CFLAGS="${CFLAGS}"
+awk '
+    /BEGIN LICENSE BLOCK/ { b = 1 }
+    b
+    /END LICENSE BLOCK/ { b = 0 }' woff.c |
+  tee LICENSE-WOFF
+
+
+%install
+# The Makefile has no install target.
+install -D --preserve-timestamps \
+    --target='%{buildroot}%{_bindir}' sfnt2woff woff2sfnt
+install -D --preserve-timestamps --mode=0644 \
+    --target='%{buildroot}%{_mandir}/man1' '%{SOURCE1}' '%{SOURCE2}'
+
+
+# Upstream provides no tests
+
+
+%files
+%license LICENSE-WOFF
+%license LICENSE-WOFF-MPL
+%license LICENSE-WOFF-GPL
+%license LICENSE-WOFF-LGPL
+
+%doc woff-2009-10-03.html
+
+%{_bindir}/sfnt2woff
+%{_bindir}/woff2sfnt
+%{_mandir}/man1/sfnt2woff.1*
+%{_mandir}/man1/woff2sfnt.1*
+
+
+%changelog
+%autochangelog

woff2sfnt.1

@@ -0,0 +1,33 @@
+.TH woff2sfnt "1" "November 2020" woff2sfnt "User Commands"
+.SH NAME
+woff2sfnt \- decode WOFF file
+.IR woff ,
+writing OpenType data to
+.B stdout
+.SH SYNOPSIS
+woff2sfnt
+.RB [ \-v \ |\  \-m \ |\  \-p ]
+.I woff
+.SH DESCRIPTION
+.PP
+Decodes WOFF file
+.IR woff ,
+writing OpenType data to
+.BR stdout .
+.SH OPTIONS
+.TP
+.B \-v
+write font version to
+.B stdout
+.TP
+.B \-m
+write WOFF metadata block to
+.B stdout
+.TP
+.B \-p
+write private data block to
+.B stdout
+.SH NOTES
+Only one of \fB\-v\fR, \fB\-m\fR, \fB\-p\fR may be used at a time.
+.SH "SEE ALSO"
+.BR sfnt2woff (1)