Security fix for CVE-2010-1028

- Various other fixes collected by Debian and contributed back upstream
  to the sfnt2woff-zopfli fork:
  https://github.com/bramstein/sfnt2woff-zopfli/pull/20

21.patch

@@ -0,0 +1,82 @@
+From a6a68208356f3d6e32bb3f32efbdb86cd9695f55 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Sat, 10 May 2025 21:47:31 -0400
+Subject: [PATCH] Update GPL/LGPL license texts for remote-only FSF
+
+The FSF is now remote-only and no longer has a street address.
+
+The license texts LICENSE-WOFF-GPL and LICENSE-WOFF-LGPL are updated
+from https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt and
+https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt, respectively.
+---
+ LICENSE-WOFF-GPL  | 9 ++++-----
+ LICENSE-WOFF-LGPL | 9 ++++-----
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/LICENSE-WOFF-GPL b/LICENSE-WOFF-GPL
+index d159169..9efa6fb 100644
+--- a/LICENSE-WOFF-GPL
++++ b/LICENSE-WOFF-GPL
+@@ -2,7 +2,7 @@
+                        Version 2, June 1991
+ 
+  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
++ <https://fsf.org/>
+  Everyone is permitted to copy and distribute verbatim copies
+  of this license document, but changing it is not allowed.
+ 
+@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found.
+     GNU General Public License for more details.
+ 
+     You should have received a copy of the GNU General Public License along
+-    with this program; if not, write to the Free Software Foundation, Inc.,
+-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++    with this program; if not, see <https://www.gnu.org/licenses/>.
+ 
+ Also add information on how to contact you by electronic and paper mail.
+ 
+@@ -329,8 +328,8 @@ necessary.  Here is a sample; alter the names:
+   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+   `Gnomovision' (which makes passes at compilers) written by James Hacker.
+ 
+-  <signature of Ty Coon>, 1 April 1989
+-  Ty Coon, President of Vice
++  <signature of Moe Ghoul>, 1 April 1989
++  Moe Ghoul, President of Vice
+ 
+ This General Public License does not permit incorporating your program into
+ proprietary programs.  If your program is a subroutine library, you may
+diff --git a/LICENSE-WOFF-LGPL b/LICENSE-WOFF-LGPL
+index 4362b49..f6683e7 100644
+--- a/LICENSE-WOFF-LGPL
++++ b/LICENSE-WOFF-LGPL
+@@ -2,7 +2,7 @@
+                        Version 2.1, February 1999
+ 
+  Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
++ <https://fsf.org/>
+  Everyone is permitted to copy and distribute verbatim copies
+  of this license document, but changing it is not allowed.
+ 
+@@ -484,8 +484,7 @@ convey the exclusion of warranty; and each file should have at least the
+     Lesser General Public License for more details.
+ 
+     You should have received a copy of the GNU Lesser General Public
+-    License along with this library; if not, write to the Free Software
+-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
++    License along with this library; if not, see <https://www.gnu.org/licenses/>.
+ 
+ Also add information on how to contact you by electronic and paper mail.
+ 
+@@ -496,7 +495,7 @@ necessary.  Here is a sample; alter the names:
+   Yoyodyne, Inc., hereby disclaims all copyright interest in the
+   library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+ 
+-  <signature of Ty Coon>, 1 April 1990
+-  Ty Coon, President of Vice
++  <signature of Moe Ghoul>, 1 April 1990
++  Moe Ghoul, President of Vice
+ 
+ That's all there is to it!

CVE-2010-1028.patch

@@ -0,0 +1,48 @@
+Description: Fix CVE-2010-1028: WOFF heap corruption due to integer overflow
+Origin: mozilla-central, https://hg.mozilla.org/releases/mozilla-1.9.2/rev/827a6883442f
+Last-Update: 2013-04-09
+
+--- a/woff.c
++++ b/woff.c
+@@ -626,7 +626,7 @@
+   const woffHeader * header;
+   uint16_t numTables, i;
+   const woffDirEntry * dirEntry;
+-  uint32_t tableTotal = 0;
++  uint64_t tableTotal = 0;
+ 
+   if (!woffData || !woffLen) {
+     return eWOFF_bad_parameter;
+@@ -652,17 +652,17 @@
+ 
+   dirEntry = (const woffDirEntry *) (woffData + sizeof(woffHeader));
+   for (i = 0; i < numTables; ++i) {
+-    uint32_t offs = READ32BE(dirEntry->offset);
+-    uint32_t orig = READ32BE(dirEntry->origLen);
+-    uint32_t comp = READ32BE(dirEntry->compLen);
++    uint64_t offs = READ32BE(dirEntry->offset);
++    uint64_t orig = READ32BE(dirEntry->origLen);
++    uint64_t comp = READ32BE(dirEntry->compLen);
+     if (comp > orig || comp > woffLen || offs > woffLen - comp) {
+       return eWOFF_invalid;
+     }
+     orig = (orig + 3) & ~3;
+-    if (tableTotal > 0xffffffffU - orig) {
++    tableTotal += orig;
++    if (tableTotal > 0xffffffffU) {
+       return eWOFF_invalid;
+     }
+-    tableTotal += orig;
+     ++dirEntry;
+   }
+ 
+--- a/woff.h
++++ b/woff.h
+@@ -48,6 +48,7 @@
+ typedef unsigned char  uint8_t;
+ typedef unsigned short uint16_t;
+ typedef unsigned int   uint32_t;
++typedef unsigned __int64  uint64_t;
+ #else
+ #include <inttypes.h>
+ #endif

add-overflow-checks.patch

@@ -0,0 +1,126 @@
+Description: Add arithmetic overflow checks in woff encoding routines
+Origin: mozilla-central, https://hg.mozilla.org/mozilla-central/rev/69eb050f2c0a
+Last-Update: 2013-04-11
+
+--- a/woff.c
++++ b/woff.c
+@@ -89,10 +89,15 @@
+   const uint32_t * csumPtr;
+   const uint32_t * csumEnd;
+   uint32_t csum = 0;
+-  uint32_t length = LONGALIGN(READ32BE(dirEntry->length));
++  uint32_t length = READ32BE(dirEntry->length);
+   uint32_t offset = READ32BE(dirEntry->offset);
+   uint32_t tag;
+-  if ((offset & 3) != 0) {
++  if (LONGALIGN(length) < length) { /* overflow */
++    return csum;
++  } else {
++    length = LONGALIGN(length);
++  }
++  if ((offset & 3) != 0) { /* invalid - not properly aligned */
+     return csum;
+   }
+   if (length > sfntLen || offset > sfntLen - length) {
+@@ -224,6 +229,9 @@
+       if (tag == TABLE_TAG_DSIG) {
+         status |= eWOFF_warn_removed_DSIG;
+         removedDsigSize = READ32BE(sfntDir[tableIndex].length);
++        if (LONGALIGN(removedDsigSize) < removedDsigSize) {
++          FAIL(eWOFF_invalid);
++        }
+         continue;
+       }
+     }
+@@ -235,6 +243,7 @@
+   qsort(tableOrder, numTables, sizeof(tableOrderRec), compareOffsets);
+ 
+   /* initially, allocate space for header and directory */
++  /* cannot be too big because numTables is 16-bit */
+   tableOffset = sizeof(woffHeader) + numTables * sizeof(woffDirEntry);
+   woffData = (uint8_t *) malloc(tableOffset);
+   if (!woffData) {
+@@ -277,7 +286,15 @@
+     if (sourceLen > sfntLen || sourceOffset > sfntLen - sourceLen) {
+       FAIL(eWOFF_invalid);
+     }
+-    destLen = LONGALIGN(compressBound(sourceLen));
++    destLen = compressBound(sourceLen);
++    if (LONGALIGN(destLen) < destLen) {
++      /* something weird is going on if this overflows! */
++      FAIL(eWOFF_invalid);
++    }
++    destLen = LONGALIGN(destLen);
++    if (tableOffset + destLen < tableOffset) {
++      FAIL(eWOFF_invalid);
++    }
+     woffData = (uint8_t *) realloc(woffData, tableOffset + destLen);
+     if (!woffData) {
+       FAIL(eWOFF_out_of_memory);
+@@ -291,13 +308,19 @@
+     }
+     if (destLen < sourceLen) {
+       /* compressed table was smaller */
+-      tableOffset += destLen;
++      tableOffset += destLen; /* checked for potential overflow above */
+       WOFFDIR[newIndex].compLen = READ32BE(destLen);
+     } else {
+       /* compression didn't make it smaller, so store original data instead */
++      if (LONGALIGN(sourceLen) < sourceLen) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       destLen = sourceLen;
+       /* reallocate to ensure enough space for the table,
+          plus potential padding after it */
++      if (tableOffset + LONGALIGN(sourceLen) < tableOffset) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       woffData = (uint8_t *) realloc(woffData,
+                                      tableOffset + LONGALIGN(sourceLen));
+       if (!woffData) {
+@@ -306,6 +329,9 @@
+       /* copy the original data into place */
+       memcpy(woffData + tableOffset,
+              sfntData + READ32BE(sfntDir[oldIndex].offset), sourceLen);
++      if (tableOffset + sourceLen < tableOffset) {
++        FAIL(eWOFF_invalid); /* overflow, bail out */
++      }
+       tableOffset += sourceLen;
+       WOFFDIR[newIndex].compLen = WOFFDIR[newIndex].origLen;
+     }
+@@ -316,7 +342,13 @@
+     }
+ 
+     /* update total size of uncompressed OpenType with table size */
++    if (totalSfntSize + sourceLen < totalSfntSize) {
++      FAIL(eWOFF_invalid); /* overflow, bail out */
++    }
+     totalSfntSize += sourceLen;
++    if (LONGALIGN(totalSfntSize) < totalSfntSize) {
++      FAIL(eWOFF_invalid);
++    }
+     totalSfntSize = LONGALIGN(totalSfntSize);
+   }
+ 
+@@ -442,10 +474,20 @@
+ 
+   totalSize = tableLimit; /* already long-aligned */
+   if (metaCompLen) {
++    if (totalSize + metaCompLen < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
+     totalSize += metaCompLen;
+   }
+   if (privLen) {
+-    totalSize = LONGALIGN(totalSize) + privLen;
++    if (LONGALIGN(totalSize) < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
++    totalSize = LONGALIGN(totalSize);
++    if (totalSize + privLen < totalSize) {
++      FAIL(eWOFF_invalid);
++    }
++    totalSize += privLen;
+   }
+   newData = malloc(totalSize);
+   if (!newData) {

fix-compiler-and-cppcheck-warnings.patch

@@ -0,0 +1,61 @@
+Description: fix some compiler and cppcheck warnings
+ - Remove two unused variables;
+ - Fix a memory leak when realloc() fails.
+Author: Dmitry Shachnev <mitya57@gmail.com>
+Forwarded: no
+Last-Update: 2013-04-11
+
+--- a/woff.c
++++ b/woff.c
+@@ -127,6 +127,7 @@
+            uint32_t * woffLen, uint32_t * pStatus)
+ {
+   uint8_t * woffData = NULL;
++  uint8_t * woffDataNew = NULL;
+   tableOrderRec * tableOrder = NULL;
+ 
+   uint32_t tableOffset;
+@@ -137,7 +138,6 @@
+   uint16_t tableIndex;
+   uint16_t order;
+   const sfntDirEntry * sfntDir;
+-  uint32_t tableBase;
+   uint32_t checkSumAdjustment = 0;
+   woffHeader * newHeader;
+   uint32_t tag = 0;
+@@ -295,8 +295,10 @@
+     if (tableOffset + destLen < tableOffset) {
+       FAIL(eWOFF_invalid);
+     }
+-    woffData = (uint8_t *) realloc(woffData, tableOffset + destLen);
+-    if (!woffData) {
++    woffDataNew = (uint8_t *) realloc(woffData, tableOffset + destLen);
++    if (woffDataNew) {
++      woffData = woffDataNew;
++    } else {
+       FAIL(eWOFF_out_of_memory);
+     }
+ 
+@@ -321,9 +323,11 @@
+       if (tableOffset + LONGALIGN(sourceLen) < tableOffset) {
+         FAIL(eWOFF_invalid); /* overflow, bail out */
+       }
+-      woffData = (uint8_t *) realloc(woffData,
+-                                     tableOffset + LONGALIGN(sourceLen));
+-      if (!woffData) {
++      woffDataNew = (uint8_t *) realloc(woffData,
++                                        tableOffset + LONGALIGN(sourceLen));
++      if (woffDataNew) {
++        woffData = woffDataNew;
++      } else {
+         FAIL(eWOFF_out_of_memory);
+       }
+       /* copy the original data into place */
+@@ -435,7 +439,6 @@
+   const woffHeader * origHeader;
+   const woffDirEntry * woffDir;
+   uint8_t * newData = NULL;
+-  uint8_t * tableData = NULL;
+   woffHeader * newHeader;
+   uint16_t numTables;
+   uint32_t tableLimit, totalSize, offset;

segfault-debian-bug-785795.patch

@@ -0,0 +1,39 @@
+diff -Naur a/woff.c b/woff.c
+--- a/woff.c	2009-09-25 09:54:13.000000000 -0400
++++ b/woff.c	2025-05-10 23:08:38.166716854 -0400
+@@ -174,6 +174,8 @@
+       }
+       head = (const sfntHeadTable *)(sfntData +
+                                      READ32BE(sfntDir[tableIndex].offset));
++      if ((uint8_t *)(head + 1) >= sfntData + sfntLen)
++       FAIL(eWOFF_invalid);
+     }
+   }
+   if (!head) {
+@@ -752,7 +754,7 @@
+   newHeader = (sfntHeader *) (sfntData);
+   newHeader->version = header->flavor;
+   newHeader->numTables = READ16BE(numTables);
+-  
++
+   /* calculate header fields for binary search */
+   searchRange = numTables;
+   searchRange |= (searchRange >> 1);
+@@ -1015,7 +1017,7 @@
+   if (pStatus) {
+     *pStatus = status;
+   }
+-  return NULL;    
++  return NULL;
+ }
+ 
+ const uint8_t *
+@@ -1070,7 +1072,7 @@
+   if (pStatus) {
+     *pStatus = status;
+   }
+-  return NULL;    
++  return NULL;
+ }
+ 
+ void

woff.rpmlintrc

@@ -0,0 +1,2 @@
+# Intentional, with a justifying spec-file comment
+addFilter(r" no-%check-section")

woff.spec

@@ -20,8 +20,42 @@ Source2:        woff2sfnt.1
 
 # It’s possible that tableOrder could be freed twice if a failure occurs. Set
 # the pointer null after freeing it to prevent this. There is no current
-# upstream to which this could be reported.
-Patch:          possible-double-free.patch
+# upstream to which this could be reported; however, this was reported to the
+# sfnt2woff-zopfli fork:
+#
+# Fix a possible double free in woffEncode()
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/18
+Patch0:         possible-double-free.patch
+
+# Add full text of the three WOFF licenses:
+#   - LICENSE-WOFF-MPL, from
+#     https://www.mozilla.org/media/MPL/1.1/index.0c5913925d40.txt
+#   - LICENSE-WOFF-GPL, from
+#     https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
+#   - LICENSE-WOFF-LGPL, from
+#     https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt
+# https://github.com/bramstein/sfnt2woff-zopfli/commit/7e08f1c944142c8e37050d9e02d91ec326d60ba5
+Patch1:         https://github.com/bramstein/sfnt2woff-zopfli/commit/7e08f1c944142c8e37050d9e02d91ec326d60ba5.patch
+# Update GPL/LGPL license texts for remote-only FS
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/21
+Patch2:         https://github.com/bramstein/sfnt2woff-zopfli/pull/21.patch
+
+# Fix segfault due to https://bugs.debian.org/785795.
+#   Remaining Debian patch rollup
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/20
+# Since the patches from the sfnt2woff-zopfli do not apply directly, we link
+# the patches Debian uses for woff (which they call woff-tools) where possible;
+# see https://sources.debian.org/patches/woff-tools/0:2009.10.04-2.
+# - Fix segfault due to https://bugs.debian.org/785795
+#   https://github.com/bramstein/sfnt2woff-zopfli/pull/20/commits/51d74ebc4ab782f9e272fa4f135ee2375c991a5b
+#   Rebased from the sfnt2woff-zopfli fork onto the original woff release
+Patch3:         segfault-debian-bug-785795.patch
+# - Add arithmetic overflow checks in woff encoding routines
+Patch4:         https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/add-overflow-checks.patch
+# - Fix CVE-2010-1028: WOFF heap corruption due to integer overflow
+Patch5:         https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/CVE-2010-1028.patch
+# - fix some compiler and cppcheck warnings
+Patch6:         https://sources.debian.org/data/main/w/woff-tools/0%3A2009.10.04-2/debian/patches/fix-compiler-and-cppcheck-warnings.patch
 
 BuildRequires:  make
 BuildRequires:  gcc
@@ -39,6 +73,11 @@ decoding Web Open Font Format (WOFF) files.
 %build
 %set_build_flags
 %make_build CFLAGS="${CFLAGS}"
+awk '
+    /BEGIN LICENSE BLOCK/ { b = 1 }
+    b
+    /END LICENSE BLOCK/ { b = 0 }' woff.c |
+  tee LICENSE-WOFF
 
 
 %install
@@ -49,8 +88,17 @@ install -d '%{buildroot}%{_mandir}/man1'
 install -t '%{buildroot}%{_mandir}/man1' -p -m 0644 '%{SOURCE1}' '%{SOURCE2}'
 
 
+# Upstream provides no tests
+
+
 %files
+%license LICENSE-WOFF
+%license LICENSE-WOFF-MPL
+%license LICENSE-WOFF-GPL
+%license LICENSE-WOFF-LGPL
+
 %doc woff-2009-10-03.html
+
 %{_bindir}/sfnt2woff
 %{_bindir}/woff2sfnt
 %{_mandir}/man1/sfnt2woff.1*