From 79d294a3e8b2c3fdffcacad215be03152cbff711 Mon Sep 17 00:00:00 2001
From: jinzhimin369 <jinzhimin2@huawei.com>
Date: Thu, 17 Sep 2020 18:00:32 +0800
Subject: [PATCH] fix CVE-2018-19876

---
 backport-CVE-2018-19876.patch | 30 ++++++++++++++++++++++++++++++
 cairo.spec                    | 10 +++++++++-
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 backport-CVE-2018-19876.patch

diff --git a/backport-CVE-2018-19876.patch b/backport-CVE-2018-19876.patch
new file mode 100644
index 0000000..484a07c
--- /dev/null
+++ b/backport-CVE-2018-19876.patch
@@ -0,0 +1,30 @@
+From 90e85c2493fdfa3551f202ff10282463f1e36645 Mon Sep 17 00:00:00 2001
+From: Carlos Garcia Campos <cgarcia@igalia.com>
+Date: Thu, 17 Sep 2020 15:55:42 -0400
+Subject: [PATCH] ft: Use FT_Done_MM_Var instead of free when available in
+ cairo_ft_apply_variations
+
+Fixes a crash when using freetype >= 2.9
+---
+ src/cairo-ft-font.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/cairo-ft-font.c b/src/cairo-ft-font.c
+index 325dd61..b63258d 100644
+--- a/src/cairo-ft-font.c
++++ b/src/cairo-ft-font.c
+@@ -2393,7 +2393,11 @@ skip:
+ done:
+         free (coords);
+         free (current_coords);
++#if HAVE_FT_DONE_MM_VAR
++	FT_Done_MM_Var (face->glyph->library, ft_mm_var);
++#else
+         free (ft_mm_var);
++#endif
+     }
+ }
+ 
+-- 
+2.23.0
+
diff --git a/cairo.spec b/cairo.spec
index 45216bf..2dd42d1 100644
--- a/cairo.spec
+++ b/cairo.spec
@@ -2,12 +2,14 @@
 
 Name:           cairo
 Version:        1.15.14
-Release:        4
+Release:        5
 Summary:        A 2D graphics library
 License:        LGPLv2 or MPLv1.1
 URL:            http://cairographics.org
 Source0:        http://cairographics.org/snapshots/%{name}-%{version}.tar.xz
 
+Patch1:         backport-CVE-2018-19876.patch
+
 BuildRequires:  pkgconfig glib2-devel librsvg2-devel
 BuildRequires:  libXrender-devel libX11-devel libpng-devel libxml2-devel
 BuildRequires:  pixman-devel >= 0.30.0
@@ -76,6 +78,12 @@ find $RPM_BUILD_ROOT -name '*.la' -delete
 %{_bindir}/cairo-trace
 
 %changelog
+* Thu Sep 11 2020 yanglu <yanglu60@huawei.com> - 1.15.14-5
+- Type:cves
+- ID:CVE-2018-19876
+- SUG:NA
+- DESC: fix CVE-2018-19876
+
 * Tue Aug 18 2020 chenyaqiang <chenyaqiang@huawei.com> - 1.15.14-4
 - rebuild for package build
 
-- 
Gitee