diff --git a/backport-0001-CVE-2022-27405.patch b/backport-0001-CVE-2022-27405.patch deleted file mode 100644 index 4452206601c5802a8530bf25028fa6a798583e5d..0000000000000000000000000000000000000000 --- a/backport-0001-CVE-2022-27405.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 06:40:17 +0100 -Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Properly guard - `face_index`. - -We must ensure that the cast to `FT_Int` doesn't change the sign. - -Fixes #1139. - -Conflict:NA -Reference:https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 ---- - src/base/ftobjs.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c -index 2c0f0e6c9..10952a6c6 100644 ---- a/src/base/ftobjs.c -+++ b/src/base/ftobjs.c -@@ -2527,6 +2527,15 @@ - #endif - - -+ /* only use lower 31 bits together with sign bit */ -+ if ( face_index > 0 ) -+ face_index &= 0x7FFFFFFFL; -+ else -+ { -+ face_index &= 0x7FFFFFFFL; -+ face_index = -face_index; -+ } -+ - #ifdef FT_DEBUG_LEVEL_TRACE - FT_TRACE3(( "FT_Open_Face: " )); - if ( face_index < 0 ) --- -GitLab - diff --git a/backport-0002-CVE-2022-27405.patch b/backport-0002-CVE-2022-27405.patch deleted file mode 100644 index 6fae679f284b675e0dcac62d34bc32f6f599c45b..0000000000000000000000000000000000000000 --- a/backport-0002-CVE-2022-27405.patch +++ /dev/null @@ -1,26 +0,0 @@ -From d014387ad4a5dd04d8e7f99587c7dacb70261924 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 09:30:45 +0100 -Subject: [PATCH] * src/base/ftobjs.c (ft_open_face_internal): Thinko. - -Conflict:NA -Reference:https://gitlab.freedesktop.org/freetype/freetype/-/commit/d014387ad4a5dd04d8e7f99587c7dacb70261924 ---- - src/base/ftobjs.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c -index 10952a6c6..6492a1517 100644 ---- a/src/base/ftobjs.c -+++ b/src/base/ftobjs.c -@@ -2532,6 +2532,7 @@ - face_index &= 0x7FFFFFFFL; - else - { -+ face_index = -face_index; - face_index &= 0x7FFFFFFFL; - face_index = -face_index; - } --- -GitLab - diff --git a/backport-CVE-2022-27404.patch b/backport-CVE-2022-27404.patch deleted file mode 100644 index 36c12daa0a86e99ec8f13bac24e5f22c407bb3f1..0000000000000000000000000000000000000000 --- a/backport-CVE-2022-27404.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 53dfdcd8198d2b3201a23c4bad9190519ba918db Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Thu, 17 Mar 2022 19:24:16 +0100 -Subject: [PATCH] [sfnt] Avoid invalid face index. - -Fixes #1138. - -* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font): -Check `face_index` before decrementing. - -Conflict:NA -Reference:https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db ---- - src/sfnt/sfobjs.c | 2 +- - src/sfnt/sfwoff2.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c -index f9d4d3858..9771c35df 100644 ---- a/src/sfnt/sfobjs.c -+++ b/src/sfnt/sfobjs.c -@@ -566,7 +566,7 @@ - face_index = FT_ABS( face_instance_index ) & 0xFFFF; - - /* value -(N+1) requests information on index N */ -- if ( face_instance_index < 0 ) -+ if ( face_instance_index < 0 && face_index > 0 ) - face_index--; - - if ( face_index >= face->ttc_header.count ) -diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c -index cb1e0664a..165b875e5 100644 ---- a/src/sfnt/sfwoff2.c -+++ b/src/sfnt/sfwoff2.c -@@ -2085,7 +2085,7 @@ - /* Validate requested face index. */ - *num_faces = woff2.num_fonts; - /* value -(N+1) requests information on index N */ -- if ( *face_instance_index < 0 ) -+ if ( *face_instance_index < 0 && face_index > 0 ) - face_index--; - - if ( face_index >= woff2.num_fonts ) --- -GitLab diff --git a/backport-CVE-2022-27406.patch b/backport-CVE-2022-27406.patch deleted file mode 100644 index de5409cce2f2c36a14e540bbf0e4bc80fc65c5b0..0000000000000000000000000000000000000000 --- a/backport-CVE-2022-27406.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 0c2bdb01a2e1d24a3e592377a6d0822856e10df2 Mon Sep 17 00:00:00 2001 -From: Werner Lemberg -Date: Sat, 19 Mar 2022 09:37:28 +0100 -Subject: [PATCH] * src/base/ftobjs.c (FT_Request_Size): Guard `face->size`. - -Fixes #1140. - -Conflict:NA -Reference:https://gitlab.freedesktop.org/freetype/freetype/-/commit/0c2bdb01a2e1d24a3e592377a6d0822856e10df2 ---- - src/base/ftobjs.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c -index 6492a1517..282c9121a 100644 ---- a/src/base/ftobjs.c -+++ b/src/base/ftobjs.c -@@ -3409,6 +3409,9 @@ - if ( !face ) - return FT_THROW( Invalid_Face_Handle ); - -+ if ( !face->size ) -+ return FT_THROW( Invalid_Size_Handle ); -+ - if ( !req || req->width < 0 || req->height < 0 || - req->type >= FT_SIZE_REQUEST_TYPE_MAX ) - return FT_THROW( Invalid_Argument ); --- -GitLab - diff --git a/freetype-2.11.0.tar.xz b/freetype-2.11.0.tar.xz deleted file mode 100644 index 22a0b0452e5582a3e6b30185e72771a35457809a..0000000000000000000000000000000000000000 Binary files a/freetype-2.11.0.tar.xz and /dev/null differ diff --git a/freetype-2.12.1.tar.xz b/freetype-2.12.1.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..2accf0e5419d38023008b88ffe8685804a5dd793 Binary files /dev/null and b/freetype-2.12.1.tar.xz differ diff --git a/freetype-doc-2.11.0.tar.xz b/freetype-doc-2.11.0.tar.xz deleted file mode 100644 index dcb673a74024b94a87c8bd333ec457972b3557eb..0000000000000000000000000000000000000000 Binary files a/freetype-doc-2.11.0.tar.xz and /dev/null differ diff --git a/freetype-doc-2.12.1.tar.xz b/freetype-doc-2.12.1.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..0939aa37ef0fc960c46fb3a0861a23f5247a36f0 Binary files /dev/null and b/freetype-doc-2.12.1.tar.xz differ diff --git a/freetype.spec b/freetype.spec index 767a4a399515fef4f57aaded25b1feccba448647..ef6f69194efca6390a923cf9402b0776c01cca18 100644 --- a/freetype.spec +++ b/freetype.spec @@ -3,8 +3,8 @@ %{!?with_xfree86:%define with_xfree86 1} Name: freetype -Version: 2.11.0 -Release: 2 +Version: 2.12.1 +Release: 1 Summary: FreeType is a freely available software library to render fonts License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org @@ -20,10 +20,6 @@ Patch6002: backport-freetype-2.6.5-libtool.patch Patch6003: backport-freetype-2.8-multilib.patch Patch6004: backport-freetype-2.10.0-internal-outline.patch Patch6005: backport-freetype-2.10.1-debughook.patch -Patch6006: backport-CVE-2022-27404.patch -Patch6007: backport-0001-CVE-2022-27405.patch -Patch6008: backport-0002-CVE-2022-27405.patch -Patch6009: backport-CVE-2022-27406.patch BuildRequires: gcc libX11-devel libpng-devel zlib-devel bzip2-devel @@ -71,10 +67,6 @@ popd %patch6003 -p1 %patch6004 -p1 %patch6005 -p1 -%patch6006 -p1 -%patch6007 -p1 -%patch6008 -p1 -%patch6009 -p1 %build %configure --disable-static --with-zlib=yes --with-bzip2=yes --with-png=yes --enable-freetype-config --with-harfbuzz=no @@ -148,6 +140,9 @@ install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_includedir}/freetype2/freetype/co %{_mandir}/man1/* %changelog +* Tue Nov 29 2022 zhouwenpei - 2.12.1-1 +- update to 2.12.1 + * Sat May 14 2022 wangkerong - 2.11.0-2 - fix CVE-2022-27404,CVE-2022-27405,CVE-2022-27406 diff --git a/ft2demos-2.11.0.tar.xz b/ft2demos-2.11.0.tar.xz deleted file mode 100644 index e7c8612d57a8fe225b85ec4165906e1da00dac44..0000000000000000000000000000000000000000 Binary files a/ft2demos-2.11.0.tar.xz and /dev/null differ diff --git a/ft2demos-2.12.1.tar.xz b/ft2demos-2.12.1.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..25b707cc222a6c4e0e6d4f000f68e999503e9174 Binary files /dev/null and b/ft2demos-2.12.1.tar.xz differ