diff --git a/backport-CVE-2022-31782.patch b/backport-CVE-2022-31782.patch new file mode 100644 index 0000000000000000000000000000000000000000..ebbcdc8929369c8ecde29bdbddb9a5de25e27778 --- /dev/null +++ b/backport-CVE-2022-31782.patch @@ -0,0 +1,23 @@ +From 3541af5e7805a4d897b8a1b199eb5037b9f1a477 Mon Sep 17 00:00:00 2001 +From: Alexei Podtelezhnikov +Date: Tue, 24 May 2022 18:24:18 +0000 +Subject: [PATCH] * src/ftbench.c (main): Check the number of glyphs. + +Fixes #8. +--- + ft2demos-2.10.2/src/ftbench.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/ft2demos-2.10.2/src/ftbench.c ++++ b/ft2demos-2.10.2/src/ftbench.c +@@ -1137,6 +1137,9 @@ + if ( get_face( &face ) ) + goto Exit; + ++ if ( !face->num_glyphs ) ++ goto Exit; ++ + if ( last_index >= (unsigned int)face->num_glyphs ) + last_index = (unsigned int)face->num_glyphs - 1; + if ( last_index < first_index ) + diff --git a/freetype.spec b/freetype.spec index c7232e2d3535fe951275e9345bdaa0185bdba799..92a6588ae6897214be268f856d74ecbc65d1632f 100644 --- a/freetype.spec +++ b/freetype.spec @@ -4,7 +4,7 @@ Name: freetype Version: 2.10.2 -Release: 6 +Release: 7 Summary: FreeType is a freely available software library to render fonts License: (FTL or GPLv2+) and BSD and MIT and Public Domain and zlib with acknowledgement URL: http://www.freetype.org @@ -27,6 +27,7 @@ Patch6008: backport-0002-CVE-2022-27405.patch Patch6009: backport-CVE-2022-27406.patch Patch6010: backport-CVE-2023-2004.patch Patch6011: backport-CVE-2025-27363.patch +Patch6012: backport-CVE-2022-31782.patch BuildRequires: gcc libX11-devel libpng-devel zlib-devel bzip2-devel @@ -76,6 +77,7 @@ popd %patch6009 -p1 %patch6010 -p1 %patch6011 -p1 +%patch6012 -p1 %build %configure --disable-static --with-zlib=yes --with-bzip2=yes --with-png=yes --enable-freetype-config --with-harfbuzz=no @@ -150,6 +152,9 @@ install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_includedir}/freetype2/freetype/co %{_mandir}/man1/* %changelog +* Fri Jul 25 2025 zhangpan - 2.10.2-7 +- fix CVE-2022-31782 + * Tue Mar 18 2025 zhangpan - 2.10.2-6 - fix CVE-2025-27363