From 0e63bfbd497fafb413802d9b504d42dff79c6b5a Mon Sep 17 00:00:00 2001 From: zhouwenpei Date: Fri, 15 Jul 2022 16:02:12 +0800 Subject: [PATCH] fix CVE-2022-33068 --- backport-CVE-2022-33068.patch | 29 +++++++++++++++++++++++++++++ harfbuzz.spec | 7 ++++++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-33068.patch diff --git a/backport-CVE-2022-33068.patch b/backport-CVE-2022-33068.patch new file mode 100644 index 0000000..2a87e75 --- /dev/null +++ b/backport-CVE-2022-33068.patch @@ -0,0 +1,29 @@ +From 62e803b36173fd096d7ad460dd1d1db9be542593 Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod +Date: Wed, 1 Jun 2022 07:38:21 -0600 +Subject: [PATCH] [sbix] Limit glyph extents + +Fixes https://github.com/harfbuzz/harfbuzz/issues/3557 +--- + src/hb-ot-color-sbix-table.hh | 6 ++++++ + test/fuzzing/fonts/sbix-extents.ttf | Bin 0 -> 582 bytes + 2 files changed, 6 insertions(+) + create mode 100644 test/fuzzing/fonts/sbix-extents.ttf + +diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh +index 9741ebd450..6efae43cda 100644 +--- a/src/hb-ot-color-sbix-table.hh ++++ b/src/hb-ot-color-sbix-table.hh +@@ -298,6 +298,12 @@ struct sbix + + const PNGHeader &png = *blob->as(); + ++ if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536) ++ { ++ hb_blob_destroy (blob); ++ return false; ++ } ++ + extents->x_bearing = x_offset; + extents->y_bearing = png.IHDR.height + y_offset; + extents->width = png.IHDR.width; diff --git a/harfbuzz.spec b/harfbuzz.spec index 2b17ddd..a1e2f10 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,12 +1,14 @@ Name: harfbuzz Version: 2.8.1 -Release: 2 +Release: 3 Summary: A text shaping engine License: MIT URL: https://harfbuzz.github.io/what-is-harfbuzz.html Source0: https://github.com/harfbuzz/harfbuzz/releases/download/2.8.1/%{name}-%{version}.tar.xz +Patch0001: backport-CVE-2022-33068.patch + BuildRequires: gcc-c++ freetype-devel cairo-devel glib2-devel graphite2-devel BuildRequires: gtk-doc libicu-devel gobject-introspection-devel Provides: harfbuzz-icu @@ -69,6 +71,9 @@ make install DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p" %{_datadir}/gtk-doc/html/harfbuzz/* %changelog +* Fri Jul 15 2022 zhouwenpei - 2.8.1-3 +- fix CVE-2022-33068 + * Mon Jul 05 2021 wangkerong - 2.8.1-2 - enable make check -- Gitee