From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36245) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1emnb1-0003kQ-56 for guix-patches@gnu.org; Fri, 16 Feb 2018 16:31:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1emnaw-0003hC-R2 for guix-patches@gnu.org; Fri, 16 Feb 2018 16:31:07 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:39394) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1emnaw-0003h6-N2 for guix-patches@gnu.org; Fri, 16 Feb 2018 16:31:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1emnaw-0006k1-Cl for guix-patches@gnu.org; Fri, 16 Feb 2018 16:31:02 -0500 Subject: [bug#30493] [PATCH] gnu: freetype: Fix CVE-2018-6942. Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:36154) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1emnZv-0003L1-Bx for guix-patches@gnu.org; Fri, 16 Feb 2018 16:30:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1emnZr-0002rt-VG for guix-patches@gnu.org; Fri, 16 Feb 2018 16:29:59 -0500 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:35145) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1emnZr-0002r2-RA for guix-patches@gnu.org; Fri, 16 Feb 2018 16:29:55 -0500 From: Marius Bakke Date: Fri, 16 Feb 2018 22:29:51 +0100 Message-Id: <20180216212951.23088-1-mbakke@fastmail.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 30493@debbugs.gnu.org * gnu/packages/patches/freetype-CVE-2018-6942.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/fontutils.scm (freetype)[replacement]: New field. (freetype/fixed): New variable. --- gnu/local.mk | 1 + gnu/packages/fontutils.scm | 8 ++++++ gnu/packages/patches/freetype-CVE-2018-6942.patch | 31 +++++++++++++++++++++++ 3 files changed, 40 insertions(+) create mode 100644 gnu/packages/patches/freetype-CVE-2018-6942.patch diff --git a/gnu/local.mk b/gnu/local.mk index 7fe374208..4ee869e0b 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -652,6 +652,7 @@ dist_patch_DATA = \ %D%/packages/patches/freeimage-CVE-2015-0852.patch \ %D%/packages/patches/freeimage-CVE-2016-5684.patch \ %D%/packages/patches/freeimage-fix-build-with-gcc-5.patch \ + %D%/packages/patches/freetype-CVE-2018-6942.patch \ %D%/packages/patches/fuse-overlapping-headers.patch \ %D%/packages/patches/gawk-shell.patch \ %D%/packages/patches/gcc-arm-bug-71399.patch \ diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm index 387c4689d..84c8497f0 100644 --- a/gnu/packages/fontutils.scm +++ b/gnu/packages/fontutils.scm @@ -53,6 +53,7 @@ (define-public freetype (package (name "freetype") + (replacement freetype/fixed) (version "2.8") (source (origin (method url-fetch) @@ -78,6 +79,13 @@ anti-aliased glyph bitmap generation with 256 gray levels.") (license license:freetype) ; some files have other licenses (home-page "https://www.freetype.org/"))) +(define freetype/fixed + (package/inherit freetype + (source + (origin + (inherit (package-source freetype)) + (patches (search-patches "freetype-CVE-2018-6942.patch")))))) + (define-public ttfautohint (package (name "ttfautohint") diff --git a/gnu/packages/patches/freetype-CVE-2018-6942.patch b/gnu/packages/patches/freetype-CVE-2018-6942.patch new file mode 100644 index 000000000..680f35776 --- /dev/null +++ b/gnu/packages/patches/freetype-CVE-2018-6942.patch @@ -0,0 +1,31 @@ +Fix CVE-2018-6942: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6942 +https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6942.html + +Copied from upstream (ChangeLog section removed): +https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c759284e305ec428703c9a5831d0b1fc3497ef + +diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c +index d855aaa..551f14a 100644 +--- a/src/truetype/ttinterp.c ++++ b/src/truetype/ttinterp.c +@@ -7532,8 +7532,16 @@ + return; + } + +- for ( i = 0; i < num_axes; i++ ) +- args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ if ( coords ) ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ ++ } ++ else ++ { ++ for ( i = 0; i < num_axes; i++ ) ++ args[i] = 0; ++ } + } + + -- 2.16.1