helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fontforge: patch CVE-2025-15269

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15269

Pick the patch that refers to this vulnerability ID explicitly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2026-01-27 07:50:18 +01:00 committed by Khem Raj
parent 5dddc4f520
commit 049c89877c
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
meta-oe/recipes-graphics/fontforge/fontforge/CVE-2025-15269.patch Normal file
View File

@ -0,0 +1,36 @@
From 6a23476bc5eea880f3f24496710a6133c92a198b Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Sat, 10 Jan 2026 20:06:53 +0100
Subject: [PATCH] Fix CVE-2025-15269: Use-after-free in SFD ligature parsing
(#5722)
From: Ahmet Furkan Kavraz <55850855+ahmetfurkankavraz@users.noreply.github.com>
Prevent circular linked list in LigaCreateFromOldStyleMultiple by clearing
the next pointer after shallow copy. The shallow copy propagates liga's
modified next pointer from previous iterations, creating a cycle that
causes double-free when the list is traversed and freed.
Fixes: CVE-2025-15269 | ZDI-25-1195 | ZDI-CAN-28564
Co-authored-by: Ahmet Furkan Kavraz <kavraz@amazon.com>
CVE: CVE-2025-15269
Upstream-Status: Backport [https://github.com/fontforge/fontforge/commit/6aea6db5da332d8ac94e3501bb83c1b21f52074d]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
fontforge/sfd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fontforge/sfd.c b/fontforge/sfd.c
index e19d3a30f..be4220515 100644
--- a/fontforge/sfd.c
+++ b/fontforge/sfd.c
@@ -4647,6 +4647,7 @@ static PST1 *LigaCreateFromOldStyleMultiple(PST1 *liga) {
while ( (pt = strrchr(liga->pst.u.lig.components,';'))!=NULL ) {
new = chunkalloc(sizeof( PST1 ));
*new = *liga;
+ new->pst.next = NULL;
new->pst.u.lig.components = copy(pt+1);
last->pst.next = (PST *) new;
last = new;

1
meta-oe/recipes-graphics/fontforge/fontforge_20251009.bb
View File

@ -21,6 +21,7 @@ SRC_URI = "git://github.com/${BPN}/${BPN}.git;branch=master;protocol=https;tag=$
file://CVE-2025-15279-1.patch \
file://CVE-2025-15279-2.patch \
file://CVE-2025-15275.patch \
file://CVE-2025-15269.patch \
"
EXTRA_OECMAKE = "-DENABLE_DOCS=OFF"