helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-04-02 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

freetype: Fix CVE-2026-23865

Browse Source 
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-23865
           https://security-tracker.debian.org/tracker/CVE-2026-23865

Picked patch mentioned in NVD

(From OE-Core rev: b371b1b670123c9f231ed8b450ad868b6c4f9549)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Vijay Anusuri 2026-03-09 19:00:55 +05:30 committed by Paul Barker
parent 61197c7a92
commit 603492f2e7
2 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
meta/recipes-graphics/freetype/freetype/CVE-2026-23865.patch Normal file
View File

@ -0,0 +1,54 @@
From fc85a255849229c024c8e65f536fe1875d84841c Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 3 Jan 2026 08:07:57 +0100
Subject: [PATCH] [ttgxvar] Check for overflow in array size computation.
Problem reported and analyzed by povcfe <povcfe2sec@gmail.com>.
Fixes issue #1382.
* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Do it.
Upstream-Status: Backport [https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c]
CVE: CVE-2026-23865
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
src/truetype/ttgxvar.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 2ff40c9e8..96ddc04c8 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -628,6 +628,7 @@
FT_UShort word_delta_count;
FT_UInt region_idx_count;
FT_UInt per_region_size;
+ FT_UInt delta_set_size;
if ( FT_STREAM_SEEK( offset + dataOffsetArray[i] ) )
@@ -697,7 +698,19 @@
if ( long_words )
per_region_size *= 2;
- if ( FT_NEW_ARRAY( varData->deltaSet, per_region_size * item_count ) )
+ /* Check for overflow (we actually test whether the */
+ /* multiplication of two unsigned values wraps around). */
+ delta_set_size = per_region_size * item_count;
+ if ( per_region_size &&
+ delta_set_size / per_region_size != item_count )
+ {
+ FT_TRACE2(( "tt_var_load_item_variation_store:"
+ " bad delta set array size\n" ));
+ error = FT_THROW( Array_Too_Large );
+ goto Exit;
+ }
+
+ if ( FT_NEW_ARRAY( varData->deltaSet, delta_set_size ) )
goto Exit;
if ( FT_Stream_Read( stream,
varData->deltaSet,
--
GitLab

1
meta/recipes-graphics/freetype/freetype_2.13.2.bb
View File

@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.TXT;md5=843b6efc16f6b1652ec97f89d5a516c0 \
SRC_URI = "${SAVANNAH_NONGNU_MIRROR}/${BPN}/${BP}.tar.xz \
file://CVE-2025-27363.patch \
file://CVE-2026-23865.patch \
"
SRC_URI[sha256sum] = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d"