diff options
| author | Michael Stahl <michael.stahl@allotropia.de> | 2022-09-14 20:02:03 +0200 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2022-09-15 11:10:53 +0200 |
| commit | da5a52ead0826f54070141dcabb456a09337f8f7 (patch) | |
| tree | a167c52c9d434c0b5f33db851d20120da81940f7 /external | |
| parent | 2a54970b26b99cdb6069146241c4f08b5fb097c2 (diff) | |
harfbuzz: add patch for CVE-2022-33068
Should be fixed in release 4.4.0
Change-Id: I9ff234f9687c7f57d9226df91b17ddb0bc083cca
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139952
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 424d2e86cc103336fb70cd8ef7aacde1ac2e28ef)
Diffstat (limited to 'external')
| -rw-r--r-- | external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 | 29 | ||||
| -rw-r--r-- | external/harfbuzz/UnpackedTarball_harfbuzz.mk | 1 |
2 files changed, 30 insertions, 0 deletions
diff --git a/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 b/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 new file mode 100644 index 000000000000..2aef204a26e1 --- /dev/null +++ b/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 @@ -0,0 +1,29 @@ +From 62e803b36173fd096d7ad460dd1d1db9be542593 Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod <behdad@behdad.org> +Date: Wed, 1 Jun 2022 07:38:21 -0600 +Subject: [PATCH] [sbix] Limit glyph extents + +Fixes https://github.com/harfbuzz/harfbuzz/issues/3557 +--- + src/hb-ot-color-sbix-table.hh | 6 ++++++ + test/fuzzing/fonts/sbix-extents.ttf | Bin 0 -> 582 bytes + 2 files changed, 6 insertions(+) + create mode 100644 test/fuzzing/fonts/sbix-extents.ttf + +diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh +index 9741ebd450..6efae43cda 100644 +--- a/src/hb-ot-color-sbix-table.hh ++++ b/src/hb-ot-color-sbix-table.hh +@@ -298,6 +298,12 @@ struct sbix + + const PNGHeader &png = *blob->as<PNGHeader>(); + ++ if (png.IHDR.height >= 65536 || png.IHDR.width >= 65536) ++ { ++ hb_blob_destroy (blob); ++ return false; ++ } ++ + extents->x_bearing = x_offset; + extents->y_bearing = png.IHDR.height + y_offset; + extents->width = png.IHDR.width; diff --git a/external/harfbuzz/UnpackedTarball_harfbuzz.mk b/external/harfbuzz/UnpackedTarball_harfbuzz.mk index adec72ed0d57..9957f89e1b5c 100644 --- a/external/harfbuzz/UnpackedTarball_harfbuzz.mk +++ b/external/harfbuzz/UnpackedTarball_harfbuzz.mk @@ -20,6 +20,7 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,harfbuzz,0)) $(eval $(call gb_UnpackedTarball_add_patches,harfbuzz, \ external/harfbuzz/ubsan.patch \ external/harfbuzz/icu-65-api-macros-with-semicolon.patch.1 \ + external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 \ )) # vim: set noet sw=4 ts=4: |