Browse code
Patch for CVE-2017-8287. Bug 1871090
Change-Id: I628c7f38512b4a0d32d36e9d7fcfcff474d8e651
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/2703
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Priyesh Padmavilasom authored on 2017/05/16 07:21:37Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,19 @@ |
| 0 |
+diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c |
|
| 1 |
+index d18e821..0baf836 100644 |
|
| 2 |
+--- a/src/psaux/psobjs.c |
|
| 3 |
+@@ -1718,6 +1718,14 @@ |
|
| 4 |
+ first = outline->n_contours <= 1 |
|
| 5 |
+ ? 0 : outline->contours[outline->n_contours - 2] + 1; |
|
| 6 |
+ |
|
| 7 |
++ /* in malformed fonts it can happen that a contour was started */ |
|
| 8 |
++ /* but no points were added */ |
|
| 9 |
++ if ( outline->n_contours && first == outline->n_points ) |
|
| 10 |
++ {
|
|
| 11 |
++ outline->n_contours--; |
|
| 12 |
++ return; |
|
| 13 |
++ } |
|
| 14 |
++ |
|
| 15 |
+ /* We must not include the last point in the path if it */ |
|
| 16 |
+ /* is located on the first point. */ |
|
| 17 |
+ if ( outline->n_points > 1 ) |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: software font engine. |
| 2 | 2 |
Name: freetype2 |
| 3 | 3 |
Version: 2.7.1 |
| 4 |
-Release: 2%{?dist}
|
|
| 4 |
+Release: 3%{?dist}
|
|
| 5 | 5 |
License: BSD/GPL |
| 6 | 6 |
URL: http://www.freetype.org/ |
| 7 | 7 |
Group: System Environment/Libraries |
| ... | ... |
@@ -11,6 +11,7 @@ Source0: http://download.savannah.gnu.org/releases/freetype/freetype-%{version}.
|
| 11 | 11 |
%define sha1 freetype=60fb8097901a887b8e8f6e7f777ef0516ae68022 |
| 12 | 12 |
Patch0: CVE-2017-7857-and-CVE-2017-7858.patch |
| 13 | 13 |
Patch1: CVE-2017-7864.patch |
| 14 |
+Patch2: CVE-2017-8287.patch |
|
| 14 | 15 |
BuildRequires: libtool |
| 15 | 16 |
BuildRequires: zlib-devel |
| 16 | 17 |
|
| ... | ... |
@@ -27,6 +28,7 @@ It contains the libraries and header files to create applications |
| 27 | 27 |
%setup -q -n freetype-%{version}
|
| 28 | 28 |
%patch0 -p1 |
| 29 | 29 |
%patch1 -p1 |
| 30 |
+%patch2 -p1 |
|
| 30 | 31 |
|
| 31 | 32 |
%build |
| 32 | 33 |
./configure \ |
| ... | ... |
@@ -61,6 +63,8 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}
|
| 61 | 61 |
%{_libdir}/pkgconfig/*.pc
|
| 62 | 62 |
|
| 63 | 63 |
%changelog |
| 64 |
+* Mon May 15 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 2.7.1-3 |
|
| 65 |
+- CVE-2017-8287 |
|
| 64 | 66 |
* Fri Apr 28 2017 Dheeraj Shetty <dheerajs@vmware.com> 2.7.1-2 |
| 65 | 67 |
- CVE-2017-7857, CVE-2017-7858 and CVE-2017-7864 |
| 66 | 68 |
* Fri Nov 11 2016 Dheeraj Shetty <dheerajs@vmware.com> 2.7.1-1 |