From 953c7fb20d79be66a8fc99844c2b83d61361c7b1 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 17 Apr 2026 15:11:29 +0200 Subject: [PATCH] package/freetype: patch CVE-2026-23865 Fixes the following security vulnerability: - CVE-2026-23865: An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2. For more information, see - https://www.cve.org/CVERecord?id=CVE-2026-23865 - https://gitlab.freedesktop.org/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c.patch (cherry picked from commit 6c3933d14bc6b8622733f1ada788c168ba9f8775) Signed-off-by: Thomas Perale --- ...r-overflow-in-array-size-computation.patch | 54 +++++++++++++++++++ package/freetype/freetype.mk | 3 ++ 2 files changed, 57 insertions(+) create mode 100644 package/freetype/0001-Check-for-overflow-in-array-size-computation.patch diff --git a/package/freetype/0001-Check-for-overflow-in-array-size-computation.patch b/package/freetype/0001-Check-for-overflow-in-array-size-computation.patch new file mode 100644 index 0000000000..6951880854 --- /dev/null +++ b/package/freetype/0001-Check-for-overflow-in-array-size-computation.patch @@ -0,0 +1,54 @@ +From fc85a255849229c024c8e65f536fe1875d84841c Mon Sep 17 00:00:00 2001 +From: Werner Lemberg +Date: Sat, 3 Jan 2026 08:07:57 +0100 +Subject: [PATCH] [ttgxvar] Check for overflow in array size computation. + +Problem reported and analyzed by povcfe . + +Fixes issue #1382. + +* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Do it. + +CVE: CVE-2026-23865 +Upstream: https://gitlab.freedesktop.org/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c.patch +Signed-off-by: Thomas Perale +--- + src/truetype/ttgxvar.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c +index 2ff40c9e8..96ddc04c8 100644 +--- a/src/truetype/ttgxvar.c ++++ b/src/truetype/ttgxvar.c +@@ -609,6 +609,7 @@ + FT_UShort word_delta_count; + FT_UInt region_idx_count; + FT_UInt per_region_size; ++ FT_UInt delta_set_size; + + + if ( FT_STREAM_SEEK( offset + dataOffsetArray[i] ) ) +@@ -666,7 +667,19 @@ + if ( long_words ) + per_region_size *= 2; + +- if ( FT_NEW_ARRAY( varData->deltaSet, per_region_size * item_count ) ) ++ /* Check for overflow (we actually test whether the */ ++ /* multiplication of two unsigned values wraps around). */ ++ delta_set_size = per_region_size * item_count; ++ if ( per_region_size && ++ delta_set_size / per_region_size != item_count ) ++ { ++ FT_TRACE2(( "tt_var_load_item_variation_store:" ++ " bad delta set array size\n" )); ++ error = FT_THROW( Array_Too_Large ); ++ goto Exit; ++ } ++ ++ if ( FT_NEW_ARRAY( varData->deltaSet, delta_set_size ) ) + goto Exit; + if ( FT_Stream_Read( stream, + varData->deltaSet, +-- +GitLab + diff --git a/package/freetype/freetype.mk b/package/freetype/freetype.mk index ad8cd00ec8..51b0471d4f 100644 --- a/package/freetype/freetype.mk +++ b/package/freetype/freetype.mk @@ -15,6 +15,9 @@ FREETYPE_CPE_ID_VENDOR = freetype FREETYPE_DEPENDENCIES = host-pkgconf FREETYPE_CONFIG_SCRIPTS = freetype-config +# 0001-Check-for-overflow-in-array-size-computation.patch +FREETYPE_IGNORE_CVES += CVE-2026-23865 + # harfbuzz already depends on freetype so disable harfbuzz in freetype to avoid # a circular dependency FREETYPE_CONF_OPTS = --without-harfbuzz