Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libXfont2 for openSUSE:Factory checked in at 2026-08-06 16:18:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libXfont2 (Old) and /work/SRC/openSUSE:Factory/.libXfont2.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXfont2" Thu Aug 6 16:18:52 2026 rev:10 rq:1369722 version:2.0.7 Changes: -------- --- /work/SRC/openSUSE:Factory/libXfont2/libXfont2.changes 2026-07-09 22:18:33.004432268 +0200 +++ /work/SRC/openSUSE:Factory/.libXfont2.new.16738/libXfont2.changes 2026-08-06 16:19:04.637904563 +0200 @@ -1,0 +2,10 @@ +Tue Jul 28 11:43:09 UTC 2026 - Stefan Dirsch <[email protected]> + +- bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch + * libXfont2 fs_read_glyphs() heap OOB read/write via encoding array index mismatch + (CVE-2026-59679, bsc#1272660) +- bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch + * libXfont2 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow + (CVE-2026-44950, bsc#1272661) + +------------------------------------------------------------------- New: ---- bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch ----------(New B)---------- New: - bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch * libXfont2 fs_read_glyphs() heap OOB read/write via encoding array index mismatch New: (CVE-2026-59679, bsc#1272660) - bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch * libXfont2 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXfont2.spec ++++++ --- /var/tmp/diff_new_pack.HtBXke/_old 2026-08-06 16:19:05.477933869 +0200 +++ /var/tmp/diff_new_pack.HtBXke/_new 2026-08-06 16:19:05.481934009 +0200 @@ -32,6 +32,8 @@ Patch1269018: bsc1269018_CVE-2026-56001_0001-bitscale-fix-integer-overflow-in-BitmapScaleBitmaps-.patch Patch1269019: bsc1269019_CVE-2026-56002_0002-pcfread-validate-bitmap-sizes-and-offsets-against-pe.patch Patch1269020: bsc1269020_CVE-2026-56003_0003-bitscale-add-bounds-check-to-computeProps-for-proper.patch +Patch1272660: bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch +Patch1272661: bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #git#BuildRequires: autoconf >= 2.60, automake, libtool BuildRequires: pkgconfig ++++++ bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch ++++++ >From c427f713ef42a9d64fd21cfdc3575197475053bc Mon Sep 17 00:00:00 2001 From: Peter Hutterer <[email protected]> Date: Mon, 13 Jul 2026 15:48:06 +1000 Subject: [PATCH libXfont 1/2] fserve: validate num_chars against encoding array size in fs_read_glyphs FS_QueryXExtents16 causes us to allocate the encoding[] array, later during the FS_QueryXBitmaps16 reply handling we fill in that array. There is no verification that the allocation is large enough, a malicious font server could send us a small numExtents and a large num_chars to force underallocation and OOB read/rwrite. A regression test is included that constructs a crafted FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies the library rejects it. Reported-by: zx (Jace) Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer <[email protected]> --- Makefile.am | 20 +- src/fc/fserve.c | 22 ++ src/fc/fservestr.h | 1 + test/test-fserve-read-glyphs.c | 368 +++++++++++++++++++++++++++++++++ 4 files changed, 409 insertions(+), 2 deletions(-) create mode 100644 test/test-fserve-read-glyphs.c Index: libXfont2-2.0.7/src/fc/fserve.c =================================================================== --- libXfont2-2.0.7.orig/src/fc/fserve.c +++ libXfont2-2.0.7/src/fc/fserve.c @@ -1081,6 +1081,7 @@ fs_read_extent_info(FontPathElementPtr f return AllocError; } fsfont->encoding = pCI; + fsfont->num_encoding = numExtents; if (haveInk) fsfont->inkMetrics = pCI + numExtents; else @@ -1980,6 +1981,17 @@ fs_read_glyphs(FontPathElementPtr fpe, F { minchar = 0; maxchar = rep->num_chars; + + /* Reject replies where num_chars exceeds the encoding array + size allocated in fs_read_extent_info() to prevent + out-of-bounds access on encoding[]. */ + if (rep->num_chars > (CARD32)fsdata->num_encoding) + { + ErrorF("fserve: num_chars (%u) > num_encoding (%d)\n", + (unsigned) rep->num_chars, fsdata->num_encoding); + err = AllocError; + goto bail; + } } off_adr = (char *)ppbits; @@ -2001,6 +2013,16 @@ fs_read_glyphs(FontPathElementPtr fpe, F for (i = 0; i < rep->num_chars; i++) { memcpy(&local_off, off_adr, SIZEOF(fsOffset32)); /* align it */ + /* Bounds-check minchar against the encoding array size to + prevent out-of-bounds access from a malicious font server + reply with more num_chars than num_extents. */ + if (minchar >= (unsigned long)fsdata->num_encoding) + { + ErrorF("fserve: glyph index %lu >= num_encoding (%d)\n", + minchar, fsdata->num_encoding); + err = AllocError; + goto bail; + } if (blockrec->type == FS_OPEN_FONT || fsdata->encoding[minchar].bits == &_fs_glyph_requested) { Index: libXfont2-2.0.7/src/fc/fservestr.h =================================================================== --- libXfont2-2.0.7.orig/src/fc/fservestr.h +++ libXfont2-2.0.7/src/fc/fservestr.h @@ -43,6 +43,7 @@ typedef struct _fs_glyph { typedef struct _fs_font { CharInfoPtr pDefault; CharInfoPtr encoding; + int num_encoding; CharInfoPtr inkMetrics; FSGlyphPtr glyphs; } FSFontRec, *FSFontPtr; ++++++ bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch ++++++ >From 2723147a9f99749f05ba269ff66bcde6882b90db Mon Sep 17 00:00:00 2001 From: Peter Hutterer <[email protected]> Date: Mon, 13 Jul 2026 15:50:09 +1000 Subject: [PATCH libXfont 2/2] fserve: bounds-check cumulative glyph data writes in fs_read_glyphs fs_read_glyphs() copies each glyph's bitmap into a single allbits buffer allocated to rep->nbytes bytes. The per-glyph guard validates only that the source slice (position, length) lies within the pbitmaps source buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64). Each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. Interestingly there was an unconditional debug printf in place that sort-of warned about this but didn't prevent this. Let's remove that and instead use the actual check to bail out before we run OOB. A regression test is included that sends 100 glyphs each referencing the same 64-byte source slice into a 64-byte destination buffer, and verifies the library rejects the overflow. Reported-by: zx (Jace) Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Peter Hutterer <[email protected]> --- src/fc/fserve.c | 23 +++++++++------ test/test-fserve-read-glyphs.c | 52 +++++++++++++++++++++++++++++++--- 2 files changed, 62 insertions(+), 13 deletions(-) Index: libXfont2-2.0.7/src/fc/fserve.c =================================================================== --- libXfont2-2.0.7.orig/src/fc/fserve.c +++ libXfont2-2.0.7/src/fc/fserve.c @@ -1900,10 +1900,7 @@ fs_read_glyphs(FontPathElementPtr fpe, F fsOffset32 local_off; char *off_adr; pointer pbitmaps; - char *bits, *allbits; -#ifdef DEBUG - char *origallbits; -#endif + char *bits, *allbits, *origallbits; int i, err; int nranges = 0; @@ -2004,8 +2001,8 @@ fs_read_glyphs(FontPathElementPtr fpe, F goto bail; } -#ifdef DEBUG origallbits = allbits; +#ifdef DEBUG fprintf (stderr, "Reading %d glyphs in %d bytes for %s\n", (int) rep->num_chars, (int) rep->nbytes, fsd->name); #endif @@ -2036,6 +2033,18 @@ fs_read_glyphs(FontPathElementPtr fpe, F (local_off.position < rep->nbytes) && (local_off.length <= (rep->nbytes - local_off.position))) { + /* Check that the destination buffer has enough room + for this glyph to prevent a heap overflow from + overlapping source offsets. */ + if (local_off.length > + rep->nbytes - (allbits - origallbits)) + { + ErrorF("fserve: glyph data overflow: " + "cumulative write exceeds nbytes (%u)\n", + (unsigned) rep->nbytes); + err = AllocError; + goto bail; + } bits = allbits; allbits += local_off.length; memcpy(bits, (char *)pbitmaps + local_off.position, @@ -2063,10 +2072,6 @@ fs_read_glyphs(FontPathElementPtr fpe, F } off_adr += SIZEOF(fsOffset32); } -#ifdef DEBUG - fprintf (stderr, "Used %d bytes instead of %d\n", - (int) (allbits - origallbits), (int) rep->nbytes); -#endif if (blockrec->type == FS_OPEN_FONT) {
