Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package harfbuzz for openSUSE:Factory checked in at 2023-02-07 18:48:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/harfbuzz (Old) and /work/SRC/openSUSE:Factory/.harfbuzz.new.4462 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "harfbuzz" Tue Feb 7 18:48:25 2023 rev:97 rq:1063505 version:6.0.0 Changes: -------- --- /work/SRC/openSUSE:Factory/harfbuzz/harfbuzz.changes 2022-12-20 20:20:03.077734967 +0100 +++ /work/SRC/openSUSE:Factory/.harfbuzz.new.4462/harfbuzz.changes 2023-02-07 18:48:37.078981043 +0100 @@ -1,0 +2,6 @@ +Mon Feb 6 17:11:49 UTC 2023 - Michael Gorse <[email protected]> + +- Add harfbuzz-CVE-2023-25193.patch: limit how far we skip when + looking back (boo#1207922 CVE-2023-25193). + +------------------------------------------------------------------- New: ---- harfbuzz-CVE-2023-25193.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ harfbuzz.spec ++++++ --- /var/tmp/diff_new_pack.0l2UoU/_old 2023-02-07 18:48:37.698984375 +0100 +++ /var/tmp/diff_new_pack.0l2UoU/_new 2023-02-07 18:48:37.710984439 +0100 @@ -1,7 +1,7 @@ # # spec file for package harfbuzz # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -24,6 +24,8 @@ URL: https://www.freedesktop.org/wiki/Software/HarfBuzz Source0: https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/%{name}-%{version}.tar.xz Source99: baselibs.conf +# PATCH-FIX-UPSTREAM harfbuzz-CVE-2023-25193.patch boo#1207922 [email protected] -- limit how far we skip when looking back. +Patch0: harfbuzz-CVE-2023-25193.patch BuildRequires: c++_compiler BuildRequires: c_compiler BuildRequires: meson ++++++ harfbuzz-CVE-2023-25193.patch ++++++ >From 85be877925ddbf34f74a1229f3ca1716bb6170dc Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod <[email protected]> Date: Wed, 1 Feb 2023 20:00:43 -0700 Subject: [PATCH] [layout] Limit how far we skip when looking back See comments. --- src/hb-ot-layout-gsubgpos.hh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh index bf74672a1..8ca691805 100644 --- a/src/hb-ot-layout-gsubgpos.hh +++ b/src/hb-ot-layout-gsubgpos.hh @@ -578,6 +578,13 @@ struct hb_ot_apply_context_t : unsigned stop = num_items - 1; if (c->buffer->flags & HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT) stop = 1 - 1; + + /* When looking back, limit how far we search; this function is mostly + * used for looking back for base glyphs when attaching marks. If we + * don't limit, we can get O(n^2) behavior where n is the number of + * consecutive marks. */ + stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH); + while (idx > stop) { idx--; -- 2.39.0
