Your message dated Sat, 11 Jul 2026 10:32:47 +0000
with message-id <[email protected]>
and subject line Released in 13.6
has caused the Debian Bug report #1140107,
regarding trixie-pu: package libreoffice/4:25.2.3-2+deb13u6
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140107: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140107
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected],
[email protected]
Control: affects -1 + src:libreoffice
Control: affects -1 + src:graphite2
User: [email protected]
Usertags: pu
[ Reason ]
LibreOffice upstream says:
> sent to them. If that's applied then this core-side fix is needed
> to survive the subsequent graceful failure
> -> https://gerrit.collaboraoffice.com/c/online/+/2102
for the graphite2 fix (see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139173)
Filing this now only since it bases on deb13u5 which was embargoed until
today...
[ Impact ]
This is most probably minor, since it would fail on
malformed stuff anyway and this just adds a graceful failure for this
but I think we should include it nevertheless if the explicitely mention
it
[ Tests ]
none.
[ Risks ]
Looks trivial.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Backport https://gerrit.collaboraoffice.com/c/online/+/2102 as mentioned
above (well, actually the LO part
ofhttps://gerrit.libreoffice.org/c/core/+/205092)
[ Other info ]
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139173 is already in
p-u.
Debdiff attached. Didn't upload it yet this time to get a ACK or NACK
beforehand since it is minor.
Regards,
Rene
diff -Nru libreoffice-25.2.3/debian/changelog libreoffice-25.2.3/debian/changelog
--- libreoffice-25.2.3/debian/changelog 2026-05-25 13:04:39.000000000 +0200
+++ libreoffice-25.2.3/debian/changelog 2026-06-06 22:12:08.000000000 +0200
@@ -1,3 +1,11 @@
+libreoffice (4:25.2.3-2+deb13u6) trixie; urgency=medium
+
+ * debian/patches/check-for-hb_shape_full-failure.diff: add patch from
+ libreoffice-26-2 branch to gracefully handle hb_shape_full failure,
+ as can happen after the fix for CVE-2026-50593 in graphite2
+
+ -- Rene Engelhard <[email protected]> Sat, 06 Jun 2026 22:12:08 +0200
+
libreoffice (4:25.2.3-2+deb13u5) trixie-security; urgency=medium
* debian/patches/CVE-2026-*.diff: fix
diff -Nru libreoffice-25.2.3/debian/patches/check-for-hb_shape_full-failure.diff libreoffice-25.2.3/debian/patches/check-for-hb_shape_full-failure.diff
--- libreoffice-25.2.3/debian/patches/check-for-hb_shape_full-failure.diff 1970-01-01 01:00:00.000000000 +0100
+++ libreoffice-25.2.3/debian/patches/check-for-hb_shape_full-failure.diff 2026-06-06 22:04:23.000000000 +0200
@@ -0,0 +1,58 @@
+From 47ad587ae515df86b1149b36bf12edc1424c5b90 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <[email protected]>
+Date: Wed, 6 May 2026 15:37:30 +0100
+Subject: [PATCH] check for hb_shape_full failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Caol�n McNamara <[email protected]>
+Change-Id: I5fafcb7d592fb4c9091cb2bab64cb6ac47462d71
+Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2102
+Reviewed-by: Miklos Vajna <[email protected]>
+(cherry picked from commit 22c19be8fae977a90f83a82d8acccd0b46c7cf20)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204946
+Tested-by: Jenkins
+Reviewed-by: Julien Nabet <[email protected]>
+---
+ vcl/source/gdi/CommonSalLayout.cxx | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/vcl/source/gdi/CommonSalLayout.cxx b/vcl/source/gdi/CommonSalLayout.cxx
+index e6c376d1619a..51a60a945cee 100644
+--- a/vcl/source/gdi/CommonSalLayout.cxx
++++ b/vcl/source/gdi/CommonSalLayout.cxx
+@@ -204,10 +204,11 @@ public:
+ // The shapers that we want HarfBuzz to use, in the order of
+ // preference.
+ const char* const pHbShapers[] = { "graphite2", "ot", "fallback", nullptr };
+- bool ok
+- = hb_shape_full(pHbFont, m_pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers);
+- assert(ok);
+- (void)ok;
++ if (!hb_shape_full(pHbFont, m_pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers))
++ {
++ SAL_WARN("vcl.harfbuzz", "hb_shape_full failed");
++ hb_buffer_set_length(m_pHbBuffer, 0);
++ }
+
+ int nRunGlyphCount = hb_buffer_get_length(m_pHbBuffer);
+ hb_glyph_info_t* pHbGlyphInfos = hb_buffer_get_glyph_infos(m_pHbBuffer, nullptr);
+@@ -604,9 +605,11 @@ bool GenericSalLayout::LayoutText(vcl::text::ImplLayoutArgs& rArgs, const SalLay
+ // The shapers that we want HarfBuzz to use, in the order of
+ // preference.
+ const char*const pHbShapers[] = { "graphite2", "ot", "fallback", nullptr };
+- bool ok = hb_shape_full(pHbFont, pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers);
+- assert(ok);
+- (void) ok;
++ if (!hb_shape_full(pHbFont, pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers))
++ {
++ SAL_WARN("vcl.harfbuzz", "hb_shape_full failed");
++ hb_buffer_set_length(pHbBuffer, 0);
++ }
+
+ // Populate glyph cluster remapping data
+ stClusterMapper.ShapeSubRun(pStr, nLength, aSubRun, pHbFont, maFeatures, oHbLanguage);
+--
+2.47.3
+
diff -Nru libreoffice-25.2.3/debian/patches/series libreoffice-25.2.3/debian/patches/series
--- libreoffice-25.2.3/debian/patches/series 2026-05-25 10:48:22.000000000 +0200
+++ libreoffice-25.2.3/debian/patches/series 2026-06-06 22:11:29.000000000 +0200
@@ -62,3 +62,4 @@
CVE-2026-8356.diff
CVE-2026-8357.diff
CVE-2026-8358.diff
+check-for-hb_shape_full-failure.diff
--- End Message ---
--- Begin Message ---
Version: 13.6
This update was released as part of 13.6.
--- End Message ---
