Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56003
[2] https://security-tracker.debian.org/tracker/CVE-2026-56003

Signed-off-by: Vijay Anusuri <[email protected]>
---
 .../xorg-lib/libxfont/CVE-2026-56003.patch    | 115 ++++++++++++++++++
 .../xorg-lib/libxfont_1.5.4.bb                |   1 +
 2 files changed, 116 insertions(+)
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont/CVE-2026-56003.patch

diff --git a/meta/recipes-graphics/xorg-lib/libxfont/CVE-2026-56003.patch 
b/meta/recipes-graphics/xorg-lib/libxfont/CVE-2026-56003.patch
new file mode 100644
index 0000000000..4a9a72e152
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libxfont/CVE-2026-56003.patch
@@ -0,0 +1,115 @@
+From dff957a5158da038a282a59a31fe736702732939 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <[email protected]>
+Date: Mon, 1 Jun 2026 16:49:55 +1000
+Subject: [PATCH] bitscale: add bounds check to computeProps for property
+ buffer
+
+ComputeScaledProperties allocates a fixed-size property buffer of 70
+slots. computeProps iterates the source font's properties and writes 1
+slot for unscaled properties or 2 slots for scaledX/scaledY properties,
+with no bounds check. A malicious font with many duplicate properties
+matching fontPropTable entries can overflow the allocated buffer.
+
+Fix this by passing the remaining buffer capacity to computeProps and
+checking it before each write. Properties that would exceed the buffer
+are silently skipped.
+
+The function is also restructured to handle the buffer writes for
+scaledX/scaledY inside the switch cases directly, rather than in a
+separate block after the switch. This makes the control flow clearer and
+ensures the bounds check covers all writes.
+
+This vulnerability was discovered by:
+Anonymous working with TrendAI Zero Day Initiative
+
+CVE-2026-56003/ZDI-CAN-30560
+
+Assisted-by: Claude:claude-opus-4-6
+Signed-off-by: Peter Hutterer <[email protected]>
+Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/34>
+
+Upstream-Status: Backport [import from debian libxfont1 1.5.2-4+deb9u1
+Upstream commit 
https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939]
+CVE: CVE-2026-56003
+Signed-off-by: Vijay Anusuri <[email protected]>
+---
+ src/bitmap/bitscale.c | 39 ++++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/src/bitmap/bitscale.c b/src/bitmap/bitscale.c
+index c87fa96..012b207 100644
+--- a/src/bitmap/bitscale.c
++++ b/src/bitmap/bitscale.c
+@@ -513,7 +513,8 @@ static int
+ computeProps(FontPropPtr pf, char *wasStringProp,
+            FontPropPtr npf, char *isStringProp,
+            unsigned int nprops, double xfactor, double yfactor,
+-           double sXfactor, double sYfactor)
++           double sXfactor, double sYfactor,
++           int maxprops)
+ {
+     int         n;
+     int         count;
+@@ -528,14 +529,26 @@ computeProps(FontPropPtr pf, char *wasStringProp,
+ 
+       switch (t->type) {
+       case scaledX:
+-          npf->value = doround(xfactor * (double)pf->value);
+-          rawfactor = sXfactor;
+-          break;
+       case scaledY:
+-          npf->value = doround(yfactor * (double)pf->value);
+-          rawfactor = sYfactor;
++          if (count + 2 > maxprops)
++              continue;
++          npf->value = (t->type == scaledX)
++              ? doround(xfactor * (double)pf->value)
++              : doround(yfactor * (double)pf->value);
++          rawfactor = (t->type == scaledX) ? sXfactor : sYfactor;
++          npf->name = pf->name;
++          npf++;
++          count++;
++          npf->value = doround(rawfactor * (double)pf->value);
++          npf->name = rawFontPropTable[t - fontPropTable].atom;
++          npf++;
++          count++;
++          *isStringProp++ = *wasStringProp;
++          *isStringProp++ = *wasStringProp;
+           break;
+       case unscaled:
++          if (count + 1 > maxprops)
++              continue;
+           npf->value = pf->value;
+           npf->name = pf->name;
+           npf++;
+@@ -545,18 +558,6 @@ computeProps(FontPropPtr pf, char *wasStringProp,
+       default:
+           break;
+       }
+-      if (t->type != unscaled)
+-      {
+-          npf->name = pf->name;
+-          npf++;
+-          count++;
+-          npf->value = doround(rawfactor * (double)pf->value);
+-          npf->name = rawFontPropTable[t - fontPropTable].atom;
+-          npf++;
+-          count++;
+-          *isStringProp++ = *wasStringProp;
+-          *isStringProp++ = *wasStringProp;
+-      }
+     }
+     return count;
+ }
+@@ -671,7 +672,7 @@ ComputeScaledProperties(FontInfoPtr sourceFontInfo, /* the 
font to be scaled */
+     n = NPROPS;
+     n += computeProps(sourceFontInfo->props, sourceFontInfo->isStringProp,
+                     fp, isStringProp, sourceFontInfo->nprops, dx, dy,
+-                    sdx, sdy);
++                    sdx, sdy, nProps - NPROPS);
+     return n;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/meta/recipes-graphics/xorg-lib/libxfont_1.5.4.bb 
b/meta/recipes-graphics/xorg-lib/libxfont_1.5.4.bb
index 08c96fdac8..e254516fcf 100644
--- a/meta/recipes-graphics/xorg-lib/libxfont_1.5.4.bb
+++ b/meta/recipes-graphics/xorg-lib/libxfont_1.5.4.bb
@@ -21,6 +21,7 @@ BBCLASSEXTEND = "native"
 
 SRC_URI += "file://CVE-2026-56001.patch \
             file://CVE-2026-56002.patch \
+            file://CVE-2026-56003.patch \
            "
 
 SRC_URI[sha256sum] = 
"1a7f7490774c87f2052d146d1e0e64518d32e6848184a18654e8d0bb57883242"
-- 
2.43.0

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#244068): 
https://lists.openembedded.org/g/openembedded-core/message/244068
Mute This Topic: https://lists.openembedded.org/mt/120899338/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to