external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 | 29
++++++++++
external/harfbuzz/UnpackedTarball_harfbuzz.mk | 1
2 files changed, 30 insertions(+)
New commits:
commit 75c9db41d1a06830d15eb43341fa196597de2bb0
Author: Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Wed Sep 14 20:02:03 2022 +0200
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Thu Sep 15 16:33:25 2022 +0200
harfbuzz: add patch for CVE-2022-33068
Should be fixed in release 4.4.0
Change-Id: I9ff234f9687c7f57d9226df91b17ddb0bc083cca
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139952
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmik...@collabora.com>
(cherry picked from commit 424d2e86cc103336fb70cd8ef7aacde1ac2e28ef)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/140005
Tested-by: Thorsten Behrens <thorsten.behr...@allotropia.de>
Reviewed-by: Thorsten Behrens <thorsten.behr...@allotropia.de>
diff --git a/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1
b/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1
new file mode 100644
index 000000000000..2aef204a26e1
--- /dev/null
+++ b/external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1
@@ -0,0 +1,29 @@
+From 62e803b36173fd096d7ad460dd1d1db9be542593 Mon Sep 17 00:00:00 2001
+From: Behdad Esfahbod <beh...@behdad.org>
+Date: Wed, 1 Jun 2022 07:38:21 -0600
+Subject: [PATCH] [sbix] Limit glyph extents
+
+Fixes https://github.com/harfbuzz/harfbuzz/issues/3557
+---
+ src/hb-ot-color-sbix-table.hh | 6 ++++++
+ test/fuzzing/fonts/sbix-extents.ttf | Bin 0 -> 582 bytes
+ 2 files changed, 6 insertions(+)
+ create mode 100644 test/fuzzing/fonts/sbix-extents.ttf
+
+diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh
+index 9741ebd450..6efae43cda 100644
+--- a/src/hb-ot-color-sbix-table.hh
++++ b/src/hb-ot-color-sbix-table.hh
+@@ -298,6 +298,12 @@ struct sbix
+
+ const PNGHeader &png = *blob->as<PNGHeader>();
+
++ if (png.IHDR.height >= 65536 || png.IHDR.width >= 65536)
++ {
++ hb_blob_destroy (blob);
++ return false;
++ }
++
+ extents->x_bearing = x_offset;
+ extents->y_bearing = png.IHDR.height + y_offset;
+ extents->width = png.IHDR.width;
diff --git a/external/harfbuzz/UnpackedTarball_harfbuzz.mk
b/external/harfbuzz/UnpackedTarball_harfbuzz.mk
index adec72ed0d57..9957f89e1b5c 100644
--- a/external/harfbuzz/UnpackedTarball_harfbuzz.mk
+++ b/external/harfbuzz/UnpackedTarball_harfbuzz.mk
@@ -20,6 +20,7 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,harfbuzz,0))
$(eval $(call gb_UnpackedTarball_add_patches,harfbuzz, \
external/harfbuzz/ubsan.patch \
external/harfbuzz/icu-65-api-macros-with-semicolon.patch.1 \
+ external/harfbuzz/62e803b36173fd096d7ad460dd1d1db9be542593.patch.1 \
))
# vim: set noet sw=4 ts=4:
