mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libxfont2: Fix CVE-2026-56001

Browse Source 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56001
[2] https://security-tracker.debian.org/tracker/CVE-2026-56001

(From OE-Core rev: 78e09979d47a03846afa7c52758e6f24ac659627)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Vijay Anusuri
2026-08-24 18:26:51 +05:30
committed by Richard Purdie
parent 04cc7f252d
commit 28e31d5c6b
2 changed files with 78 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-56001.patch Normal file
View File

@@ -0,0 +1,75 @@
From be0b08e2d354138d3222b4490e2a77c6ee42f778 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 1 Jun 2026 16:46:10 +1000
Subject: [PATCH] bitscale: fix integer overflow in BitmapScaleBitmaps
bytestoalloc
bytestoalloc is declared as unsigned int (32-bit). When the sum of
per-glyph byte counts exceeds 2^32, the value wraps around and calloc()
allocates a buffer that is too small. The subsequent ScaleBitmap loop
then writes past the end of the allocated buffer.
Change bytestoalloc from unsigned int to size_t to match the actual
allocation size type, and add an explicit overflow check in the
accumulation loop to bail out if the total would exceed SIZE_MAX.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
CVE-2026-56001/ZDI-CAN-30558
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/34>
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/be0b08e2d354138d3222b4490e2a77c6ee42f778]
CVE: CVE-2026-56001
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
src/bitmap/bitscale.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
diff --git a/src/bitmap/bitscale.c b/src/bitmap/bitscale.c
index e29ba96..7100138 100644
--- a/src/bitmap/bitscale.c
+++ b/src/bitmap/bitscale.c
@@ -1460,7 +1460,7 @@ BitmapScaleBitmaps(FontPtr pf, /* scaled font */
opci;
FontInfoPtr pfi;
int glyph;
- unsigned bytestoalloc = 0;
+ size_t bytestoalloc = 0;
int firstCol, lastCol, firstRow, lastRow;
double xform[4], inv_xform[4];
@@ -1487,8 +1487,25 @@ BitmapScaleBitmaps(FontPtr pf, /* scaled font */
glyph = pf->glyph;
for (i = 0; i < nchars; i++)
{
- if ((pci = ACCESSENCODING(bitmapFont->encoding, i)))
- bytestoalloc += BYTES_FOR_GLYPH(pci, glyph);
+ if ((pci = ACCESSENCODING(bitmapFont->encoding, i))) {
+ size_t glyphsize = BYTES_FOR_GLYPH(pci, glyph);
+ if (bytestoalloc > SIZE_MAX - glyphsize) {
+ fprintf(stderr,
+ "Error: bitmap allocation overflow for scaled font\n");
+ goto bail;
+ }
+ bytestoalloc += glyphsize;
+ }
+ }
+
+ /* Reject unreasonably large bitmap allocations that could result
+ * from malicious fonts with extreme scale factors. 256 MiB is
+ * far beyond any legitimate scaled bitmap font. */
+#define BITMAP_SCALE_MAX_ALLOC (256 * 1024 * 1024)
+ if (bytestoalloc > BITMAP_SCALE_MAX_ALLOC) {
+ fprintf(stderr,
+ "Error: scaled bitmap size %zu exceeds limit\n", bytestoalloc);
+ goto bail;
}
/* Do we add the font malloc stuff for VALUE ADDED ? */
--
2.43.0

3
meta/recipes-graphics/xorg-lib/libxfont2_2.0.6.bb
View File

@@ -15,6 +15,9 @@ XORG_PN = "libXfont2"
BBCLASSEXTEND = "native"
SRC_URI += "file://CVE-2026-56001.patch \
"
SRC_URI[sha256sum] = "74ca20017eb0fb3f56d8d5e60685f560fc85e5ff3d84c61c4cb891e40c27aef4"
PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"