mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libxfont2: Fix CVE-2026-56003

Browse Source 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56003
[2] https://security-tracker.debian.org/tracker/CVE-2026-56003

(From OE-Core rev: 0590e69f65ec1da5d545faec44fdfa8be8a03631)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Vijay Anusuri
2026-08-24 18:26:53 +05:30
committed by Richard Purdie
parent bd2ef0458c
commit 4e5fdf25e3
2 changed files with 115 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-56003.patch Normal file
View File

@@ -0,0 +1,114 @@
From dff957a5158da038a282a59a31fe736702732939 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 1 Jun 2026 16:49:55 +1000
Subject: [PATCH] bitscale: add bounds check to computeProps for property
buffer
ComputeScaledProperties allocates a fixed-size property buffer of 70
slots. computeProps iterates the source font's properties and writes 1
slot for unscaled properties or 2 slots for scaledX/scaledY properties,
with no bounds check. A malicious font with many duplicate properties
matching fontPropTable entries can overflow the allocated buffer.
Fix this by passing the remaining buffer capacity to computeProps and
checking it before each write. Properties that would exceed the buffer
are silently skipped.
The function is also restructured to handle the buffer writes for
scaledX/scaledY inside the switch cases directly, rather than in a
separate block after the switch. This makes the control flow clearer and
ensures the bounds check covers all writes.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
CVE-2026-56003/ZDI-CAN-30560
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/34>
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/dff957a5158da038a282a59a31fe736702732939]
CVE: CVE-2026-56003
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
src/bitmap/bitscale.c | 39 ++++++++++++++++++++-------------------
1 file changed, 20 insertions(+), 19 deletions(-)
diff --git a/src/bitmap/bitscale.c b/src/bitmap/bitscale.c
index 7100138..1fd15be 100644
--- a/src/bitmap/bitscale.c
+++ b/src/bitmap/bitscale.c
@@ -511,7 +511,8 @@ static int
computeProps(FontPropPtr pf, char *wasStringProp,
FontPropPtr npf, char *isStringProp,
unsigned int nprops, double xfactor, double yfactor,
- double sXfactor, double sYfactor)
+ double sXfactor, double sYfactor,
+ int maxprops)
{
int n;
int count;
@@ -526,14 +527,26 @@ computeProps(FontPropPtr pf, char *wasStringProp,
switch (t->type) {
case scaledX:
- npf->value = doround(xfactor * (double)pf->value);
- rawfactor = sXfactor;
- break;
case scaledY:
- npf->value = doround(yfactor * (double)pf->value);
- rawfactor = sYfactor;
+ if (count + 2 > maxprops)
+ continue;
+ npf->value = (t->type == scaledX)
+ ? doround(xfactor * (double)pf->value)
+ : doround(yfactor * (double)pf->value);
+ rawfactor = (t->type == scaledX) ? sXfactor : sYfactor;
+ npf->name = pf->name;
+ npf++;
+ count++;
+ npf->value = doround(rawfactor * (double)pf->value);
+ npf->name = rawFontPropTable[t - fontPropTable].atom;
+ npf++;
+ count++;
+ *isStringProp++ = *wasStringProp;
+ *isStringProp++ = *wasStringProp;
break;
case unscaled:
+ if (count + 1 > maxprops)
+ continue;
npf->value = pf->value;
npf->name = pf->name;
npf++;
@@ -543,18 +556,6 @@ computeProps(FontPropPtr pf, char *wasStringProp,
default:
break;
}
- if (t->type != unscaled)
- {
- npf->name = pf->name;
- npf++;
- count++;
- npf->value = doround(rawfactor * (double)pf->value);
- npf->name = rawFontPropTable[t - fontPropTable].atom;
- npf++;
- count++;
- *isStringProp++ = *wasStringProp;
- *isStringProp++ = *wasStringProp;
- }
}
return count;
}
@@ -671,7 +672,7 @@ ComputeScaledProperties(FontInfoPtr sourceFontInfo, /* the font to be scaled */
n = NPROPS;
n += computeProps(sourceFontInfo->props, sourceFontInfo->isStringProp,
fp, isStringProp, sourceFontInfo->nprops, dx, dy,
- sdx, sdy);
+ sdx, sdy, nProps - NPROPS);
return n;
}
--
2.43.0

1
meta/recipes-graphics/xorg-lib/libxfont2_2.0.6.bb
View File

@@ -17,6 +17,7 @@ BBCLASSEXTEND = "native"
SRC_URI += "file://CVE-2026-56001.patch \
file://CVE-2026-56002.patch \
file://CVE-2026-56003.patch \
"
SRC_URI[sha256sum] = "74ca20017eb0fb3f56d8d5e60685f560fc85e5ff3d84c61c4cb891e40c27aef4"