Commit Graph

6 Commits

Author SHA1 Message Date
Peter Marko
822c6db93e harfbuzz: ignore CVE-2026-22693
Patch [1] linked in NVD report fixes issue in cache code introduced only
in v6.0.0 (as can be seen in tags containind that commit).

[1] 1265ff8d99
[2] 7a004a7ac2

(From OE-Core rev: 1d7c87fa2e499927cb6a26e4b2ad99e6127b6e33)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-02-27 15:54:03 +00:00
Siddharth Doshi
b7da7c8996 harfbuzz: Security fix for CVE-2023-25193
Upstream-Status: Backport from [8708b9e081]
(From OE-Core rev: 58e212a6109a639ca0675e73967da74d6c4c5aa3)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-03-20 17:20:44 +00:00
Petr Kubizňák
dc62b99bdf harfbuzz: remove bindir only if it exists
In some scenarios (e.g. when "glib" removed from PACKAGECONFIG),
"${D}${bindir}" might not exist which caused `rmdir` to fail.

(From OE-Core rev: b342790a37c891cf83f24d4f96060e2d0bd79c07)

Signed-off-by: Petr Kubizňák <kubiznak@2n.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 21261072cbe0056e85550a0710de142fab8943e4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-26 23:37:05 +00:00
Pavel Zhukov
c82f38999b harfbuzz: Fix compilation with clang
Fixup commit for prevous CVE-2022-33068 fix.

Fixes:
| In file included from ../harfbuzz-4.0.1/src/hb-ot-face.cc:39:
4429| ../harfbuzz-4.0.1/src/hb-ot-color-sbix-table.hh:301:11: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical]
4430|       if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
4431|           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4432|                                    ||
4433| ../harfbuzz-4.0.1/src/hb-ot-color-sbix-table.hh:301:11: note: cast one or both operands to int to silence this warning
4434| 1 error generated.

(From OE-Core rev: 7505ac6da37ba00d4dad74a0312ca20fc17e64df)

Signed-off-by: Pavel Zhukov <pavel.zhukov@huawei.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-25 15:11:46 +01:00
Wentao Zhang
917569e54b harfbuzz: fix CVE-2022-33068
Backport patch from
62e803b361

The 'tff' file in upstream patch is for testing only which cause error during do_patch so need be dropped.
File test/fuzzing/fonts/sbix-extents.ttf: git binary diffs are not supported.

(From OE-Core rev: 537e7d323f57a0484c279c3b52ad5bb45eb44a10)

Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-16 06:52:45 +01:00
wangmy
80974fd763 harfbuzz: upgrade 4.0.0 -> 4.0.1
Changelog:
=========
- Update OpenType to AAT mappings for hist and vrtr features.
- Update IANA Language Subtag Registry to 2022-03-02.
- Update USE shaper to allow any non-numeric tail in a symbol cluster, and remove
  obsolete data overrides.
- Fix handling of baseline variations to return correctly scaled values.
- A new experimental hb_subset_repack_or_fail() to repack an array of objects,
  eliminating offset overflows. The API is not available unless HarfBuzz is
  built with experimental APIs enabled.
- New experimental API
  +hb_link_t
  +hb_object_t
  +hb_subset_repack_or_fail()

(From OE-Core rev: 6a668a01c6502ba9e27c1d181b013284bfec4660)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-16 10:31:41 +00:00