已合并
add CVE-2026-23865 #111
ZacohZhen创建于 3月7日
add CVE-2026-23865 #111
已合并
共 2 个文件变更+38-1
| @@ -0,0 +1,35 @@ | |||
| 1 | +diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c | ||
| 2 | +index 4f0083c..0e1e21f 100644 | ||
| 3 | +--- a/src/truetype/ttgxvar.c | ||
| 4 | ++++ b/src/truetype/ttgxvar.c | ||
| 5 | + | ||
| 6 | + FT_UShort word_delta_count; | ||
| 7 | + FT_UInt region_idx_count; | ||
| 8 | + FT_UInt per_region_size; | ||
| 9 | +- | ||
| 10 | ++ FT_UInt delta_set_size; | ||
| 11 | + | ||
| 12 | + if ( FT_STREAM_SEEK( offset + dataOffsetArray[i] ) ) | ||
| 13 | + goto Exit; | ||
| 14 | + | ||
| 15 | + if ( long_words ) | ||
| 16 | + per_region_size *= 2; | ||
| 17 | + | ||
| 18 | +- if ( FT_NEW_ARRAY( varData->deltaSet, per_region_size * item_count ) ) | ||
| 19 | ++ | ||
| 20 | ++ /* Check for overflow (we actually test whether the */ | ||
| 21 | ++ /* multiplication of two unsigned values wraps around). */ | ||
| 22 | ++ delta_set_size = per_region_size * item_count; | ||
| 23 | ++ if ( per_region_size && | ||
| 24 | ++ delta_set_size / per_region_size != item_count ) | ||
| 25 | ++ { | ||
| 26 | ++ FT_TRACE2(( "tt_var_load_item_variation_store:" | ||
| 27 | ++ " bad delta set array size\n" )); | ||
| 28 | ++ error = FT_THROW( Array_Too_Large ); | ||
| 29 | ++ goto Exit; | ||
| 30 | ++ } | ||
| 31 | ++ | ||
| 32 | ++ if ( FT_NEW_ARRAY( varData->deltaSet, delta_set_size ) ) | ||
| 33 | + goto Exit; | ||
| 34 | + if ( FT_Stream_Read( stream, | ||
| 35 | + varData->deltaSet, | ||
| @@ -39,6 +39,7 @@ def move_file(src_path, dst_path): | |||
| 39 | "backport-freetype-2.10.0-internal-outline.patch", | 39 | "backport-freetype-2.10.0-internal-outline.patch", |
| 40 | "backport-freetype-2.10.1-debughook.patch", | 40 | "backport-freetype-2.10.1-debughook.patch", |
| 41 | "backport-freetype-2.12.1-enable-funcs.patch", | 41 | "backport-freetype-2.12.1-enable-funcs.patch", |
| 42 | + "CVE-2026-23865.patch", | ||
| 42 | "ftconfig.h" | 43 | "ftconfig.h" |
| 43 | ] | 44 | ] |
| 44 | for file in files: | 45 | for file in files: |
| @@ -74,7 +75,8 @@ def do_patch(target_dir): | |||
| 74 | "backport-freetype-2.8-multilib.patch", | 75 | "backport-freetype-2.8-multilib.patch", |
| 75 | "backport-freetype-2.10.0-internal-outline.patch", | 76 | "backport-freetype-2.10.0-internal-outline.patch", |
| 76 | "backport-freetype-2.10.1-debughook.patch", | 77 | "backport-freetype-2.10.1-debughook.patch", |
| 77 | - "backport-freetype-2.12.1-enable-funcs.patch" | 78 | + "backport-freetype-2.12.1-enable-funcs.patch", |
| 79 | + "CVE-2026-23865.patch" | ||
| 78 | ] | 80 | ] |
| 79 | 81 | ||
| 80 | for patch in patch_file: | 82 | for patch in patch_file: |