开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 3

_service:tar_scm:harfbuzz.spec Changed

_service:tar_scm:backport-CVE-2022-33068.patch -> _service:tar_scm:backport-CVE-2023-25193.patch Changed

@@ -1,29 +1,31 @@
-From 62e803b36173fd096d7ad460dd1d1db9be542593 Mon Sep 17 00:00:00 2001
+From 85be877925ddbf34f74a1229f3ca1716bb6170dc Mon Sep 17 00:00:00 2001
 From: Behdad Esfahbod <behdad@behdad.org>
-Date: Wed, 1 Jun 2022 07:38:21 -0600
-Subject: PATCH sbix Limit glyph extents
+Date: Wed, 1 Feb 2023 20:00:43 -0700
+Subject: PATCH layout Limit how far we skip when looking back
 
-Fixes https://github.com/harfbuzz/harfbuzz/issues/3557
+See comments.
 ---
- src/hb-ot-color-sbix-table.hh       |   6 ++++++
- test/fuzzing/fonts/sbix-extents.ttf | Bin 0 -> 582 bytes
- 2 files changed, 6 insertions(+)
- create mode 100644 test/fuzzing/fonts/sbix-extents.ttf
+ src/hb-ot-layout-gsubgpos.hh | 7 +++++++
+ 1 file changed, 7 insertions(+)
 
-diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh
-index 9741ebd450..6efae43cda 100644
---- a/src/hb-ot-color-sbix-table.hh
-+++ b/src/hb-ot-color-sbix-table.hh
-@@ -298,6 +298,12 @@ struct sbix
- 
-       const PNGHeader &png = *blob->as<PNGHeader>();
- 
-+      if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
-+      {
-+	hb_blob_destroy (blob);
-+	return false;
-+      }
+diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh
+index bf74672a1..8ca691805 100644
+--- a/src/hb-ot-layout-gsubgpos.hh
++++ b/src/hb-ot-layout-gsubgpos.hh
+@@ -578,6 +578,13 @@ struct hb_ot_apply_context_t :
+       unsigned stop = num_items - 1;
+       if (c->buffer->flags & HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT)
+         stop = 1 - 1;
 +
-       extents->x_bearing = x_offset;
-       extents->y_bearing = png.IHDR.height + y_offset;
-       extents->width     = png.IHDR.width;
++      /* When looking back, limit how far we search; this function is mostly
++       * used for looking back for base glyphs when attaching marks. If we
++       * don't limit, we can get O(n^2) behavior where n is the number of
++       * consecutive marks. */
++      stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);
++
+       while (idx > stop)
+       {
+ 	idx--;
+-- 
+2.20.1
+

_service Changed

_service:tar_scm:harfbuzz-4.3.0.tar.xz -> _service:tar_scm:harfbuzz-6.0.0.tar.xz Changed