c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

freetype: add patches for four vulnerabilities from project zero (#528652)

Browse source
This commit is contained in:
Vladimír Čunát 2026-06-06 17:24:47 +00:00 • committed by GitHub
commit 0ff10a9001
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 48 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

48
pkgs/by-name/fr/freetype/package.nix
View file

@ -2,6 +2,7 @@
lib,
stdenv,
fetchurl,
fetchpatch,
buildPackages,
pkgsHostHost,
pkg-config,
@ -69,6 +70,53 @@ stdenv.mkDerivation (finalAttrs: {
patches = [
./enable-table-validation.patch
# https://project-zero.issues.chromium.org/issues/505355061
# https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419
# https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
(fetchpatch {
name = "truetype-shz-limit-heap-buffer-overflow-part1.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/1803559c4ee407d0bcbf2a67dbe96690cee869d2.patch";
hash = "sha256-zxtJ2pJz8pNofgYrJ6c8/eZqRvxTotanF2IdU9ckpM4=";
})
(fetchpatch {
name = "truetype-shz-limit-heap-buffer-overflow-part2.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7d600a022e1d813e85a8c94ffd395f6135872267.patch";
hash = "sha256-aHE11C9Cr23D2lqNmTVUDA5E07xxUm+AcYdWJG9zLFs=";
})
# https://project-zero.issues.chromium.org/issues/505357209
# https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
(fetchpatch {
name = "truetype-iup-integer-overflow.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7974be74d8b5a2fbf99aa88f0461d1f80af51cee.patch";
hash = "sha256-b5Px0ALsnC5K1+601YioAjCLkLVXNnvTIZ1aQtCeNoQ=";
})
# https://project-zero.issues.chromium.org/issues/506902245
# https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
# https://gitlab.freedesktop.org/freetype/freetype/-/merge_requests/428
(fetchpatch {
name = "truetype-variation-handling-signednes-mismatch.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/0d45c7f1911bc6db0bf072eea0c8cdccd77bc6b3.patch";
hash = "sha256-bw/9O86sZQa+vwdgx2MTqxWi6vjMcRTyC42ba9CaZ3I=";
})
# prerequisite for the below to apply, since this changes formatting of
# affected code.
(fetchpatch {
name = "ftobjs-formatting.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/590b77014bd920d0bdf64c039fddbce89a288b83.patch";
hash = "sha256-govOzLBzQMAjSKABVFryDnSn2by2f/W9BgGG3o+qSuE=";
})
# https://project-zero.issues.chromium.org/issues/507321912
# https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
(fetchpatch {
name = "sub-byte-bitmaps-heap-buffer-over-read.patch";
url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/cbe12767ea73d1006edc75fcd61c0b0d2a88f34e.patch";
hash = "sha256-jMeqY9uX7Ryfdd8icGDT4kEKl6aGRWafSN8GzOhGW7g=";
})
]
++ lib.optional useEncumberedCode ./enable-subpixel-rendering.patch;