Notification time stamped 2022-11-29 16:46:46 UTC
From b5b1c0fff5b5d2a884e28245bbf4ebbb8fe3d4c7 Mon Sep 17 00:00:00 2001
From: Benjamin A. Beasley <code(a)musicinmybrain.net>
Date: Nov 29 2022 16:46:28 +0000
Subject: Fix a possible double free in woffEncode()
---
diff --git a/18.patch b/18.patch
new file mode 100644
index 0000000..e2afe21
--- /dev/null
+++ b/18.patch
@@ -0,0 +1,28 @@
+From 0ff83fc1dabb0ba0fd42f12ba4fa7f401006315f Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code(a)musicinmybrain.net>
+Date: Tue, 29 Nov 2022 10:29:18 -0500
+Subject: [PATCH] Fix a possible double free in woffEncode()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The tableOrder is freed after the header is wrtten. If a decoding or
+encoding failure occurs thereafter, resulting in a jump to the “failure”
+label, the tableOrder can be freed again. Set the tableOrder pointer
+null when freeing it to prevent this.
+---
+ woff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/woff.c b/woff.c
+index dc77c42..6da832e 100644
+--- a/woff.c
++++ b/woff.c
+@@ -359,6 +359,7 @@ woffEncode(const uint8_t * sfntData, uint32_t sfntLen,
+ newHeader->privLen = 0;
+
+ free(tableOrder);
++ tableOrder = 0;
+
+ if ((status & eWOFF_warn_checksum_mismatch) != 0) {
+ /* The original font had checksum errors, so we now decode our WOFF data
diff --git a/sfnt2woff-zopfli.spec b/sfnt2woff-zopfli.spec
index 37963a2..6a17acd 100644
--- a/sfnt2woff-zopfli.spec
+++ b/sfnt2woff-zopfli.spec
@@ -21,6 +21,10 @@ License: MPL-1.0 OR GPL-2.0-or-later OR LGPL-2.0-or-later
URL:
https://github.com/bramstein/sfnt2woff-zopfli
Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
+# Fix a possible double free in woffEncode()
+#
https://github.com/bramstein/sfnt2woff-zopfli/pull/18
+Patch: %{url}/pull/18.patch
+
# Note that the URL
http://people.mozilla.org/~jkew/woff/, where the original
# WOFF reference implementation sources were published, is no longer available.
# A copy of that page can be found at
@@ -43,7 +47,7 @@ A corresponding version of the woff2sfnt utility is also provided.
%prep
-%autosetup
+%autosetup -p1
# Strip out bundled Zopfli sources
rm -rvf zopfli
https://src.fedoraproject.org/rpms/sfnt2woff-zopfli/c/b5b1c0fff5b5d2a884e...