diff --git a/.gitignore b/.gitignore index 6bf4162..85db405 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /SDL2_ttf-2.0.15.tar.gz /SDL2_ttf-2.0.18.tar.gz +/SDL2_ttf-2.20.1.tar.gz diff --git a/0000-disable-building-example-programs.patch b/0000-disable-building-example-programs.patch index 3a0c2f0..6fb00e1 100644 --- a/0000-disable-building-example-programs.patch +++ b/0000-disable-building-example-programs.patch @@ -1,9 +1,9 @@ ---- Makefile.am 2022-01-10 18:07:27.000000000 +0100 -+++ Makefile.am 2022-02-10 17:37:15.233146842 +0100 -@@ -155,9 +155,9 @@ - SDL2_ttf.spec.in \ - SDL2_ttfConfig.cmake \ - autogen.sh gcc-fat.sh +--- SDL2_ttf-2.20.1--orig/Makefile.am 2022-06-17 07:55:39.000000000 +0200 ++++ SDL2_ttf-2.20.1--patched/Makefile.am 2022-10-11 13:06:22.501314877 +0200 +@@ -160,9 +160,9 @@ + sdl2_ttf-config-version.cmake.in \ + sdl2_ttf-config.cmake.in \ + version.rc -noinst_PROGRAMS = showfont glfont +noinst_PROGRAMS = diff --git a/0001-no-harfbuzz-check.patch b/0001-no-harfbuzz-check.patch deleted file mode 100644 index 84109c1..0000000 --- a/0001-no-harfbuzz-check.patch +++ /dev/null @@ -1,31 +0,0 @@ ---- SDL2_ttf-2.0.18--orig/configure.ac 2021-12-31 19:45:28.000000000 +0100 -+++ SDL2_ttf-2.0.18--patched/configure.ac 2022-02-10 18:48:04.961535869 +0100 -@@ -164,28 +164,8 @@ - SUMMARY="${SUMMARY}Using included HarfBuzz : NO\n" - PKG_CHECK_MODULES([HB], [harfbuzz >= 2.3.1], harfbuzz=yes, harfbuzz=no) - - if test x$harfbuzz = xyes; then -- save_CFLAGS="$CFLAGS" -- save_LIBS="$LIBS" -- CFLAGS="$CFLAGS $HB_CFLAGS" -- LIBS="$LIBS $HB_LIBS" -- AC_MSG_CHECKING(for freetype support in harfbuzz) -- harbuzz_has_freetype=no -- AC_LINK_IFELSE([AC_LANG_PROGRAM([],[[ -- void* hb_ft_font_create(void*, void*); -- return !hb_ft_font_create((void*)0, (void*)0);]]) -- ],[harbuzz_has_freetype=yes]) -- CFLAGS="$save_CFLAGS" -- LIBS="$save_LIBS" -- AC_MSG_RESULT($harbuzz_has_freetype) -- if test x$harbuzz_has_freetype = xno; then -- harfbuzz=no -- AC_MSG_ERROR([dnl --*** HarfBuzz library was built without FreeType support.)]) -- fi -- fi -- if test x$harfbuzz = xyes; then - AC_DEFINE(TTF_USE_HARFBUZZ, 1, []) - TTF_CFLAGS="$TTF_CFLAGS $HB_CFLAGS" - TTF_LIBS="$TTF_LIBS $HB_LIBS" - SUMMARY="${SUMMARY}Using harfbuzz : YES\n" diff --git a/0002-CVE-2022-27470.patch b/0002-CVE-2022-27470.patch deleted file mode 100644 index 7ff3939..0000000 --- a/0002-CVE-2022-27470.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 09a2294338d7907ae955b07affdac229546f9cc9 Mon Sep 17 00:00:00 2001 -From: Sylvain -Date: Sat, 19 Mar 2022 16:17:23 +0100 -Subject: [PATCH 1/2] Fixed bug #187 - Arbitrary memory overwrite occurs when - loading glyphs and rendering text with a malformed TTF Pitch/size isn't - calculated with 64 bits precisions - ---- - SDL_ttf.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/SDL_ttf.c b/SDL_ttf.c -index 053f42b..1c19458 100644 ---- a/SDL_ttf.c -+++ b/SDL_ttf.c -@@ -1257,7 +1257,7 @@ static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui - */ - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- int pitch = width + alignment; -+ Sint64 pitch = width + alignment; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; -@@ -1321,7 +1321,7 @@ static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S - */ - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- int pitch = width + alignment; -+ Sint64 pitch = width + alignment; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; -@@ -1418,7 +1418,7 @@ static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg, - Sint64 size; - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- int pitch = (width + alignment) * 4; -+ Sint64 pitch = (width + alignment) * 4; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; - -From db1b41ab8bde6723c24b866e466cad78c2fa0448 Mon Sep 17 00:00:00 2001 -From: Sylvain -Date: Sat, 19 Mar 2022 20:40:28 +0100 -Subject: [PATCH 2/2] More integer overflow (see bug #187) Make sure that - 'width + alignment' doesn't overflow, otherwise it could create a SDL_Surface - of 'width' but with wrong 'pitch' - ---- - SDL_ttf.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/SDL_ttf.c b/SDL_ttf.c -index 1c19458..6a0956b 100644 ---- a/SDL_ttf.c -+++ b/SDL_ttf.c -@@ -1257,7 +1257,7 @@ static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui - */ - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- Sint64 pitch = width + alignment; -+ Sint64 pitch = (Sint64)width + (Sint64)alignment; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; -@@ -1321,7 +1321,7 @@ static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S - */ - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- Sint64 pitch = width + alignment; -+ Sint64 pitch = (Sint64)width + (Sint64)alignment; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; -@@ -1418,7 +1418,7 @@ static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg, - Sint64 size; - void *pixels, *ptr; - /* Worse case at the end of line pulling 'alignment' extra blank pixels */ -- Sint64 pitch = (width + alignment) * 4; -+ Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4; - pitch += alignment; - pitch &= ~alignment; - size = height * pitch + sizeof (void *) + alignment; diff --git a/mingw-SDL2_ttf.spec b/mingw-SDL2_ttf.spec index d03e88e..2147d89 100644 --- a/mingw-SDL2_ttf.spec +++ b/mingw-SDL2_ttf.spec @@ -3,8 +3,8 @@ Name: mingw-SDL2_ttf License: zlib -Version: 2.0.18 -Release: 4%{?dist} +Version: 2.20.1 +Release: 1%{?dist} %global pkg_summary MinGW Windows port of the TrueType font handling library for SDL2 Summary: %{pkg_summary} @@ -15,18 +15,6 @@ Source0: %{URL}release/SDL2_ttf-%{version}.tar.gz # By default, some example programs are also built - we want only the library. Patch0: 0000-disable-building-example-programs.patch -# The configure script checks if harfbuzz was built with freetype support, -# but Fedora's harfbuzz.dll uses delayed loading for freetype.dll, -# which causes this check to fail. This patch removes the check entirely. -Patch1: 0001-no-harfbuzz-check.patch - -# Fix for CVE-2022-27470 -# Backport of upstream commits: -# - https://github.com/libsdl-org/SDL_ttf/commit/09a2294338d7907ae955b07affdac229546f9cc9 -# - https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448 -# See: https://bugzilla.redhat.com/show_bug.cgi?id=2081599 -Patch2: 0002-CVE-2022-27470.patch - BuildArch: noarch BuildRequires: autoconf @@ -76,9 +64,7 @@ Summary: %{pkg_summary} %prep %setup -q -n SDL2_ttf-%{version} -%patch0 -p0 -%patch1 -p1 -%patch2 -p1 +%patch0 -p1 %build @@ -88,6 +74,7 @@ Summary: %{pkg_summary} --disable-dependency-tracking \ --enable-freetype-builtin=no \ --enable-harfbuzz-builtin=no \ + --enable-harfbuzz=yes \ %mingw_make_build @@ -99,29 +86,36 @@ Summary: %{pkg_summary} find %{buildroot} -name "*.la" -delete # Convert CRLF line endings to LF -sed -i 's/\r$//' README.txt CHANGES.txt COPYING.txt +sed -i 's/\r$//' README.txt CHANGES.txt LICENSE.txt # Win32 %files -n mingw32-SDL2_ttf %doc CHANGES.txt README.txt -%license COPYING.txt +%license LICENSE.txt %{mingw32_bindir}/SDL2_ttf.dll %{mingw32_libdir}/libSDL2_ttf.dll.a +%{mingw32_libdir}/cmake/SDL2_ttf/ %{mingw32_libdir}/pkgconfig/SDL2_ttf.pc %{mingw32_includedir}/SDL2 # Win64 %files -n mingw64-SDL2_ttf %doc CHANGES.txt README.txt -%license COPYING.txt +%license LICENSE.txt %{mingw64_bindir}/SDL2_ttf.dll %{mingw64_libdir}/libSDL2_ttf.dll.a +%{mingw64_libdir}/cmake/SDL2_ttf/ %{mingw64_libdir}/pkgconfig/SDL2_ttf.pc %{mingw64_includedir}/SDL2 %changelog +* Tue Oct 11 2022 Artur Frenszek-Iwicki - 2.20.1-1 +- Update to v2.20.1 +- Drop Patch1 (fix faulty Harfbuzz check - no longer needed, issue fixed upstream) +- Drop Patch2 (fix for CVE-2022-27470 - included in this release) + * Thu Jul 21 2022 Fedora Release Engineering - 2.0.18-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 37aaaa1..2e0edef 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (SDL2_ttf-2.0.18.tar.gz) = 9a211c07d4180fe3fb2f7614e907d1002ddf3bb77b57f62116f22dc29a6043f091deb6a8113656d26a44d2f06b9abcc372aa3e0761500fcf47b455406973a1c7 +SHA512 (SDL2_ttf-2.20.1.tar.gz) = 5745a318583a771dff30421d79c5940bdb0fe2f8908a0192e98a2a80076722ba53f6488e922de5b49e078f0c7d9d358e681886ebc8862d89ca6671b5be471134