Skip to contentSkip to conversation

freetype: bump version to 2.9.1

PATCH New Peter Seiderer 2 participants 4 messages Nov 28, 2018 – Dec 3, 2018

lore
Share & tools
lore

Peter Seiderer

author
#0 lore raw

PATCH 1/1 freetype: bump version to 2.9.1

According to [1]:

- fixes CVE-2018-6942
- needs '--enable-freetype-config' for freetype-config installation

[1] https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/CHANGES?id=86bc8a95056c97a810986434a3f268cbe67f2902

Signed-off-by Peter Seiderer <[email protected]>
---
 package/freetype/freetype.hash | 8 ++++----
 package/freetype/freetype.mk   | 5 ++++-
 2 files changed, 8 insertions(+), 5 deletions(-)
package/freetype/freetype.hash +4 -4
index 806375c058..c98674c7c2 100644
@@ -1,9 +1,9 @@
-# From https://sourceforge.net/projects/freetype/files/freetype2/2.9/
-md5	513c403c110016fdc7e537216a642b1d		freetype-2.9.tar.bz2
-sha1	94c4399b1a55c5892812e732843fcb4a7c2fe657	freetype-2.9.tar.bz2
+# From https://sourceforge.net/projects/freetype/files/freetype2/2.9.1/
+md5 60ef7d8160cd4bf8cb118ee9d65367ca freetype-2.9.1.tar.bz2
+sha1 220c82062171c513e4017c523d196933c9de4a7d freetype-2.9.1.tar.bz2
 
 # Locally calculated
-sha256	e6ffba3c8cef93f557d1f767d7bc3dee860ac7a3aaff588a521e081bc36f4c8a	freetype-2.9.tar.bz2
+sha256	db8d87ea720ea9d5edc5388fc7a0497bb11ba9fe972245e0f7f4c7e8b1e1e84d	freetype-2.9.1.tar.bz2
 sha256	fd056de4196903a676208ef58cfddafc7d583d1f28fa2e44c309cf84a59e62fb	docs/LICENSE.TXT
 sha256	08c135755dd589039470f1fdbb400daaabaaa50d0b366d19cebff4d22986baa1	docs/FTL.TXT
 sha256	c4120c6752c910c299e3bd9cb3a46ff262c268303ca2069b61f92f10a5656c18	docs/GPLv2.TXT
package/freetype/freetype.mk +4 -1
index 1b3a9d1755..c9ea960798 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FREETYPE_VERSION = 2.9
+FREETYPE_VERSION = 2.9.1
 FREETYPE_SOURCE = freetype-$(FREETYPE_VERSION).tar.bz2
 FREETYPE_SITE = http://download.savannah.gnu.org/releases/freetype
 FREETYPE_INSTALL_STAGING = YES

@@ -14,6 +14,9 @@ FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT
 FREETYPE_DEPENDENCIES = host-pkgconf
 FREETYPE_CONFIG_SCRIPTS = freetype-config
 
+# since 2.9.1 needed for freetyep-config install
+FREETYPE_CONF_OPTS = --enable-freetype-config
+
 HOST_FREETYPE_DEPENDENCIES = host-pkgconf
 HOST_FREETYPE_CONF_OPTS = --without-zlib --without-bzip2 --without-png
Signature · 1 line
2.19.1
#1 lore raw

PATCH 1/1 freetype: bump version to 2.9.1

Quoted 4 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Seiderer <[email protected]> writes:

According to [1]:
- fixes CVE-2018-6942

It is always great to add a short description what this is about. I've added:

A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

(from https://security-tracker.debian.org/tracker/CVE-2018-6942)

Quoted 12 lines
package/freetype/freetype.mk +1 -1
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-FREETYPE_VERSION = 2.9
+FREETYPE_VERSION = 2.9.1
 FREETYPE_SOURCE = freetype-$(FREETYPE_VERSION).tar.bz2
 FREETYPE_SITE = http://download.savannah.gnu.org/releases/freetype
 FREETYPE_INSTALL_STAGING = YES

package/freetype/freetype.mk FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT · line 17

Quoted 4 lines
package/freetype/freetype.mk +1 -0
@@ -14,6 +14,9 @@ FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT
 FREETYPE_DEPENDENCIES = host-pkgconf
 FREETYPE_CONFIG_SCRIPTS = freetype-config
 
+# since 2.9.1 needed for freetyep-config install

s/freetyep/freetype/

package/freetype/freetype.mk FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT · line 18

Quoted 1 line
package/freetype/freetype.mk +1 -0
+FREETYPE_CONF_OPTS = --enable-freetype-config

We probably also need this for the host variant. Committed after adding that, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 freetype: bump version to 2.9.1

Hello Peter,

Quoted 5 lines · Peter Korsgaard
Quoted 4 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Seiderer <[email protected]> writes:

According to [1]:
- fixes CVE-2018-6942

Quoted 7 lines

It is always great to add a short description what this is about. I've added:

A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

(from https://security-tracker.debian.org/tracker/CVE-2018-6942)

O.k, will try to add some the next time...

Quoted 17 lines
Quoted 16 lines
package/freetype/freetype.mk +1 -1
@@ -4,7 +4,7 @@
 #
 ################################################################################  
 
-FREETYPE_VERSION = 2.9
+FREETYPE_VERSION = 2.9.1
 FREETYPE_SOURCE = freetype-$(FREETYPE_VERSION).tar.bz2
 FREETYPE_SITE = http://download.savannah.gnu.org/releases/freetype
 FREETYPE_INSTALL_STAGING = YES

@@ -14,6 +14,9 @@ FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT
 FREETYPE_DEPENDENCIES = host-pkgconf
 FREETYPE_CONFIG_SCRIPTS = freetype-config
Quoted 3 lines

package/freetype/freetype.mk FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT · line 17

Quoted 1 line
package/freetype/freetype.mk +1 -0
+# since 2.9.1 needed for freetyep-config install

s/freetyep/freetype/

Ups, thanks for fixing...

Quoted 6 lines

package/freetype/freetype.mk FREETYPE_LICENSE_FILES = docs/LICENSE.TXT docs/FTL.TXT docs/GPLv2.TXT · line 18

Quoted 2 lines
package/freetype/freetype.mk +1 -0
+FREETYPE_CONF_OPTS = --enable-freetype-config

We probably also need this for the host variant. Committed after adding that, thanks.

Was not sure about this as FREETYPE_FIX_CONFIG_FILE and FREETYPE_FIX_CONFIG_FILE_LIBS are only applied for the target build, but the option will not hurt for the host build...

Thanks for all the fixes ;-)

Regards,
Peter

#3 lore raw

PATCH 1/1 freetype: bump version to 2.9.1

In reply to Peter Seiderer
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Seiderer <[email protected]> writes:

According to [1]:
- fixes CVE-2018-6942
- needs '--enable-freetype-config' for freetype-config installation

[1]
https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/CHANGES?id=86bc8a95056c97a810986434a3f268cbe67f2902

Signed-off-by Peter Seiderer <[email protected]>

Committed to 2018.02.x and 2018.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard