From da1d160248523e7f570fdd7baf21f24c56c882f6 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Wed, 22 Jul 2026 17:27:39 +0800 Subject: [PATCH] Fix NULL pointer dereference in hb_ot_tags_to_script_and_language when language tag is DFLT/dflt --- ...-against-null-language-in-hb-cce964c.patch | 44 +++++++++++++++++++ harfbuzz.spec | 7 ++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch diff --git a/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch b/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch new file mode 100644 index 0000000..80f98e8 --- /dev/null +++ b/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch @@ -0,0 +1,44 @@ +From cce964cb4f3f29a9addbb079b52c7a712fba93b8 Mon Sep 17 00:00:00 2001 +From: Sai Asish Y +Date: Tue, 21 Jul 2026 17:47:36 -0700 +Subject: [PATCH] [ot-tag] guard against NULL language in + hb_ot_tags_to_script_and_language (#6085) + +hb_ot_tag_to_language returns NULL for HB_OT_TAG_DEFAULT_LANGUAGE, and hb_language_to_string returns NULL for it, so the script-suffix path called strlen on a NULL pointer whenever the primary script tag did not match the input. Skip the suffix construction when there is no base language string and leave the default (NULL) language in place. + +Signed-off-by: Sai Asish Y +--- + src/hb-ot-tag.cc | 4 ++-- + test/api/test-ot-tag.c | 3 +++ + 2 files changed, 5 insertions(+), 2 deletions(-) +diff --git a/src/hb-ot-tag.cc b/src/hb-ot-tag.cc +index 53b6b38..d92a2f5 100644 +--- a/src/hb-ot-tag.cc ++++ b/src/hb-ot-tag.cc +@@ -584,10 +584,10 @@ hb_ot_tags_to_script_and_language (hb_tag_t script_tag, + primary_script_tag, + nullptr, nullptr); + *language = hb_ot_tag_to_language (language_tag); +- if (script_count == 0 || primary_script_tag[0] != script_tag) ++ const char *lang_str = *language ? hb_language_to_string (*language) : nullptr; ++ if (lang_str && (script_count == 0 || primary_script_tag[0] != script_tag)) + { + unsigned char *buf; +- const char *lang_str = hb_language_to_string (*language); + size_t len = strlen (lang_str); + buf = (unsigned char *) hb_malloc (len + 16); + if (unlikely (!buf)) +diff --git a/test/api/test-ot-tag.c b/test/api/test-ot-tag.c +index 14928e0..0374dff 100644 +--- a/test/api/test-ot-tag.c ++++ b/test/api/test-ot-tag.c +@@ -281,6 +281,9 @@ test_ot_tags_to_script_and_language (void) + test_tags_to_script_and_language ("dev2", "MAR", "Deva", "mr-x-hbsc-64657632"); + test_tags_to_script_and_language ("dev3", "MAR", "Deva", "mr"); + test_tags_to_script_and_language ("qaa", "QTZ0", "Qaaa", "x-hbot-51545a30-hbsc-71616120"); ++ /* Default language tag maps to a NULL language; the script-suffix path ++ * must not dereference it. */ ++ test_tags_to_script_and_language ("DFLT", "dflt", "", NULL); + } + + static void diff --git a/harfbuzz.spec b/harfbuzz.spec index 2711c0b..1a30af7 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,12 +1,13 @@ Summary: HarfBuzz text shaping engine Name: harfbuzz Version: 8.1.1 -Release: 8%{?dist} +Release: 9%{?dist} License: MIT URL: http://harfbuzz.org/ Source0: https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz Patch0001: harfbuzz-8.1.1-CVE-2026-22693.patch +Patch0002: harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch BuildRequires: gcc, gcc-c++, make, automake, libtool, gtk-doc BuildRequires: freetype-devel, glib2-devel, cairo-devel, gobject-introspection-devel, libicu-devel, graphite2-devel @@ -112,6 +113,10 @@ make check %{_libdir}/libharfbuzz-icu.so.* %changelog +* Wed Jul 22 2026 PkgAgent Robot - 8.1.1-9 +- [Type] security +- [DESC] Fix NULL pointer dereference in hb_ot_tags_to_script_and_language when language tag is DFLT/dflt + * Mon Jan 12 2026 ze-you-liu - 8.1.1-8 - [Type] security - [DESC] Fix CVE-2026-22693 vulnerability -- Gitee