Add patch to fix CVE-2010-4259 (fixes #659359)

#2781)

.cvsignore

@@ -1,2 +0,0 @@
-fontforge_full-20040824.tgz
-fontforge_htdocs-20040824.tgz

.gitignore

@@ -0,0 +1,2 @@
+fontforge_full-20061025.tar.bz2
+fontforge_htdocs-20061014.tar.bz2

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: fontforge
-# $Id$
-NAME := fontforge
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON	:= $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Rootx && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

fontforge-20061025-CVE-2010-4259.patch

@@ -0,0 +1,50 @@
+--- fontforge/fontforge/fvimportbdf.c	15 Apr 2010 10:47:36 -0000	1.58
++++ fontforge/fontforge/fvimportbdf.c	3 Dec 2010 21:03:38 -0000
+@@ -560,7 +560,7 @@
+ 	}
+     
+ 	if ( strcmp(tok,"FONT")==0 ) {
+-	    if ( sscanf(buf,"-%*[^-]-%[^-]-%[^-]-%[^-]-%*[^-]-", family, weight, italic )!=0 ) {
++	    if ( sscanf(buf,"-%*[^-]-%99[^-]-%99[^-]-%99[^-]-%*[^-]-", family, weight, italic )!=0 ) {
+ 		char *pt=buf;
+ 		int dcnt=0;
+ 		while ( *pt=='-' && dcnt<7 ) { ++pt; ++dcnt; }
+@@ -616,26 +616,30 @@
+ 	    sscanf(buf, "%d", &defs->metricsset );
+ 	else if ( strcmp(tok,"VVECTOR")==0 )
+ 	    sscanf(buf, "%*d %d", &defs->vertical_origin );
++	/* For foundry, fontname and encname, only copy up to the buffer size */
+ 	else if ( strcmp(tok,"FOUNDRY")==0 )
+-	    sscanf(buf, "%[^\"]", foundry );
++	    sscanf(buf, "%99[^\"]", foundry );
+ 	else if ( strcmp(tok,"FONT_NAME")==0 )
+-	    sscanf(buf, "%[^\"]", fontname );
++	    sscanf(buf, "%99[^\"]", fontname );
+ 	else if ( strcmp(tok,"CHARSET_REGISTRY")==0 )
+-	    sscanf(buf, "%[^\"]", encname );
++	    sscanf(buf, "%99[^\"]", encname );
+ 	else if ( strcmp(tok,"CHARSET_ENCODING")==0 ) {
+ 	    enc = 0;
+ 	    if ( sscanf(buf, " %d", &enc )!=1 )
+ 		sscanf(buf, "%d", &enc );
++	/* These properties should be copied up to the buffer length too */
+ 	} else if ( strcmp(tok,"FAMILY_NAME")==0 ) {
+-	    strcpy(family,buf);
++	    strncpy(family,buf,99);
+ 	} else if ( strcmp(tok,"FULL_NAME")==0 || strcmp(tok,"FACE_NAME")==0 ) {
+-	    strcpy(full,buf);
++	    strncpy(full,buf,99);
+ 	} else if ( strcmp(tok,"WEIGHT_NAME")==0 )
+-	    strcpy(weight,buf);
++	    strncpy(weight,buf,99);
+ 	else if ( strcmp(tok,"SLANT")==0 )
+-	    strcpy(italic,buf);
++	    strncpy(italic,buf,99);
+ 	else if ( strcmp(tok,"COPYRIGHT")==0 ) {
+-	    strcpy(comments,buf);
++		/* LS: Assume the size of the passed-in buffer is 1000, see below in
++		 * COMMENT */
++	    strncpy(comments,buf,999);
+ 	    found_copyright = true;
+ 	} else if ( strcmp(tok,"COMMENT")==0 && !found_copyright ) {
+ 	    char *pt = comments+strlen(comments);

fontforge-20061025-fsSel.patch

@@ -0,0 +1,11 @@
+--- fontforge-20061025/fontforge/tottf.c.fsSel	2006-12-09 21:36:24.000000000 +0330
++++ fontforge-20061025/fontforge/tottf.c	2006-12-09 21:41:45.000000000 +0330
+@@ -3090,7 +3090,7 @@
+     os2->fsSel = (at->head.macstyle&1?32:0)|(at->head.macstyle&2?1:0);
+     if ( sf->fullname!=NULL && strstrmatch(sf->fullname,"outline")!=NULL )
+ 	os2->fsSel |= 8;
+-    if ( os2->fsSel==0 ) os2->fsSel = 64;		/* Regular */
++    if ( os2->fsSel==0 && sf->pfminfo.weight == 400) os2->fsSel = 64;		/* Regular */
+     if ( os2->version>=4 ) {
+ 	if ( strstrmatch(sf->fontname,"Obli")==0 ) {
+ 	    os2->fsSel &= ~1;		/* Turn off Italic */

fontforge-20061025-usFirstCharIndex.patch

@@ -0,0 +1,10 @@
+--- fontforge-20061025/fontforge/tottf.c.usFirstCharIndex	2006-10-05 07:29:12.000000000 +0330
++++ fontforge-20061025/fontforge/tottf.c	2006-11-25 13:59:52.000000000 +0330
+@@ -3187,7 +3187,6 @@
+ 	os2->firstcharindex = 0xf000 + first;	/* This gets mapped to space */
+ 	os2->lastcharindex  = 0xf000 + last;
+     } else {
+-	if ( first>13 && format!=ff_otf && format!=ff_otfcid ) first = 13;	/* We give the font an extra char mapped to cr (13) */
+ 	os2->firstcharindex = first;
+ 	os2->lastcharindex = last;
+ 	OS2FigureCodePages(sf, os2->ulCodePage);

fontforge.spec

@@ -1,67 +1,82 @@
+%define docs_version 20061014
+%define gettext_package FontForge
+
 Name:           fontforge
-Version:        0.0
-Release:        0.fdr.1.20040824.2
-Epoch:          0
-Summary:        An outline and bitmap font editor
+Version:        20061025
+Release:        3%{?dist}
+Summary:        Outline and bitmap font editor
 
 Group:          Applications/Publishing
 License:        BSD
 URL:            http://fontforge.sourceforge.net/
-Source0:        http://fontforge.sourceforge.net/fontforge_full-20040824.tgz
+Source0:        http://dl.sf.net/fontforge/fontforge_full-%{version}.tar.bz2
 Source1:        fontforge.desktop
-Source2:        http://fontforge.sourceforge.net/fontforge_htdocs-20040824.tgz
-Source3:        pfaicon.gif
-Patch1:         fontforge-20040618-docview.patch
+Source2:        http://dl.sf.net/fontforge/fontforge_htdocs-%{docs_version}.tar.bz2
+Patch1:         fontforge-20061025-usFirstCharIndex.patch
+Patch2:         fontforge-20061025-fsSel.patch
+Patch3:		fontforge-20061025-CVE-2010-4259.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Requires:       htmlview
+
 BuildRequires:  libjpeg-devel
 BuildRequires:  libtiff-devel
 BuildRequires:  libpng-devel
 BuildRequires:  libungif-devel
 BuildRequires:  libxml2-devel
 BuildRequires:  freetype-devel
-BuildRequires:  XFree86-devel
-BuildRequires:  ImageMagick
 BuildRequires:  desktop-file-utils
 BuildRequires:  libuninameslist-devel
-Obsoletes:      pfaedit
+BuildRequires:  XFree86-devel
+BuildRequires:  gettext
 
-%description 
+Obsoletes:      pfaedit
+Provides:       pfaedit
+
+%description
 FontForge (former PfaEdit) is a font editor for outline and bitmap
 fonts. It supports a range of font formats, including PostScript
 (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType
 (Type2) and CID-keyed fonts.
 
 %prep
-%setup -q -n fontforge-20040824
-%patch1 -p2 -b .docview
+%setup -q -n %{name}-%{version}
+%patch1 -p1 -b .usFirstCharIndex
+%patch2 -p1 -b .fsSel
 
 mkdir htdocs
-tar xzf %{SOURCE2} -C htdocs
+tar xjf %{SOURCE2} -C htdocs
 rm -rf htdocs/scripts
+chmod 644 htdocs/*.gif
+chmod 644 htdocs/*.html
+chmod 644 htdocs/*.png
 mkdir cidmaps
 tar xzf htdocs/cidmaps.tgz -C cidmaps
 
-find . -name "CVS" -type d -print | xargs rm -r 
+sed -i -e 's/-rpath $(libdir)//' fontforge/Makefile*.in
+
+# Fix bad line terminators
+%{__sed} -i 's/\r//' htdocs/Big5.txt
+%{__sed} -i 's/\r//' htdocs/corpchar.txt
 
 
 %build
+export CPPFLAGS='-DDOCDIR=\"%{_docdir}/%{name}-%{version}/htdocs\"'
+export LIBS=-lgif
 %configure --with-regular-link --with-freetype-bytecode=no
-# Parallell make not working.
-make DOCDIR=%{_docdir}/%{name}-%{version}/htdocs
+
+make %{?_smp_mflags}
+
 
 %install
 rm -rf $RPM_BUILD_ROOT
 # make install DESTDIR=$RPM_BUILD_ROOT fails.
 %makeinstall
 install -p -m 644 cidmaps/Adobe* $RPM_BUILD_ROOT%{_datadir}/fontforge
-rm -f $RPM_BUILD_ROOT%{_libdir}/libgunicode.la $RPM_BUILD_ROOT%{_libdir}/libgdraw.la
-rm -f $RPM_BUILD_ROOT%{_libdir}/libgunicode.so $RPM_BUILD_ROOT%{_libdir}/libgdraw.so
+rm -f $RPM_BUILD_ROOT%{_libdir}/libg{draw,unicode}.{la,so}
 
-mkdir -p $RPM_BUILD_ROOT%{_datadir}/pixmaps
-convert %{SOURCE3} fontforge.png
-install -m 644 fontforge.png $RPM_BUILD_ROOT%{_datadir}/pixmaps/
+install -Dpm 644 htdocs/ffanvil32.png \
+  $RPM_BUILD_ROOT%{_datadir}/pixmaps/fontforge.png
 
 desktop-file-install \
   --vendor fedora                                          \
@@ -69,6 +84,15 @@ desktop-file-install \
   --add-category X-Fedora                                  \
   %{SOURCE1}
 
+chmod -x $RPM_BUILD_ROOT%{_libdir}/pkgconfig/fontforge.pc
+
+# The fontforge makefiles install htdocs as well, but we
+# prefer to have them under the standard RPM location, so
+# remove the extra copy
+rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/fontforge
+
+# Find translations
+%find_lang %{gettext_package}
 
 %clean
 rm -rf $RPM_BUILD_ROOT
@@ -79,18 +103,95 @@ rm -rf $RPM_BUILD_ROOT
 %postun -p /sbin/ldconfig
 
 
-%files
+%files -f %{gettext_package}.lang
 %defattr(-,root,root,-)
-%doc AUTHORS INSTALL LICENSE README htdocs
+%doc AUTHORS LICENSE htdocs
 %{_bindir}/*
-%{_libdir}/*.so.*
-%{_datadir}/applications/*.desktop
-%{_datadir}/%{name}
-%{_datadir}/pixmaps/*.png
+%{_libdir}/libg*.so.*
+%{_libdir}/pkgconfig/fontforge.pc
+%{_datadir}/applications/*fontforge.desktop
+%{_datadir}/fontforge
+%{_datadir}/pixmaps/fontforge.png
 %{_mandir}/man1/*.1*
 
 
 %changelog
+* Sat Dec 04 2010 Kevin Fenzi <kevin@tummy.com> - 20061025-3
+- Add patch to fix CVE-2010-4259 (fixes #659359)
+
+* Sat Dec 09 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20061025-2
+- Add patch to fix fsSelection problem with DejaVu ExtraLight
+
+* Sat Nov 25 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20061025-1
+- Update to 20061025
+- Patch to correct usFirstCharIndex (George Williams)
+
+* Fri Oct 20 2006 Kevin Fenzi <kevin@tummy.com> - 20061019-1
+- Update to 20061019
+
+* Thu Oct 05 2006 Christian Iseli <Christian.Iseli@licr.org> 20060822-2
+ - rebuilt for unwind info generation, broken in gcc-4.1.1-21
+
+* Thu Sep 21 2006 Kevin Fenzi <kevin@tummy.com> - 20060822-1
+- Update to 20060822
+- Remove unneeded patch
+- Add flag to compile right with giflib
+
+* Sun Jun 18 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-7
+- Add BuildRequires on gettext, to make sure the package builds in minimal
+  mock environments
+
+* Mon Feb 13 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-6
+- Rebuild for Fedora Extras 5
+
+* Sun Feb 12 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-5
+- Add patch to fix crash (#181052, George Williams)
+
+* Wed Feb 01 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-4
+- Add "BuildRequires:" on libXt-devel and xorg-x11-proto-devel
+
+* Wed Feb 01 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-3
+- Really remove XFree86-devel BuildReq
+
+* Wed Feb 01 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-2
+- Remove XFree86-devel BuildReq
+
+* Wed Feb 01 2006 Roozbeh Pournader <roozbeh@farsiweb.info> - 20060125-1
+- Update to 20060125 (bug #170177)
+- Update docs to 20060114
+- Change versioning to reflect upstream and follow packaging guidelines
+- Provide pfaedit (bug #176548)
+- Use %%{?dist} tag (bug #176472)
+- Add localizations
+- No need to remove CVS subdir: fixed upstream
+- No need to covert man pages to UTF-8: fixed upstream
+- Fixed DOS line terminators
+- Use parallel build
+
+* Sat Jul 30 2005 Owen Taylor <otaylor@redhat.com> - 0.0-2.20050729.fc4
+- Update to 20050729
+- Remove .docview patch, looking for HTMLview is upstream so no longer needed
+
+* Tue May 10 2005 Owen Taylor <otaylor@redhat.com> - 0.0-2.20050502.fc4
+- Update to 20050502
+- Fix the build to look for the docs where we install them
+
+* Sat Mar 19 2005 Owen Taylor <otaylor@redhat.com> - 0.0-2.20050310
+- Update to 20050310
+
+* Sat Jan 29 2005 Ville Skyttä <ville.skytta at iki.fi> - 0:0.0-2.20041231
+- Avoid RPATH.
+- Convert man pages to UTF-8.
+- Fix pkgconfig and doc file permissions.
+- Use updated upstream icon.
+- Don't include installation documentation.
+
+* Mon Jan 17 2005 Marius L. Jøhndal <mariuslj at ifi.uio.no> - 0:0.0-1.20041231
+- Updated to 20041231.
+
+* Thu Oct 28 2004 Marius L. Jøhndal <mariuslj at ifi.uio.no> - 0:0.0-0.fdr.1.20041014
+- Updated to 20041014.
+
 * Sun Sep 19 2004 Marius L. Jøhndal <mariuslj at ifi.uio.no> - 0:0.0-0.fdr.1.20040824
 - Updated to 20040824.
 
@@ -165,7 +266,7 @@ rm -rf $RPM_BUILD_ROOT
 - Updated to 031012.
 - Removed .so links.
 - Removed empty AUTHORS file.
-- Removed the samples subpackage. 
+- Removed the samples subpackage.
 
 * Mon Sep 22 2003 Marius L. Jøhndal <mariuslj at ifi.uio.no> 0:0.0-0.fdr.1.030904
 - Updated to 030904.

sources

@@ -1,2 +1,2 @@
-7e589796d0cd715df6db4aab2cd48f7b  fontforge_full-20040824.tgz
-fade846419ab9c6a78d2194bd4f731a4  fontforge_htdocs-20040824.tgz
+5fcfa3497d237bf68d1d388254f78448  fontforge_full-20061025.tar.bz2
+c55c948e1475d2f772aba96704e4b779  fontforge_htdocs-20061014.tar.bz2