On Fri Feb 20, 2026 at 3:34 PM CET, Hugo Simeliere via lists.openembedded.org wrote: > From: Hugo SIMELIERE <[email protected]> > > Upstream-Status: Backport from > https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae
Hello, Same remarks as your recent zlib CVE patch. Thanks! > > Signed-off-by: Bruno VERNAY <[email protected]> > Signed-off-by: Hugo SIMELIERE <[email protected]> > --- > .../harfbuzz/files/CVE-2026-22693.patch | 33 +++++++++++++++++++ > .../harfbuzz/harfbuzz_11.4.5.bb | 4 ++- > 2 files changed, 36 insertions(+), 1 deletion(-) > create mode 100644 meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch > > diff --git a/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch > b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch > new file mode 100644 > index 0000000000..bf821bb63a > --- /dev/null > +++ b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch > @@ -0,0 +1,33 @@ > +From 21c880d1154a5bcef2ef68c1687d286820a274ee Mon Sep 17 00:00:00 2001 > +From: Behdad Esfahbod <[email protected]> > +Date: Fri, 9 Jan 2026 04:54:42 -0700 > +Subject: [PATCH] [cmap] malloc fail test (#5710) > + > +Fixes > https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww > + > +Upstream-Status: Backport > [https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae] > +CVE: CVE-2026-22693 > + > +Signed-off-by: Hugo SIMELIERE <[email protected]> > +--- > + src/hb-ot-cmap-table.hh | 4 ++++ > + 1 file changed, 4 insertions(+) > + > +diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh > +index 294b2b60d..95a436b54 100644 > +--- a/src/hb-ot-cmap-table.hh > ++++ b/src/hb-ot-cmap-table.hh > +@@ -1679,6 +1679,10 @@ struct SubtableUnicodesCache { > + { > + SubtableUnicodesCache* cache = > + (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache)); > ++ > ++ if (unlikely (!cache)) > ++ return nullptr; > ++ > + new (cache) SubtableUnicodesCache (source_table); > + return cache; > + } > +-- > +2.43.0 > + > diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb > b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb > index 9e0e42b717..2364dd7efd 100644 > --- a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb > +++ b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb > @@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = > "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \ > > file://src/hb-ucd.cc;beginline=1;endline=15;md5=29d4dcb6410429195df67efe3382d8bc > \ > " > > -SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz" > +SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz \ > + file://CVE-2026-22693.patch \ > + " > SRC_URI[sha256sum] = > "0f052eb4ab01d8bae98ba971c954becb32be57d7250f18af343b1d27892e03fa" > > DEPENDS += "glib-2.0-native" -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#231635): https://lists.openembedded.org/g/openembedded-core/message/231635 Mute This Topic: https://lists.openembedded.org/mt/117910362/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
