music pushed to rpms/sfnt2woff-zopfli (rawhide). "Fix a possible double free in woffEncode()"

Notification time stamped 2022-11-29 16:46:46 UTC

From b5b1c0fff5b5d2a884e28245bbf4ebbb8fe3d4c7 Mon Sep 17 00:00:00 2001
From: Benjamin A. Beasley 
Date: Nov 29 2022 16:46:28 +0000
Subject: Fix a possible double free in woffEncode()

---

diff --git a/18.patch b/18.patch
new file mode 100644
index 0000000..e2afe21
--- /dev/null
+++ b/18.patch
@@ -0,0 +1,28 @@
+From 0ff83fc1dabb0ba0fd42f12ba4fa7f401006315f Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" 
+Date: Tue, 29 Nov 2022 10:29:18 -0500
+Subject: [PATCH] Fix a possible double free in woffEncode()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The tableOrder is freed after the header is wrtten. If a decoding or
+encoding failure occurs thereafter, resulting in a jump to the “failure”
+label, the tableOrder can be freed again. Set the tableOrder pointer
+null when freeing it to prevent this.
+---
+ woff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/woff.c b/woff.c
+index dc77c42..6da832e 100644
+--- a/woff.c
++++ b/woff.c
+@@ -359,6 +359,7 @@ woffEncode(const uint8_t * sfntData, uint32_t sfntLen,
+   newHeader->privLen = 0;
+ 
+   free(tableOrder);
++  tableOrder = 0;
+ 
+   if ((status & eWOFF_warn_checksum_mismatch) != 0) {
+     /* The original font had checksum errors, so we now decode our WOFF data
diff --git a/sfnt2woff-zopfli.spec b/sfnt2woff-zopfli.spec
index 37963a2..6a17acd 100644
--- a/sfnt2woff-zopfli.spec
+++ b/sfnt2woff-zopfli.spec
@@ -21,6 +21,10 @@ License:        MPL-1.0 OR GPL-2.0-or-later OR LGPL-2.0-or-later
 URL:            https://github.com/bramstein/sfnt2woff-zopfli
 Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz

+# Fix a possible double free in woffEncode()
+# https://github.com/bramstein/sfnt2woff-zopfli/pull/18
+Patch:          %{url}/pull/18.patch
+
 # Note that the URL http://people.mozilla.org/~jkew/woff/, where the original
 # WOFF reference implementation sources were published, is no longer available.
 # A copy of that page can be found at
@@ -43,7 +47,7 @@ A corresponding version of the woff2sfnt utility is also provided.

%prep
-%autosetup
+%autosetup -p1
 # Strip out bundled Zopfli sources
 rm -rvf zopfli

https://src.fedoraproject.org/rpms/sfnt2woff-zopfli/c/b5b1c0fff5b5d2a884e282...