[AUH] libxfont2: upgrading to 2.0.9 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *libxfont2* to *2.0.9* has Succeeded.

Next steps:
    - apply the patch: git am 0001-libxfont2-upgrade-2.0.8-2.0.9.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 83bc98b2fbd88b712a646d4124572300f35c677a Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Wed, 5 Aug 2026 05:09:07 +0000
Subject: [PATCH] libxfont2: upgrade 2.0.8 -> 2.0.9

Source: ChangeLog

commit 975cc6526e892c6fad8fa49d0fef58565fbaa003
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Aug 5 10:57:21 2026 +1000

    libXfont2 2.0.9

    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jul 13 15:50:09 2026 +1000

    fserve: bounds-check cumulative glyph data writes in fs_read_glyphs

    fs_read_glyphs() copies each glyph's bitmap into a single allbits
    buffer allocated to rep->nbytes bytes. The per-glyph guard validates
    only that the source slice (position, length) lies within the pbitmaps
    source buffer. It does not check whether the running destination cursor
    has exceeded the allocation.

    A malicious font server can send overlapping source offsets (e.g. 1000
    glyphs each referencing {position:0, length:64} with nbytes=64). Each
    individual source range passes validation, but the cumulative writes
    total 64000 bytes into a 64-byte destination buffer.

    Interestingly there was an unconditional debug printf in place that
    sort-of warned about this but didn't prevent this. Let's remove that and
    instead use the actual check to bail out before we run OOB.

    A regression test is included that sends 100 glyphs each referencing
    the same 64-byte source slice into a 64-byte destination buffer, and
    verifies the library rejects the overflow.

    CVE-2026-44950

    Found-by: Zhixi "Jace" Sun, independent security researcher
    Assisted-by: Claude:claude-opus-4-6
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>

commit 668fea81f40bcb48ec67fb55d0b851049d265290
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jul 13 15:48:06 2026 +1000

    fserve: validate num_chars against encoding array size in fs_read_glyphs

    FS_QueryXExtents16 causes us to allocate the encoding[] array, later
    during the FS_QueryXBitmaps16 reply handling we fill in that array.
    There is no verification that the allocation is large enough, a
    malicious font server could send us a small numExtents and a
    large num_chars to force underallocation and OOB read/rwrite.

    A regression test is included that constructs a crafted
    FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies
    the library rejects it.

    CVE-2026-59679

    Found-by: Zhixi "Jace" Sun, independent security researcher
    Assisted-by: Claude:claude-opus-4-6
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>

commit 2d4b37f525df41399cf2cd409fb97aa30c48546a
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Jul 23 12:06:45 2026 +1000

    Disable fontserver support by default

    Debian has disabled this for over a dec

[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 .../xorg-lib/{libxfont2_2.0.8.bb => libxfont2_2.0.9.bb}         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/xorg-lib/{libxfont2_2.0.8.bb => libxfont2_2.0.9.bb} (87%)