new file mode 100644
@@ -0,0 +1,93 @@
+From 016a21b1eea8e4aef4949e19cdf5f386f36fd978 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 13 Jul 2026 15:48:06 +1000
+Subject: [PATCH] fserve: validate num_chars against encoding array size in
+ fs_read_glyphs
+
+FS_QueryXExtents16 causes us to allocate the encoding[] array, later
+during the FS_QueryXBitmaps16 reply handling we fill in that array.
+There is no verification that the allocation is large enough, a
+malicious font server could send us a small numExtents and a
+large num_chars to force underallocation and OOB read/rwrite.
+
+A regression test is included that constructs a crafted
+FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies
+the library rejects it.
+
+CVE-2026-59679
+
+Found-by: Zhixi "Jace" Sun, independent security researcher
+Assisted-by: Claude:claude-opus-4-6
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
+
+CVE: CVE-2026-59679
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290]
+
+Dropped makefile and test changes during backport.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/fc/fserve.c | 22 ++++++++++++++++++++++
+ src/fc/fservestr.h | 1 +
+ 2 files changed, 23 insertions(+)
+
+diff --git a/src/fc/fserve.c b/src/fc/fserve.c
+index abf7d07..744a68c 100644
+--- a/src/fc/fserve.c
++++ b/src/fc/fserve.c
+@@ -1081,6 +1081,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ return AllocError;
+ }
+ fsfont->encoding = pCI;
++ fsfont->num_encoding = numExtents;
+ if (haveInk)
+ fsfont->inkMetrics = pCI + numExtents;
+ else
+@@ -1980,6 +1981,17 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ {
+ minchar = 0;
+ maxchar = rep->num_chars;
++
++ /* Reject replies where num_chars exceeds the encoding array
++ size allocated in fs_read_extent_info() to prevent
++ out-of-bounds access on encoding[]. */
++ if (rep->num_chars > (CARD32)fsdata->num_encoding)
++ {
++ ErrorF("fserve: num_chars (%u) > num_encoding (%d)\n",
++ (unsigned) rep->num_chars, fsdata->num_encoding);
++ err = AllocError;
++ goto bail;
++ }
+ }
+
+ off_adr = (char *)ppbits;
+@@ -2001,6 +2013,16 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ for (i = 0; i < rep->num_chars; i++)
+ {
+ memcpy(&local_off, off_adr, SIZEOF(fsOffset32)); /* align it */
++ /* Bounds-check minchar against the encoding array size to
++ prevent out-of-bounds access from a malicious font server
++ reply with more num_chars than num_extents. */
++ if (minchar >= (unsigned long)fsdata->num_encoding)
++ {
++ ErrorF("fserve: glyph index %lu >= num_encoding (%d)\n",
++ minchar, fsdata->num_encoding);
++ err = AllocError;
++ goto bail;
++ }
+ if (blockrec->type == FS_OPEN_FONT ||
+ fsdata->encoding[minchar].bits == &_fs_glyph_requested)
+ {
+diff --git a/src/fc/fservestr.h b/src/fc/fservestr.h
+index 29ae46e..da95e41 100644
+--- a/src/fc/fservestr.h
++++ b/src/fc/fservestr.h
+@@ -43,6 +43,7 @@ typedef struct _fs_glyph {
+ typedef struct _fs_font {
+ CharInfoPtr pDefault;
+ CharInfoPtr encoding;
++ int num_encoding;
+ CharInfoPtr inkMetrics;
+ FSGlyphPtr glyphs;
+ } FSFontRec, *FSFontPtr;
@@ -18,6 +18,7 @@ BBCLASSEXTEND = "native"
SRC_URI += "file://CVE-2026-56001.patch \
file://CVE-2026-56002.patch \
file://CVE-2026-56003.patch \
+ file://CVE-2026-59679.patch \
"
SRC_URI[sha256sum] = "8b7b82fdeba48769b69433e8e3fbb984a5f6bf368b0d5f47abeec49de3e58efb"