new file mode 100644
@@ -0,0 +1,181 @@
+From 7890a39d98e73c59156ebd6ff58a4a455801745f Mon Sep 17 00:00:00 2001
+From: Peter Kydas <pk@canva.com>
+Date: Tue, 6 Feb 2024 10:23:36 +1100
+Subject: [PATCH] fix splinefont shell command injection
+
+CVE: CVE-2024-25081 CVE-2024-25082
+Upstream-Status: Backport [https://github.com/fontforge/fontforge/pull/5367/commits/a64099931ea004a08e074b08ad0984d92c25daa2]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ fontforge/splinefont.c | 125 +++++++++++++++++++++++++++++------------
+ 1 file changed, 90 insertions(+), 35 deletions(-)
+
+diff --git a/fontforge/splinefont.c b/fontforge/splinefont.c
+index ef1ed27ea..9a70c90d9 100644
+--- a/fontforge/splinefont.c
++++ b/fontforge/splinefont.c
+@@ -799,11 +799,14 @@ return( name );
+
+ char *Unarchive(char *name, char **_archivedir) {
+ char *dir = getenv("TMPDIR");
+- char *pt, *archivedir, *listfile, *listcommand, *unarchivecmd, *desiredfile;
++ char *pt, *archivedir, *listfile, *desiredfile;
+ char *finalfile;
+ int i;
+ int doall=false;
+ static int cnt=0;
++ gchar *command[5];
++ gchar *stdoutresponse = NULL;
++ gchar *stderrresponse = NULL;
+
+ *_archivedir = NULL;
+
+@@ -838,18 +841,30 @@ return( NULL );
+ listfile = malloc(strlen(archivedir)+strlen("/" TOC_NAME)+1);
+ sprintf( listfile, "%s/" TOC_NAME, archivedir );
+
+- listcommand = malloc( strlen(archivers[i].unarchive) + 1 +
+- strlen( archivers[i].listargs) + 1 +
+- strlen( name ) + 3 +
+- strlen( listfile ) +4 );
+- sprintf( listcommand, "%s %s %s > %s", archivers[i].unarchive,
+- archivers[i].listargs, name, listfile );
+- if ( system(listcommand)!=0 ) {
+- free(listcommand); free(listfile);
+- ArchiveCleanup(archivedir);
+-return( NULL );
+- }
+- free(listcommand);
++ command[0] = archivers[i].unarchive;
++ command[1] = archivers[i].listargs;
++ command[2] = name;
++ command[3] = NULL; // command args need to be NULL-terminated
++
++ if ( g_spawn_sync(
++ NULL,
++ command,
++ NULL,
++ G_SPAWN_SEARCH_PATH,
++ NULL,
++ NULL,
++ &stdoutresponse,
++ &stderrresponse,
++ NULL,
++ NULL
++ ) == FALSE) { // did not successfully execute
++ ArchiveCleanup(archivedir);
++ return( NULL );
++ }
++ // Write out the listfile to be read in later
++ FILE *fp = fopen(listfile, "wb");
++ fwrite(stdoutresponse, strlen(stdoutresponse), 1, fp);
++ fclose(fp);
+
+ desiredfile = ArchiveParseTOC(listfile, archivers[i].ars, &doall);
+ free(listfile);
+@@ -858,22 +873,28 @@ return( NULL );
+ return( NULL );
+ }
+
+- /* I tried sending everything to stdout, but that doesn't work if the */
+- /* output is a directory file (ufo, sfdir) */
+- unarchivecmd = malloc( strlen(archivers[i].unarchive) + 1 +
+- strlen( archivers[i].listargs) + 1 +
+- strlen( name ) + 1 +
+- strlen( desiredfile ) + 3 +
+- strlen( archivedir ) + 30 );
+- sprintf( unarchivecmd, "( cd %s ; %s %s %s %s ) > /dev/null", archivedir,
+- archivers[i].unarchive,
+- archivers[i].extractargs, name, doall ? "" : desiredfile );
+- if ( system(unarchivecmd)!=0 ) {
+- free(unarchivecmd); free(desiredfile);
+- ArchiveCleanup(archivedir);
+-return( NULL );
++ command[0] = archivers[i].unarchive;
++ command[1] = archivers[i].extractargs;
++ command[2] = name;
++ command[3] = doall ? "" : desiredfile;
++ command[4] = NULL;
++
++ if ( g_spawn_sync(
++ (gchar*)archivedir,
++ command,
++ NULL,
++ G_SPAWN_SEARCH_PATH,
++ NULL,
++ NULL,
++ &stdoutresponse,
++ &stderrresponse,
++ NULL,
++ NULL
++ ) == FALSE) { // did not successfully execute
++ free(desiredfile);
++ ArchiveCleanup(archivedir);
++ return( NULL );
+ }
+- free(unarchivecmd);
+
+ finalfile = malloc( strlen(archivedir) + 1 + strlen(desiredfile) + 1);
+ sprintf( finalfile, "%s/%s", archivedir, desiredfile );
+@@ -896,20 +917,54 @@ struct compressors compressors[] = {
+
+ char *Decompress(char *name, int compression) {
+ char *dir = getenv("TMPDIR");
+- char buf[1500];
+ char *tmpfn;
+-
++ gchar *command[4];
++ gint stdout_pipe;
++ gchar buffer[4096];
++ gssize bytes_read;
++ GByteArray *binary_data = g_byte_array_new();
++
+ if ( dir==NULL ) dir = P_tmpdir;
+ tmpfn = malloc(strlen(dir)+strlen(GFileNameTail(name))+2);
+ strcpy(tmpfn,dir);
+ strcat(tmpfn,"/");
+ strcat(tmpfn,GFileNameTail(name));
+ *strrchr(tmpfn,'.') = '\0';
+- snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfn );
+- if ( system(buf)==0 )
+-return( tmpfn );
+- free(tmpfn);
+-return( NULL );
++
++ command[0] = compressors[compression].decomp;
++ command[1] = "-c";
++ command[2] = name;
++ command[3] = NULL;
++
++ // Have to use async because g_spawn_sync doesn't handle nul-bytes in the output (which happens with binary data)
++ if (g_spawn_async_with_pipes(
++ NULL,
++ command,
++ NULL,
++ G_SPAWN_DO_NOT_REAP_CHILD | G_SPAWN_SEARCH_PATH,
++ NULL,
++ NULL,
++ NULL,
++ NULL,
++ &stdout_pipe,
++ NULL,
++ NULL) == FALSE) {
++ //command has failed
++ return( NULL );
++ }
++
++ // Read binary data from pipe and output to file
++ while ((bytes_read = read(stdout_pipe, buffer, sizeof(buffer))) > 0) {
++ g_byte_array_append(binary_data, (guint8 *)buffer, bytes_read);
++ }
++ close(stdout_pipe);
++
++ FILE *fp = fopen(tmpfn, "wb");
++ fwrite(binary_data->data, sizeof(gchar), binary_data->len, fp);
++ fclose(fp);
++ g_byte_array_free(binary_data, TRUE);
++
++ return(tmpfn);
+ }
+
+ static char *ForceFileToHaveName(FILE *file, char *exten) {
@@ -19,6 +19,7 @@ SRC_URI = "git://github.com/${BPN}/${BPN}.git;branch=master;protocol=https \
file://0001-include-sys-select-on-non-glibc-platforms.patch \
file://CVE-2020-25690-1.patch \
file://CVE-2020-25690-2.patch \
+ file://CVE-2024-25081-25082.patch \
"
S = "${WORKDIR}/git"
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-25081 https://nvd.nist.gov/vuln/detail/CVE-2024-25082 The same patch fixes both vulnerabilities. Take the patch from the pull request that is referenced by the nv report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> --- .../fontforge/CVE-2024-25081-25082.patch | 181 ++++++++++++++++++ .../fontforge/fontforge_20190801.bb | 1 + 2 files changed, 182 insertions(+) create mode 100644 meta-oe/recipes-graphics/fontforge/fontforge/CVE-2024-25081-25082.patch