[OE-core][wrynose][PATCH 1/3] ffmpeg: mark CVE-2026-52295, CVE-2026-52296 and CVE-2026-52297 fixed

[OE-core][wrynose][PATCH 1/3] ffmpeg: mark CVE-2026-52295, CVE-2026-52296 and CVE-2026-52297 fixed

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

CVE-2026-52295:
Debian[1] identified the fix[2] which exists[3] in the upstream version.

CVE-2026-52296:
Debian[4] identified the fix[5] which exists[6] in the upstream version.

CVE-2026-52297:
Debian[7] identified the fix[8] which exists[9] in the upstream version.

[1]https://security-tracker.debian.org/tracker/CVE-2026-52295
[2]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/016a241102250372a9c2e96f6e8dca67ec01d3f7
[3]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ff43ef5219ad543e57ed56d065e9d4a3b0426468

[4]https://security-tracker.debian.org/tracker/CVE-2026-52296
[5]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/23227a444de4a8f7696f46660cdd044b460f7e47
[6]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d18354f8d4bd018eb486d18079ff0afb3b84c506

[7]https://security-tracker.debian.org/tracker/CVE-2026-52297
[8]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8439e0203744a30d280668fcd086f74ed5001da1
[9]https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ebff1abbad8b036bfc0f52a4785433b06e865e3b

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
index 8a6eb4eb86..e84a29ac87 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
@@ -185,3 +185,6 @@ CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since v8.0"
 CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since v8.0"
 CVE_STATUS[CVE-2026-8461] = "cpe-stable-backport: this CVE are fixed since v8.0.3"
 CVE_STATUS[CVE-2026-40962] = "cpe-stable-backport: this CVE are fixed since v8.0.2"
+CVE_STATUS[CVE-2026-52295] = "fixed-version: fixed since v8.0.2"
+CVE_STATUS[CVE-2026-52297] = "fixed-version: fixed since v8.0.2"
+CVE_STATUS[CVE-2026-52297] = "fixed-version: fixed since v8.0.2"

[OE-core][wrynose][PATCH 2/3] libxfont2: patch CVE-2026-59679

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Debian[1] also identified the fix.

[1]https://security-tracker.debian.org/tracker/CVE-2026-59679

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../xorg-lib/libxfont2/CVE-2026-59679.patch   | 93 +++++++++++++++++++
 .../xorg-lib/libxfont2_2.0.7.bb               |  1 +
 2 files changed, 94 insertions(+)
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-59679.patch

diff --git a/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-59679.patch b/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-59679.patch
new file mode 100644
index 0000000000..8e2ea4bd62
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-59679.patch
@@ -0,0 +1,93 @@
+From 016a21b1eea8e4aef4949e19cdf5f386f36fd978 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 13 Jul 2026 15:48:06 +1000
+Subject: [PATCH] fserve: validate num_chars against encoding array size in
+ fs_read_glyphs
+
+FS_QueryXExtents16 causes us to allocate the encoding[] array, later
+during the FS_QueryXBitmaps16 reply handling we fill in that array.
+There is no verification that the allocation is large enough, a
+malicious font server could send us a small numExtents and a
+large num_chars to force underallocation and OOB read/rwrite.
+
+A regression test is included that constructs a crafted
+FS_QueryXBitmaps16 reply with num_chars > num_encoding and verifies
+the library rejects it.
+
+CVE-2026-59679
+
+Found-by: Zhixi "Jace" Sun, independent security researcher
+Assisted-by: Claude:claude-opus-4-6
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
+
+CVE: CVE-2026-59679
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/668fea81f40bcb48ec67fb55d0b851049d265290]
+
+Dropped makefile and test changes during backport.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/fc/fserve.c    | 22 ++++++++++++++++++++++
+ src/fc/fservestr.h |  1 +
+ 2 files changed, 23 insertions(+)
+
+diff --git a/src/fc/fserve.c b/src/fc/fserve.c
+index abf7d07..744a68c 100644
+--- a/src/fc/fserve.c
++++ b/src/fc/fserve.c
+@@ -1081,6 +1081,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 	return AllocError;
+     }
+     fsfont->encoding = pCI;
++    fsfont->num_encoding = numExtents;
+     if (haveInk)
+ 	fsfont->inkMetrics = pCI + numExtents;
+     else
+@@ -1980,6 +1981,17 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     {
+ 	minchar = 0;
+ 	maxchar = rep->num_chars;
++
++	/* Reject replies where num_chars exceeds the encoding array
++	   size allocated in fs_read_extent_info() to prevent
++	   out-of-bounds access on encoding[]. */
++	if (rep->num_chars > (CARD32)fsdata->num_encoding)
++	{
++	    ErrorF("fserve: num_chars (%u) > num_encoding (%d)\n",
++		   (unsigned) rep->num_chars, fsdata->num_encoding);
++	    err = AllocError;
++	    goto bail;
++	}
+     }
+ 
+     off_adr = (char *)ppbits;
+@@ -2001,6 +2013,16 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     for (i = 0; i < rep->num_chars; i++)
+     {
+ 	memcpy(&local_off, off_adr, SIZEOF(fsOffset32));	/* align it */
++	/* Bounds-check minchar against the encoding array size to
++	   prevent out-of-bounds access from a malicious font server
++	   reply with more num_chars than num_extents. */
++	if (minchar >= (unsigned long)fsdata->num_encoding)
++	{
++	    ErrorF("fserve: glyph index %lu >= num_encoding (%d)\n",
++		   minchar, fsdata->num_encoding);
++	    err = AllocError;
++	    goto bail;
++	}
+ 	if (blockrec->type == FS_OPEN_FONT ||
+ 	    fsdata->encoding[minchar].bits == &_fs_glyph_requested)
+ 	{
+diff --git a/src/fc/fservestr.h b/src/fc/fservestr.h
+index 29ae46e..da95e41 100644
+--- a/src/fc/fservestr.h
++++ b/src/fc/fservestr.h
+@@ -43,6 +43,7 @@ typedef struct _fs_glyph {
+ typedef struct _fs_font {
+     CharInfoPtr pDefault;
+     CharInfoPtr encoding;
++    int		num_encoding;
+     CharInfoPtr inkMetrics;
+     FSGlyphPtr	glyphs;
+ }           FSFontRec, *FSFontPtr;
diff --git a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
index de6418b11a..8775d1cc13 100644
--- a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
+++ b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
@@ -18,6 +18,7 @@ BBCLASSEXTEND = "native"
 SRC_URI += "file://CVE-2026-56001.patch \
             file://CVE-2026-56002.patch \
             file://CVE-2026-56003.patch \
+            file://CVE-2026-59679.patch \
            "
 
 SRC_URI[sha256sum] = "8b7b82fdeba48769b69433e8e3fbb984a5f6bf368b0d5f47abeec49de3e58efb"

[OE-core][wrynose][PATCH 3/3] libxfont2: patch CVE-2026-44950

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Debian[1] also identified the fix.

[1]https://security-tracker.debian.org/tracker/CVE-2026-44950

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../xorg-lib/libxfont2/CVE-2026-44950.patch   | 99 +++++++++++++++++++
 .../xorg-lib/libxfont2_2.0.7.bb               |  1 +
 2 files changed, 100 insertions(+)
 create mode 100644 meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-44950.patch

diff --git a/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-44950.patch b/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-44950.patch
new file mode 100644
index 0000000000..96e3c1f0a8
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libxfont2/CVE-2026-44950.patch
@@ -0,0 +1,99 @@
+From b48aa50f2ba02f74167492c1c3aa312a7590991a Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 13 Jul 2026 15:50:09 +1000
+Subject: [PATCH] fserve: bounds-check cumulative glyph data writes in
+ fs_read_glyphs
+
+fs_read_glyphs() copies each glyph's bitmap into a single allbits
+buffer allocated to rep->nbytes bytes. The per-glyph guard validates
+only that the source slice (position, length) lies within the pbitmaps
+source buffer. It does not check whether the running destination cursor
+has exceeded the allocation.
+
+A malicious font server can send overlapping source offsets (e.g. 1000
+glyphs each referencing {position:0, length:64} with nbytes=64). Each
+individual source range passes validation, but the cumulative writes
+total 64000 bytes into a 64-byte destination buffer.
+
+Interestingly there was an unconditional debug printf in place that
+sort-of warned about this but didn't prevent this. Let's remove that and
+instead use the actual check to bail out before we run OOB.
+
+A regression test is included that sends 100 glyphs each referencing
+the same 64-byte source slice into a 64-byte destination buffer, and
+verifies the library rejects the overflow.
+
+CVE-2026-44950
+
+Found-by: Zhixi "Jace" Sun, independent security researcher
+Assisted-by: Claude:claude-opus-4-6
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxfont/-/merge_requests/36>
+(cherry picked from commit c2d222bb22c623d8a40f3275077fc7e6617f2c8a)
+
+CVE: CVE-2026-44950
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/c2d222bb22c623d8a40f3275077fc7e6617f2c8a]
+
+Dropped test changes during the backport.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/fc/fserve.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/src/fc/fserve.c b/src/fc/fserve.c
+index abf7d07..0fdc090 100644
+--- a/src/fc/fserve.c
++++ b/src/fc/fserve.c
+@@ -1899,10 +1899,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     fsOffset32		    local_off;
+     char		    *off_adr;
+     pointer		    pbitmaps;
+-    char		    *bits, *allbits;
+-#ifdef DEBUG
+-    char		    *origallbits;
+-#endif
++    char		    *bits, *allbits, *origallbits;
+     int			    i,
+ 			    err;
+     int			    nranges = 0;
+@@ -1992,8 +1989,8 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 	goto bail;
+     }
+ 
+-#ifdef DEBUG
+     origallbits = allbits;
++#ifdef DEBUG
+     fprintf (stderr, "Reading %d glyphs in %d bytes for %s\n",
+ 	     (int) rep->num_chars, (int) rep->nbytes, fsd->name);
+ #endif
+@@ -2014,6 +2011,18 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 		    (local_off.position < rep->nbytes) &&
+ 		    (local_off.length <= (rep->nbytes - local_off.position)))
+ 		{
++		    /* Check that the destination buffer has enough room
++		       for this glyph to prevent a heap overflow from
++		       overlapping source offsets. */
++		    if (local_off.length >
++			rep->nbytes - (allbits - origallbits))
++		    {
++			ErrorF("fserve: glyph data overflow: "
++			       "cumulative write exceeds nbytes (%u)\n",
++			       (unsigned) rep->nbytes);
++			err = AllocError;
++			goto bail;
++		    }
+ 		    bits = allbits;
+ 		    allbits += local_off.length;
+ 		    memcpy(bits, (char *)pbitmaps + local_off.position,
+@@ -2041,10 +2050,6 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 	}
+ 	off_adr += SIZEOF(fsOffset32);
+     }
+-#ifdef DEBUG
+-    fprintf (stderr, "Used %d bytes instead of %d\n",
+-	     (int) (allbits - origallbits), (int) rep->nbytes);
+-#endif
+ 
+     if (blockrec->type == FS_OPEN_FONT)
+     {
diff --git a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
index 8775d1cc13..17cfc133d6 100644
--- a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
+++ b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.7.bb
@@ -19,6 +19,7 @@ SRC_URI += "file://CVE-2026-56001.patch \
             file://CVE-2026-56002.patch \
             file://CVE-2026-56003.patch \
             file://CVE-2026-59679.patch \
+            file://CVE-2026-44950.patch \
            "
 
 SRC_URI[sha256sum] = "8b7b82fdeba48769b69433e8e3fbb984a5f6bf368b0d5f47abeec49de3e58efb"