[OE-core][whinlatter][PATCH] harfbuzz: Fix CVE-2026-22693

[OE-core][whinlatter][PATCH] harfbuzz: Fix CVE-2026-22693

[hsimeliere.opensource]

From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>

Upstream-Status: Backport from https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae

Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
---
 .../harfbuzz/files/CVE-2026-22693.patch       | 33 +++++++++++++++++++
 .../harfbuzz/harfbuzz_11.4.5.bb               |  4 ++-
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch

diff --git a/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch
new file mode 100644
index 0000000000..bf821bb63a
--- /dev/null
+++ b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch
@@ -0,0 +1,33 @@
+From 21c880d1154a5bcef2ef68c1687d286820a274ee Mon Sep 17 00:00:00 2001
+From: Behdad Esfahbod <behdad@behdad.org>
+Date: Fri, 9 Jan 2026 04:54:42 -0700
+Subject: [PATCH] [cmap] malloc fail test (#5710)
+
+Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+
+Upstream-Status: Backport [https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae]
+CVE: CVE-2026-22693
+
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+---
+ src/hb-ot-cmap-table.hh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
+index 294b2b60d..95a436b54 100644
+--- a/src/hb-ot-cmap-table.hh
++++ b/src/hb-ot-cmap-table.hh
+@@ -1679,6 +1679,10 @@ struct SubtableUnicodesCache {
+   {
+     SubtableUnicodesCache* cache =
+         (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache));
++
++    if (unlikely (!cache))
++      return nullptr;
++
+     new (cache) SubtableUnicodesCache (source_table);
+     return cache;
+   }
+-- 
+2.43.0
+
diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
index 9e0e42b717..2364dd7efd 100644
--- a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
+++ b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
@@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \
                     file://src/hb-ucd.cc;beginline=1;endline=15;md5=29d4dcb6410429195df67efe3382d8bc \
                     "
 
-SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz"
+SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz \
+           file://CVE-2026-22693.patch \
+           "
 SRC_URI[sha256sum] = "0f052eb4ab01d8bae98ba971c954becb32be57d7250f18af343b1d27892e03fa"
 
 DEPENDS += "glib-2.0-native"
-- 
2.43.0

Re: [OE-core][whinlatter][PATCH] harfbuzz: Fix CVE-2026-22693

[Yoann Congal]

On Fri Feb 20, 2026 at 3:34 PM CET, Hugo Simeliere via lists.openembedded.org wrote:
> From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
>
> Upstream-Status: Backport from https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae

Hello,

Same remarks as your recent zlib CVE patch.

Thanks!

>
> Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
> ---
>  .../harfbuzz/files/CVE-2026-22693.patch       | 33 +++++++++++++++++++
>  .../harfbuzz/harfbuzz_11.4.5.bb               |  4 ++-
>  2 files changed, 36 insertions(+), 1 deletion(-)
>  create mode 100644 meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch
>
> diff --git a/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch
> new file mode 100644
> index 0000000000..bf821bb63a
> --- /dev/null
> +++ b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch
> @@ -0,0 +1,33 @@
> +From 21c880d1154a5bcef2ef68c1687d286820a274ee Mon Sep 17 00:00:00 2001
> +From: Behdad Esfahbod <behdad@behdad.org>
> +Date: Fri, 9 Jan 2026 04:54:42 -0700
> +Subject: [PATCH] [cmap] malloc fail test (#5710)
> +
> +Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
> +
> +Upstream-Status: Backport [https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae]
> +CVE: CVE-2026-22693
> +
> +Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
> +---
> + src/hb-ot-cmap-table.hh | 4 ++++
> + 1 file changed, 4 insertions(+)
> +
> +diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
> +index 294b2b60d..95a436b54 100644
> +--- a/src/hb-ot-cmap-table.hh
> ++++ b/src/hb-ot-cmap-table.hh
> +@@ -1679,6 +1679,10 @@ struct SubtableUnicodesCache {
> +   {
> +     SubtableUnicodesCache* cache =
> +         (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache));
> ++
> ++    if (unlikely (!cache))
> ++      return nullptr;
> ++
> +     new (cache) SubtableUnicodesCache (source_table);
> +     return cache;
> +   }
> +-- 
> +2.43.0
> +
> diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
> index 9e0e42b717..2364dd7efd 100644
> --- a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
> +++ b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb
> @@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \
>                      file://src/hb-ucd.cc;beginline=1;endline=15;md5=29d4dcb6410429195df67efe3382d8bc \
>                      "
>  
> -SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz"
> +SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz \
> +           file://CVE-2026-22693.patch \
> +           "
>  SRC_URI[sha256sum] = "0f052eb4ab01d8bae98ba971c954becb32be57d7250f18af343b1d27892e03fa"
>  
>  DEPENDS += "glib-2.0-native"


-- 
Yoann Congal
Smile ECS