1458905 - Update freetype2 to 2.9.1

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Tom Ritter [:tjr] (ni? for response to CVE/sec-approval/advisories/etc)]

This is a (semi-)automated bug making you aware that there is an available upgrade for an embedded third-party library. You can leave this bug open, and it will be updated if a newer version of the library becomes available. If you close it as WONTFIX, please indicate if you do not wish to receive any future bugs upon new releases of the library.

freetype2 is currently at version 2.9 in mozilla-central, and the latest version of the library released is 2.9.1. 

I fetched the latest version of the library from http://download.savannah.gnu.org/releases/freetype/.



It looks like this may be a security release, so tagging as such.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

We pretty aggressively backported the upstream security fixes to 60/61 as they landed:
https://hg.mozilla.org/mozilla-central/file/default/modules/freetype2/README.moz-patches

Tom, are you aware of any other scary-looking upstream commits that would justify taking this urgently? Otherwise, I'd prefer to wait until next week after we're clear of the Nightly soft freeze.

Comment 2

[Tom Ritter [:tjr] (ni? for response to CVE/sec-approval/advisories/etc)]

Nope, sounds good.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Thanks, I'll take this next week. And also, since we don't ship Android builds off ESR60, I think we can wontfix this bug for there (since it's the release we ship which uses the in-tree FT2).

Comment 4

[Ryan VanderMeulen [:RyanVM]]

First attempt has bustage:
https://treeherder.mozilla.org/logviewer.html#?job_id=177267288&repo=try&lineNumber=29189

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Attachment: update freetype to version 2.9.1

Easy fix. Just needed to remove two files from moz.build which were added to ftbase.c as #includes instead.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4fd11122127493b1778846af5f99384235181436

Comment 6

[Jonathan Kew (:jfkthame)]

Comment on attachment 8973734 [details] [diff] [review]
update freetype to version 2.9.1

Review of attachment 8973734 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM -- after reading the entire patch line-by-line, obviously. ;)

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/796bf4be1f82

Comment 8

[Jonathan Kew (:jfkthame)]

Comment on attachment 8973734 [details] [diff] [review]
update freetype to version 2.9.1

Approval Request Comment
[Feature/Bug causing the regression]: no regression, updating library from upstream
[User impact if declined]: possible vulnerabilities in freetype
[Is this code covered by automated tests?]: yes, exercised by anything that draws text on android
[Has the fix been verified in Nightly?]: not yet
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: update to latest upstream release of a widely-used library
[String changes made/needed]: none

Comment 9

[Sebastian Hengst [:aryx] (needinfo on intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/796bf4be1f82

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8973734 [details] [diff] [review]
update freetype to version 2.9.1

Approved for 61.0b4.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/2e8113527d2c