Closed Bug 1458905 Opened Last year Closed Last year
Update freetype2 to 2
This is a (semi-)automated bug making you aware that there is an available upgrade for an embedded third-party library. You can leave this bug open, and it will be updated if a newer version of the library becomes available. If you close it as WONTFIX, please indicate if you do not wish to receive any future bugs upon new releases of the library. freetype2 is currently at version 2.9 in mozilla-central, and the latest version of the library released is 2.9.1. I fetched the latest version of the library from http://download.savannah.gnu.org/releases/freetype/. It looks like this may be a security release, so tagging as such.
We pretty aggressively backported the upstream security fixes to 60/61 as they landed: https://hg.mozilla.org/mozilla-central/file/default/modules/freetype2/README.moz-patches Tom, are you aware of any other scary-looking upstream commits that would justify taking this urgently? Otherwise, I'd prefer to wait until next week after we're clear of the Nightly soft freeze.
Nope, sounds good.
Thanks, I'll take this next week. And also, since we don't ship Android builds off ESR60, I think we can wontfix this bug for there (since it's the release we ship which uses the in-tree FT2).
First attempt has bustage: https://treeherder.mozilla.org/logviewer.html#?job_id=177267288&repo=try&lineNumber=29189
Easy fix. Just needed to remove two files from moz.build which were added to ftbase.c as #includes instead. https://treeherder.mozilla.org/#/jobs?repo=try&revision=4fd11122127493b1778846af5f99384235181436
Attachment #8973734 - Flags: review?(jfkthame)
Comment on attachment 8973734 [details] [diff] [review] update freetype to version 2.9.1 Review of attachment 8973734 [details] [diff] [review]: ----------------------------------------------------------------- LGTM -- after reading the entire patch line-by-line, obviously. ;)
Attachment #8973734 - Flags: review?(jfkthame) → review+
Comment on attachment 8973734 [details] [diff] [review] update freetype to version 2.9.1 Approval Request Comment [Feature/Bug causing the regression]: no regression, updating library from upstream [User impact if declined]: possible vulnerabilities in freetype [Is this code covered by automated tests?]: yes, exercised by anything that draws text on android [Has the fix been verified in Nightly?]: not yet [Needs manual test from QE? If yes, steps to reproduce]: no [List of other uplifts needed for the feature/fix]: none [Is the change risky?]: no [Why is the change risky/not risky?]: update to latest upstream release of a widely-used library [String changes made/needed]: none
Attachment #8973734 - Flags: approval-mozilla-beta?
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Comment on attachment 8973734 [details] [diff] [review] update freetype to version 2.9.1 Approved for 61.0b4.
Attachment #8973734 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.