CVS commit: pkgsrc/converters/fribidi

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Nov  1 21:12:54 UTC 2026

Modified Files:
        pkgsrc/converters/fribidi: Makefile distinfo

Log Message:
fribidi: update to 1.0.18.

Overview of changes between 1.0.17 and 1.0.18
=============================================

* Security and robustness fixes found by an automated scan (Anthropic's
  OSS Scanner):
  - fribidi_remove_bidi_marks(): fixed an out-of-bounds write before the
    caller's map when the position maps returned by one call are passed to
    a second call. The maps it returns are now correct, and removed
    characters are -1.
  - Fixed unchecked memory allocations in fribidi_reorder_line(),
    fribidi_log2vis() and the bracket pairing code, which could crash
    when memory ran out instead of returning failure.
  - Fixed an out-of-bounds read in the CapRTL decoder on platforms where
    plain char is unsigned (e.g. aarch64, arm, ppc64le, s390x).
  - Fixed quadratic running time on paragraphs made of many back-to-back
    isolates, and on deeply nested isolates containing brackets (N0).
* Fixed a stack buffer overflow in the CapRTL/UTF-8 output of fribidi and
  fribidi-caprtl2utf8, and an integer overflow in the run-pool allocation
  on 32-bit platforms.
* Fixed paragraph direction detection to reset isolates at paragraph
  boundaries.
* Bidi fixes to match UAX #9 more closely. These can change the output for
  unusual input:
  - Overflow isolates are no longer treated as valid isolates (X5a-X5c),
    and PDF handling checks the overflow counts first (X7).
  - Bracket pairs (BD16/N0) no longer pair across isolates, and a full
    bracket stack no longer stops pairing outside its isolating run
    sequence.
* fribidi_unicode_to_charset() now null-terminates the output for an
  unknown character set.
* Added regression tests and a fuzzing seed.


To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 pkgsrc/converters/fribidi/Makefile
cvs rdiff -u -r1.25 -r1.26 pkgsrc/converters/fribidi/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/converters/fribidi/Makefile
diff -u pkgsrc/converters/fribidi/Makefile:1.39 pkgsrc/converters/fribidi/Makefile:1.40
--- pkgsrc/converters/fribidi/Makefile:1.39     Tue Sep 22 10:51:08 2026
+++ pkgsrc/converters/fribidi/Makefile  Sun Nov  1 21:12:53 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.39 2026/09/22 10:51:08 ryoon Exp $
+# $NetBSD: Makefile,v 1.40 2026/11/01 21:12:53 wiz Exp $
 
-DISTNAME=      fribidi-1.0.17
+DISTNAME=      fribidi-1.0.18
 CATEGORIES=    converters
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=fribidi/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}

Index: pkgsrc/converters/fribidi/distinfo
diff -u pkgsrc/converters/fribidi/distinfo:1.25 pkgsrc/converters/fribidi/distinfo:1.26
--- pkgsrc/converters/fribidi/distinfo:1.25     Tue Sep 22 07:42:17 2026
+++ pkgsrc/converters/fribidi/distinfo  Sun Nov  1 21:12:53 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.25 2026/09/22 07:42:17 ryoon Exp $
+$NetBSD: distinfo,v 1.26 2026/11/01 21:12:53 wiz Exp $
 
-BLAKE2s (fribidi-1.0.17.tar.xz) = d79d29dfbede580544a87624901e7c0b17782b77df02c0db60b98568099663c6
-SHA512 (fribidi-1.0.17.tar.xz) = 70df8b9b2b8e552e969122227192b04c45e3fa2d133ed3642ba1cf8a8c5855cfeace4e0b009cdb9f58431dfc63fbf7878419594d4d7be095ee4d154d3b7570cc
-Size (fribidi-1.0.17.tar.xz) = 1203284 bytes
+BLAKE2s (fribidi-1.0.18.tar.xz) = e568404f0f5aefa38ea8b9b5eb9650d77fdb2a943e5cf11eff2eb683a538a990
+SHA512 (fribidi-1.0.18.tar.xz) = c7bf95e6695652ee935afc3067cb7667e77859bb6d27e7fc2b5294e1bc17d1a0c2ed5f7eef709999f7e51ec4475934f0a4abefde79bc3db577ca2f4361c92a1c
+Size (fribidi-1.0.18.tar.xz) = 1222656 bytes