Rebase #224 on top of current main + build tests with CMake

.github/fetch_sdl_vc.ps1

@@ -0,0 +1,40 @@
+$ErrorActionPreference = "Stop"
+
+$project_root = "$psScriptRoot\.."
+Write-Output "project_root: $project_root"
+
+$sdl2_version = "2.0.10"
+$sdl2_zip = "SDL2-devel-$($sdl2_version)-VC.zip"
+
+$sdl2_url = "https://github.com/libsdl-org/SDL/releases/download/release-$($sdl2_version)/SDL2-devel-$($sdl2_version)-VC.zip"
+$sdl2_dlpath = "$($Env:TEMP)\$sdl2_zip"
+
+$sdl2_bindir = "$($project_root)"
+$sdl2_extractdir = "$($sdl2_bindir)\SDL2-$($sdl2_version)"
+$sdl2_root_name = "SDL2-devel-VC"
+
+echo "sdl2_bindir:     $sdl2_bindir"
+echo "sdl2_extractdir: $sdl2_extractdir"
+echo "sdl2_root_name:  $sdl2_root_name"
+
+echo "Cleaning previous artifacts"
+if (Test-Path $sdl2_extractdir) {
+    Remove-Item $sdl2_extractdir -Recurse -Force
+}
+if (Test-Path "$($sdl2_bindir)/$sdl2_root_name") {
+    Remove-Item "$($sdl2_bindir)/$sdl2_root_name" -Recurse -Force
+}
+if (Test-Path $sdl2_dlpath) {
+    Remove-Item $sdl2_dlpath -Force
+}
+
+Write-Output "Downloading $sdl2_url"
+Invoke-WebRequest -Uri $sdl2_url -OutFile $sdl2_dlpath
+
+Write-Output "Extracting archive"
+Expand-Archive $sdl2_dlpath -DestinationPath $sdl2_bindir
+
+Write-Output "Setting up SDL2 folder"
+Rename-Item $sdl2_extractdir $sdl2_root_name
+
+Write-Output "Done"

.github/workflows/main.yml

@@ -15,10 +15,15 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-        - { name: Windows (mingw32),      os: windows-latest, shell: 'msys2 {0}', msystem: mingw32, msys-env: mingw-w64-i686 }
-        - { name: Windows (mingw64),      os: windows-latest, shell: 'msys2 {0}', msystem: mingw64, msys-env: mingw-w64-x86_64 }
-        - { name: Linux (CMake),          os: ubuntu-20.04,   shell: sh,   cmake: '-GNinja' }
-        - { name: Linux (autotools),      os: ubuntu-20.04,   shell: sh }
+        - { name: Windows (MSVC+CMake),         os: windows-latest, shell: sh,   cmake: '-DSDL2TTF_VENDORED=ON -GNinja', msvc: 1, shared: 1, static: 0 }
+        - { name: Windows (mingw32+autotools),  os: windows-latest, shell: 'msys2 {0}', msystem: mingw32, msys-env: mingw-w64-i686, shared: 1, static: 1 }
+        - { name: Windows (mingw64+CMake),      os: windows-latest, shell: 'msys2 {0}', msystem: mingw64, msys-env: mingw-w64-x86_64, shared: 1, static: 0,
+            cmake: '-DSDL2TTF_VENDORED=OFF -G "Ninja Multi-Config"' }
+        - { name: Linux (autotools),            os: ubuntu-20.04,   shell: sh,   shared: 1, static: 1 }
+        - { name: Linux (CMake),                os: ubuntu-20.04,   shell: sh,   cmake: '-DSDL2TTF_VENDORED=ON -GNinja', shared: 1, static: 0 }
+        - { name: 'Linux (CMake, static)',      os: ubuntu-20.04,   shell: sh,   cmake: '-GNinja -DBUILD_SHARED_LIBS=OFF', shared: 0, static: 1 }
+        - { name: Macos (autotools),            os: macos-latest,   shell: sh,   shared: 1, static: 1}
+        - { name: Macos (CMake),                os: macos-latest,   shell: sh,   cmake: '-DSDL2TTF_VENDORED=ON -GNinja', shared: 1, static: 0 }
 
     steps:
     - name: Set up MSYS2
@@ -36,7 +41,19 @@ jobs:
           ${{ matrix.platform.msys-env }}-ninja
           ${{ matrix.platform.msys-env }}-pkg-config
           ${{ matrix.platform.msys-env }}-zlib
-
+    - name: Setup Macos dependencies
+      if: runner.os == 'macOS'
+      run: |
+          brew install \
+            autoconf \
+            automake \
+            freetype \
+            harfbuzz \
+            libtool \
+            ninja \
+            pkg-config \
+            sdl2 \
+            ${NULL+}
     - name: Setup Linux dependencies
       if: runner.os == 'Linux'
       run: |
@@ -57,66 +74,114 @@ jobs:
     - uses: actions/checkout@v2
       with:
         submodules: recursive
+
+    - name: Setup MSVC dependencies
+      if: "matrix.platform.msvc"
+      shell: pwsh
+      run: |
+        .github/fetch_sdl_vc.ps1
+        echo "SDL2_DIR=$Env:GITHUB_WORKSPACE/SDL2-devel-VC" >> $Env:GITHUB_ENV
+    - name: Setup Ninja for MSVC
+      if: "matrix.platform.msvc"
+      uses: ashutoshvarma/setup-ninja@master
+      with:
+        version: 1.10.2
+    - uses: ilammy/msvc-dev-cmd@v1
+      if: "matrix.platform.msvc"
+      with:
+        arch: x64
+
     - name: Check that versioning is consistent
       # We only need to run this once: arbitrarily use the Linux/CMake build
       if: "runner.os == 'Linux' && matrix.platform.cmake"
       run: ./test-versioning.sh
 
-    - name: Configure CMake
+    - name: Configure (CMake)
       if: "matrix.platform.cmake"
       run: |
-        cmake -B build \
-          -DTTF_WITH_HARFBUZZ=ON \
-          -DBUILD_SAMPLES=ON \
+        set -- \
           -DBUILD_SHARED_LIBS=ON \
+          -DSDL2TTF_HARFBUZZ=ON \
+          -DSDL2TTF_SAMPLES=ON \
           -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
           -DCMAKE_BUILD_TYPE=Release \
+          -DCMAKE_INSTALL_PREFIX=prefix_cmake \
+          ${NULL+}
+
+        if [ "${{ matrix.platform.msystem }}" = "" ]; then
+          # mingw-w64-*-SDL2 doesn't have SDL_test, and the macOS CMake
+          # build can't find it (see #260), so we only enable build-time
+          # tests for Linux at the moment.
+          set -- "$@" -DSDL2TTF_TESTS=ON
+        fi
+
+        cmake -B build-cmake \
+          "$@" \
           ${{ matrix.platform.cmake }}
-    - name: Build
+    - name: Build (CMake)
+      if: "matrix.platform.cmake"
+      run: |
+        cmake --build build-cmake --config Release --verbose
+    - name: Install (CMake)
       if: "matrix.platform.cmake"
-      run: cmake --build build/ --config Release --verbose
-    - name: Install
-      if: "matrix.platform.shell == 'sh' && matrix.platform.cmake"
       run: |
         set -eu
-        rm -fr DESTDIR-cmake
-        DESTDIR=$(pwd)/DESTDIR-cmake cmake --install build/ --config Release --verbose
-        ( cd DESTDIR-cmake; find ) | LC_ALL=C sort -u
+        rm -rf prefix_cmake
+        cmake --install build-cmake/ --config Release --verbose
+        echo "SDL2_ttf_DIR=$(pwd)/prefix_cmake" >> $GITHUB_ENV
+        ( cd prefix_cmake; find . ) | LC_ALL=C sort -u
+    - name: Test using showfont (CMake)
+      if: "runner.os == 'Linux' && matrix.platform.cmake"
+      run: |
+          # Just check that it doesn't crash, we can't really test the results...
+          env -C build-cmake/ SDL_VIDEODRIVER=dummy ./showfont -dump /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
+          # ... but we can at least assert that it outputs a .bmp
+          file build-cmake/glyph-100.bmp
 
-    - name: Configure Autotools
+    - name: Configure (Autotools)
       if: "! matrix.platform.cmake"
       run: |
         set -eu
         rm -fr build-autotools
         mkdir build-autotools
         ./autogen.sh
-        ( cd build-autotools && ../configure )
-    - name: Build with Autotools
+        set -- --prefix=$(pwd)/prefix_autotools
+        ( cd build-autotools && ../configure "$@" )
+    - name: Build (Autotools)
       if: "! matrix.platform.cmake"
       run: |
         set -eu
         parallel="$(getconf _NPROCESSORS_ONLN)"
         make -j"${parallel}" -C build-autotools V=1
-    - name: Test using showfont
+    - name: Test (showfont)
       if: "runner.os == 'Linux' && ! matrix.platform.cmake"
       run: |
         # Just check that it doesn't crash, we can't really test the results...
         env -C build-autotools SDL_VIDEODRIVER=dummy ./showfont -dump /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
         # ... but we can at least assert that it outputs a .bmp
         file build-autotools/glyph-100.bmp
-    - name: Install with Autotools
+    - name: Install (Autotools)
       if: "! matrix.platform.cmake"
       run: |
         set -eu
         curdir="$(pwd)"
         parallel="$(getconf _NPROCESSORS_ONLN)"
-        rm -fr DESTDIR-autotools
-        mkdir DESTDIR-autotools
-        make -j"${parallel}" -C build-autotools install DESTDIR="${curdir}/DESTDIR-autotools" V=1
-        ( cd DESTDIR-autotools; find ) | LC_ALL=C sort -u
-    - name: Distcheck with Autotools
+        rm -rf prefix_autotools
+        make -j"${parallel}" -C build-autotools install V=1
+        echo "SDL2_ttf_DIR=$(pwd)/prefix_autotools" >> $GITHUB_ENV
+        ( cd prefix_autotools; find . ) | LC_ALL=C sort -u
+    - name: Distcheck (Autotools)
       if: "runner.os == 'Linux' && ! matrix.platform.cmake"
       run: |
         set -eu
         parallel="$(getconf _NPROCESSORS_ONLN)"
         make -j"${parallel}" -C build-autotools distcheck V=1
+
+    - name: Verify CMake configuration files
+      run: |
+          cmake -S cmake/test -B cmake_config_build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_PREFIX_PATH="${{ env.SDL2_ttf_DIR }};${{ env.SDL2_DIR }}" \
+            -DTEST_SHARED=${{ matrix.platform.shared }} \
+            -DTEST_STATIC=${{ matrix.platform.static }}
+          cmake --build cmake_config_build --verbose --config Release

CHANGES.txt

@@ -12,6 +12,7 @@
  * Added TTF_SetFontDirection() and TTF_SetFontScriptName() for additional control over fonts using HarfBuzz
  * Updated to FreeType version 2.12.1 and HarfBuzz version 2.9.1, fixing CVE-2018-25032
  * Fixed crash when loading fonts at certain sizes on Windows
+ * Fix memory corruption loading malformed TTF files (CVE-2022-27470)
 
 2.0.18:
 Ozkan Sezer - Wed Jan  5 14:15:46 PST 2022