[rpms/nanosvg] f44: fix CVE-2026-88367

[Tom spot Callaway <spotaws@amazon.com>]

A new commit has been pushed.

Repo   : rpms/nanosvg
Branch : f44
Commit : 3428777f67f6cde3d0bf7c3aaa53497342a9c783
Author : Tom spot Callaway <spotaws@amazon.com>
Date   : 2026-09-25T15:27:25-04:00
Stats  : +125/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/nanosvg/c/3428777f67f6cde3d0bf7c3aaa53497342a9c783?branch=f44

Log:
fix CVE-2026-88367

---
diff --git a/nanosvg-CVE-2026-88367.patch b/nanosvg-CVE-2026-88367.patch
new file mode 100644
index 0000000..067614c
--- /dev/null
+++ b/nanosvg-CVE-2026-88367.patch
@@ -0,0 +1,117 @@
+diff -up nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvg.h.fix nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvg.h
+--- nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvg.h.fix	2026-09-25 14:54:07.253112457 -0400
++++ nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvg.h	2026-09-25 14:55:41.117809697 -0400
+@@ -2166,11 +2166,13 @@ static void nsvg__pathArcTo(NSVGparser*
+ 		x2 = args[5];
+ 		y2 = args[6];
+ 	}
++	if (!isfinite(x2) || !isfinite(y2)) return;
+ 
+ 	dx = x1 - x2;
+ 	dy = y1 - y2;
+ 	d = sqrtf(dx*dx + dy*dy);
+-	if (d < 1e-6f || rx < 1e-6f || ry < 1e-6f) {
++	if (d < 1e-6f || rx < 1e-6f || ry < 1e-6f ||
++		!isfinite(d) || !isfinite(rx) || !isfinite(ry) || !isfinite(rotx)) {
+ 		// The arc degenerates to a line
+ 		nsvg__lineTo(p, x2, y2);
+ 		*cpx = x2;
+@@ -2224,6 +2226,14 @@ static void nsvg__pathArcTo(NSVGparser*
+ 	else if (fs == 1 && da < 0)
+ 		da += 2 * NSVG_PI;
+ 
++	// Invalid intermediate geometry must not reach the subdivision cast.
++	if (!isfinite(da) || !isfinite(a1) || !isfinite(cx) || !isfinite(cy)) {
++		nsvg__lineTo(p, x2, y2);
++		*cpx = x2;
++		*cpy = y2;
++		return;
++	}
++
+ 	// Approximate the arc using cubic spline segments.
+ 	t[0] = cosrx; t[1] = sinrx;
+ 	t[2] = -sinrx; t[3] = cosrx;
+diff -up nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvgrast.h.fix nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvgrast.h
+--- nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvgrast.h.fix	2026-09-25 14:55:49.435969851 -0400
++++ nanosvg-abcd277ea45e9098bed752cf9c6875b533c0892f/src/nanosvgrast.h	2026-09-25 15:00:36.400802785 -0400
+@@ -94,6 +94,7 @@ void nsvgDeleteRasterizer(NSVGrasterizer
+ #include <math.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <limits.h>
+ 
+ #define NSVG__SUBSAMPLES	5
+ #define NSVG__FIXSHIFT		10
+@@ -346,6 +347,24 @@ static float nsvg__normalize(float *x, f
+ }
+ 
+ static float nsvg__absf(float x) { return x < 0 ? -x : x; }
++static float nsvg__roundf(float x) { return (x >= 0) ? floorf(x + 0.5) : ceilf(x - 0.5); }
++
++static int nsvg__roundf_clamp(float x)
++{
++	float rounded;
++	if (!isfinite(x)) return x > 0 ? INT_MAX : (x < 0 ? INT_MIN : 0);
++	rounded = nsvg__roundf(x);
++	if ((double)rounded >= (double)INT_MAX) return INT_MAX;
++	if ((double)rounded <= (double)INT_MIN) return INT_MIN;
++	return (int)rounded;
++}
++
++static int nsvg__iadd_sat(int a, int b)
++{
++	if (b > 0 && a > INT_MAX - b) return INT_MAX;
++	if (b < 0 && a < INT_MIN - b) return INT_MIN;
++	return a + b;
++}
+ 
+ static void nsvg__flattenCubicBez(NSVGrasterizer* r,
+ 								  float x1, float y1, float x2, float y2,
+@@ -573,7 +592,7 @@ static void nsvg__roundJoin(NSVGrasteriz
+ 	if (da < NSVG_PI) da += NSVG_PI*2;
+ 	if (da > NSVG_PI) da -= NSVG_PI*2;
+ 
+-	n = (int)ceilf((nsvg__absf(da) / NSVG_PI) * (float)ncap);
++	n = nsvg__roundf_clamp(ceilf((nsvg__absf(da) / NSVG_PI) * (float)ncap));
+ 	if (n < 2) n = 2;
+ 	if (n > ncap) n = ncap;
+ 
+@@ -616,9 +635,12 @@ static void nsvg__straightJoin(NSVGraste
+ static int nsvg__curveDivs(float r, float arc, float tol)
+ {
+ 	float da = acosf(r / (r + tol)) * 2.0f;
+-	int divs = (int)ceilf(arc / da);
+-	if (divs < 2) divs = 2;
+-	return divs;
++	float divs;
++	// Huge radii can round the ratio to one; use the minimum subdivision.
++	if (!(da > 0.0f)) return 2;
++	divs = ceilf(arc / da);
++	if (!isfinite(divs) || (double)divs >= (double)INT_MAX) return 2;
++	return divs < 2 ? 2 : (int)divs;
+ }
+ 
+ static void nsvg__expandStroke(NSVGrasterizer* r, NSVGpoint* points, int npoints, int closed, int lineJoin, int lineCap, float lineWidth)
+@@ -887,11 +909,8 @@ static NSVGactiveEdge* nsvg__addActive(N
+ 	float dxdy = (e->x1 - e->x0) / (e->y1 - e->y0);
+ //	STBTT_assert(e->y0 <= start_point);
+ 	// round dx down to avoid going too far
+-	if (dxdy < 0)
+-		z->dx = (int)(-floorf(NSVG__FIX * -dxdy));
+-	else
+-		z->dx = (int)floorf(NSVG__FIX * dxdy);
+-	z->x = (int)floorf(NSVG__FIX * (e->x0 + dxdy * (startPoint - e->y0)));
++	z->dx = nsvg__roundf_clamp(NSVG__FIX * dxdy);
++	z->x = nsvg__roundf_clamp(NSVG__FIX * (e->x0 + dxdy * (startPoint - e->y0)));
+ //	z->x -= off_x * FIX;
+ 	z->ey = e->y1;
+ 	z->next = 0;
+@@ -1156,7 +1175,7 @@ static void nsvg__rasterizeSortedEdges(N
+ //					NSVG__assert(z->valid);
+ 					nsvg__freeActive(r, z);
+ 				} else {
+-					z->x += z->dx; // advance to position for current scanline
++					z->x = nsvg__iadd_sat(z->x, z->dx); // advance to position for current scanline
+ 					step = &((*step)->next); // advance through list
+ 				}
+ 			}

diff --git a/nanosvg.spec b/nanosvg.spec
index d7a362c..f1b7315 100644
--- a/nanosvg.spec
+++ b/nanosvg.spec
@@ -3,7 +3,7 @@
 Name:		nanosvg
 # This thing has no version so we'll use the last commit date
 Version:	20221221
-Release:	10%{?dist}
+Release:	11%{?dist}
 License:	Zlib
 # Technically, this is a fork, but the upstream is unmaintained and this one has some fixes
 URL:		https://github.com/fltk/nanosvg
@@ -18,6 +18,9 @@ Patch1:		nanosvg-lib64.patch
 # https://github.com/memononen/nanosvg/pull/216
 # Modified slightly to work without an installed nanosvg instance
 Patch2:		nanosvg-build-examples.patch
+# https://github.com/jantzeno/nanosvg_slop/commit/a39afb47ff72f4a10f0df9ba34f4508ccf551f73
+# Fixes CVE-2026-88367
+Patch3:		nanosvg-CVE-2026-88367.patch
 Summary:	Simple stupid SVG parser
 BuildRequires:	cmake, gcc
 # Needed for example1
@@ -41,6 +44,7 @@ Development files for nanosvg.
 %patch -P0 -p1 -b .sover
 %patch -P1 -p1 -b .lib64
 %patch -P2 -p1 -b .build-examples
+%patch -P3 -p1 -b .CVE-2026-88367
 
 %build
 %cmake
@@ -69,6 +73,9 @@ popd
 %{_libdir}/libnanosvgrast.so
 
 %changelog
+* Fri Sep 25 2026 Tom Callaway <spot@fedoraproject.org> - 20221221-11
+- apply fix for CVE-2026-88367 (thanks to @jantzeno and @1820893135-pixel on GitHub)
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 20221221-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild