mirror of
https://git.yoctoproject.org/poky
synced 2026-10-21 06:48:18 +00:00
cups: fix CVE-2026-34980
Pick the upstream fix [1] for CVE-2026-34980 as mentioned in [2], where the scheduler did not filter control characters from option values. Also include the upstream regression fixes that followed the CVE fix: - CVE-2026-34980-regression_p1.patch [3] fixes filter PPD keyword processing. The CVE fix parsed PPD keywords into a temporary array, but the loop did not advance the keyword pointer. This regression was reported in OpenPrinting/cups Issue [4]. - CVE-2026-34980-regression_p2.patch [5] fixes a get_options() regression where the option-value parser did not advance the input pointer for whitespace/control-character paths. [1] https://github.com/OpenPrinting/cups/commit/8d0f51cac24cb5bf949c5b6a221e51a150d982e3 [2] https://security-tracker.debian.org/tracker/CVE-2026-34980 [3] https://github.com/OpenPrinting/cups/commit/3f2bdc293243bca938c6de23ba50e6d783189629 [4] https://github.com/OpenPrinting/cups/issues/1562 [5] https://github.com/OpenPrinting/cups/commit/da0ff58c041f7ee129c3c2c72fb14df1f1e4069a (From OE-Core rev: a64f1bfff50bb9e507705ff671391ec2cafdc692) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore authored and 
Paul Barker committed
1 parent
9184e90773
commit
335776489f
4 files changed
+194
No files matched your search
@@ -25,6 +25,9 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
|
||||
file://CVE-2026-27447-regression_p2.patch \
|
||||
file://CVE-2026-41079.patch \
|
||||
file://CVE-2026-34978.patch \
|
||||
file://CVE-2026-34980.patch \
|
||||
file://CVE-2026-34980-regression_p1.patch \
|
||||
file://CVE-2026-34980-regression_p2.patch \
|
||||
"
|
||||
|
||||
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
From 3f2bdc293243bca938c6de23ba50e6d783189629 Mon Sep 17 00:00:00 2001
|
||||
From: Michael R Sweet <msweet@msweet.org>
|
||||
Date: Tue, 28 Apr 2026 17:42:41 -0400
|
||||
Subject: [PATCH] Fix filter PPD keyword processing (Issue #1562)
|
||||
|
||||
CVE: CVE-2026-34980
|
||||
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/3f2bdc293243bca938c6de23ba50e6d783189629]
|
||||
|
||||
(cherry picked from commit 3f2bdc293243bca938c6de23ba50e6d783189629)
|
||||
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
|
||||
---
|
||||
scheduler/job.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/scheduler/job.c b/scheduler/job.c
|
||||
index 895b2d9..915ba94 100644
|
||||
--- a/scheduler/job.c
|
||||
+++ b/scheduler/job.c
|
||||
@@ -5419,7 +5419,7 @@ update_job(cupsd_job_t *job) /* I - Job to check */
|
||||
keywords = NULL;
|
||||
num_keywords = cupsParseOptions(message, 0, &keywords);
|
||||
|
||||
- for (i = 0, keyword = keywords; i < num_keywords; i ++)
|
||||
+ for (i = 0, keyword = keywords; i < num_keywords; i ++, keyword ++)
|
||||
{
|
||||
/*
|
||||
* Filter out "special" PPD keywords...
|
||||
--
|
||||
2.43.7
|
||||
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
From da0ff58c041f7ee129c3c2c72fb14df1f1e4069a Mon Sep 17 00:00:00 2001
|
||||
From: Michael R Sweet <msweet@msweet.org>
|
||||
Date: Wed, 8 Apr 2026 16:42:48 -0400
|
||||
Subject: [PATCH] Fix get_options regression (Issue #1532)
|
||||
|
||||
CVE: CVE-2026-34980
|
||||
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/da0ff58c041f7ee129c3c2c72fb14df1f1e4069a]
|
||||
|
||||
(cherry picked from commit da0ff58c041f7ee129c3c2c72fb14df1f1e4069a)
|
||||
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
|
||||
---
|
||||
scheduler/job.c | 4 ++--
|
||||
test/5.5-lp.sh | 10 +++++-----
|
||||
2 files changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/scheduler/job.c b/scheduler/job.c
|
||||
index 6b9d366..cf019e1 100644
|
||||
--- a/scheduler/job.c
|
||||
+++ b/scheduler/job.c
|
||||
@@ -4144,7 +4144,7 @@ get_options(cupsd_job_t *job, /* I - Job */
|
||||
case IPP_TAG_CHARSET :
|
||||
case IPP_TAG_LANGUAGE :
|
||||
case IPP_TAG_URI :
|
||||
- for (valptr = attr->values[i].string.text; *valptr;)
|
||||
+ for (valptr = attr->values[i].string.text; *valptr; valptr ++)
|
||||
{
|
||||
/*
|
||||
* Convert tabs and newlines to spaces, filter out control chars,
|
||||
@@ -4159,7 +4159,7 @@ get_options(cupsd_job_t *job, /* I - Job */
|
||||
{
|
||||
if (strchr("\\\'\"", *valptr))
|
||||
*optptr++ = '\\';
|
||||
- *optptr++ = *valptr++;
|
||||
+ *optptr++ = *valptr;
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/test/5.5-lp.sh b/test/5.5-lp.sh
|
||||
index 25e9d65..fe60890 100644
|
||||
--- a/test/5.5-lp.sh
|
||||
+++ b/test/5.5-lp.sh
|
||||
@@ -2,7 +2,7 @@
|
||||
#
|
||||
# Test the lp command.
|
||||
#
|
||||
-# Copyright © 2020-2024 by OpenPrinting.
|
||||
+# Copyright © 2020-2026 by OpenPrinting.
|
||||
# Copyright © 2007-2019 by Apple Inc.
|
||||
# Copyright © 1997-2005 by Easy Software Products, all rights reserved.
|
||||
#
|
||||
@@ -72,8 +72,8 @@ echo ""
|
||||
|
||||
echo "LP Flood Test ($1 times in parallel)"
|
||||
echo ""
|
||||
-echo " lp -d Test1 testfile.jpg"
|
||||
-echo " lp -d Test2 testfile.jpg"
|
||||
+echo " lp -d Test1 -t 'Flood Test N' testfile.jpg"
|
||||
+echo " lp -d Test2 -t 'Flood Test N' testfile.jpg"
|
||||
i=0
|
||||
pids=""
|
||||
while test $i -lt $1; do
|
||||
@@ -83,9 +83,9 @@ while test $i -lt $1; do
|
||||
j=`expr $j + 1`
|
||||
done
|
||||
|
||||
- $runcups $VALGRIND ../systemv/lp -d Test1 ../examples/testfile.jpg 2>&1 &
|
||||
+ $runcups $VALGRIND ../systemv/lp -d Test1 -t "Flood Test $j" ../examples/testfile.jpg 2>&1 &
|
||||
pids="$pids $!"
|
||||
- $runcups $VALGRIND ../systemv/lp -d Test2 ../examples/testfile.jpg 2>&1 &
|
||||
+ $runcups $VALGRIND ../systemv/lp -d Test2 -t "Flood Test $j" ../examples/testfile.jpg 2>&1 &
|
||||
pids="$pids $!"
|
||||
|
||||
i=`expr $i + 1`
|
||||
--
|
||||
2.43.7
|
||||
@@ -0,0 +1,85 @@
|
||||
From e206c7643a7574cab2e9457eac4c9f755dbf44ff Mon Sep 17 00:00:00 2001
|
||||
From: Michael R Sweet <msweet@msweet.org>
|
||||
Date: Tue, 31 Mar 2026 14:45:13 -0400
|
||||
Subject: [PATCH] Filter out control characters from option values.
|
||||
|
||||
CVE: CVE-2026-34980
|
||||
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/8d0f51cac24cb5bf949c5b6a221e51a150d982e3]
|
||||
|
||||
Backport Changes:
|
||||
- Rebase scheduler/job.c option-handling context to the CUPS 2.4.11
|
||||
source carried by this recipe.
|
||||
- Omit the upstream CHANGES.md release-note hunk because Yocto patch metadata
|
||||
carries the CVE details and the target source release-note sections differ.
|
||||
|
||||
(cherry picked from commit 8d0f51cac24cb5bf949c5b6a221e51a150d982e3)
|
||||
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
|
||||
---
|
||||
scheduler/job.c | 41 +++++++++++++++++++++++++++++++++++------
|
||||
1 file changed, 35 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/scheduler/job.c b/scheduler/job.c
|
||||
index 822a247..895b2d9 100644
|
||||
--- a/scheduler/job.c
|
||||
+++ b/scheduler/job.c
|
||||
@@ -4121,9 +4121,21 @@ get_options(cupsd_job_t *job, /* I - Job */
|
||||
case IPP_TAG_URI :
|
||||
for (valptr = attr->values[i].string.text; *valptr;)
|
||||
{
|
||||
- if (strchr(" \t\n\\\'\"", *valptr))
|
||||
- *optptr++ = '\\';
|
||||
- *optptr++ = *valptr++;
|
||||
+ /*
|
||||
+ * Convert tabs and newlines to spaces, filter out control chars,
|
||||
+ * and escape \, ', and ".
|
||||
+ */
|
||||
+
|
||||
+ if (isspace(*valptr & 255))
|
||||
+ {
|
||||
+ *optptr++ = ' ';
|
||||
+ }
|
||||
+ else if ((*valptr & 255) >= ' ' && *valptr != 0x7f)
|
||||
+ {
|
||||
+ if (strchr("\\\'\"", *valptr))
|
||||
+ *optptr++ = '\\';
|
||||
+ *optptr++ = *valptr++;
|
||||
+ }
|
||||
}
|
||||
|
||||
*optptr = '\0';
|
||||
@@ -5394,13 +5409,30 @@ update_job(cupsd_job_t *job) /* I - Job to check */
|
||||
else if (loglevel == CUPSD_LOG_PPD)
|
||||
{
|
||||
/*
|
||||
- * Set attribute(s)...
|
||||
+ * Set PPD keyword(s)/value(s)...
|
||||
*/
|
||||
|
||||
+ int i, /* Looping var */
|
||||
+ num_keywords; /* Number of keywords */
|
||||
+ cups_option_t *keywords, /* Keywords */
|
||||
+ *keyword; /* Current keyword */
|
||||
+
|
||||
cupsdLogJob(job, CUPSD_LOG_DEBUG, "PPD: %s", message);
|
||||
|
||||
- job->num_keywords = cupsParseOptions(message, job->num_keywords,
|
||||
- &job->keywords);
|
||||
+ keywords = NULL;
|
||||
+ num_keywords = cupsParseOptions(message, 0, &keywords);
|
||||
+
|
||||
+ for (i = 0, keyword = keywords; i < num_keywords; i ++)
|
||||
+ {
|
||||
+ /*
|
||||
+ * Filter out "special" PPD keywords...
|
||||
+ */
|
||||
+
|
||||
+ if (strcmp(keyword->name, "cupsFilter") && strcmp(keyword->name, "cupsFilter2") && strcmp(keyword->name, "cupsFinishingTemplate") && strcmp(keyword->name, "cupsIPPFinishings") && strcmp(keyword->name, "cupsIPPReason") && strcmp(keyword->name, "cupsMarkerName") && strcmp(keyword->name, "cupsMaxSize") && strncmp(keyword->name, "cupsMediaQualifier", 18) && strcmp(keyword->name, "cupsMinSize") && strcmp(keyword->name, "cupsPageSizeCategory") && strcmp(keyword->name, "cupsPortMonitor") && strcmp(keyword->name, "cupsPreFilter") && strcmp(keyword->name, "cupsPrintQuality") && strcmp(keyword->name, "APPrinterPreset"))
|
||||
+ job->num_keywords = cupsAddOption(keyword->name, keyword->value, job->num_keywords, &job->keywords);
|
||||
+ }
|
||||
+
|
||||
+ cupsFreeOptions(num_keywords, keywords);
|
||||
}
|
||||
else
|
||||
{
|
||||
--
|
||||
2.43.7
|
||||
Reference in new issue
Block a user