mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-08-31 14:24:12 +00:00
Code Issues Projects Releases Wiki Activity

cups: fix CVE-2026-41079

Browse Source 
Pick the upstream fix [1] for CVE-2026-41079 as referenced by Debian [2].

[1] https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080
[2] https://security-tracker.debian.org/tracker/CVE-2026-41079

(From OE-Core rev: bdb4178b04dabbdba1c1f32aa34bb50ee1a8aedf)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
[YC: reverted modified indentation in imported patch]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore
2026-07-30 13:21:15 +01:00
committed by Paul Barker
parent b9993675ea
commit 8b7ff1d843
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/cups/cups.inc
+1
View File
@@ -23,6 +23,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
file://CVE-2026-27447.patch \
file://CVE-2026-27447-regression_p1.patch \
file://CVE-2026-27447-regression_p2.patch \
file://CVE-2026-41079.patch \
"
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
meta/recipes-extended/cups/cups/CVE-2026-41079.patch
+71
View File
@@ -0,0 +1,71 @@
From a331e93e2f9baf411715ef69ae19b73827da23d7 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 13 Apr 2026 11:50:23 -0400
Subject: [PATCH] Limit num_bytes for SNMP string values.
CVE: CVE-2026-41079
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080]
(cherry picked from commit b7c2525a885f528d243c3a92197ca99609b3f080)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
cups/snmp-private.h | 6 +++---
cups/snmp.c | 8 ++++++--
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/cups/snmp-private.h b/cups/snmp-private.h
index 52b8740..015f53e 100644
--- a/cups/snmp-private.h
+++ b/cups/snmp-private.h
@@ -1,7 +1,7 @@
/*
* Private SNMP definitions for CUPS.
*
- * Copyright © 2020-2024 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
* Copyright © 2007-2014 by Apple Inc.
* Copyright © 2006-2007 by Easy Software Products, all rights reserved.
*
@@ -58,9 +58,9 @@ typedef enum cups_asn1_e cups_asn1_t; /**** ASN1 request/object types ****/
typedef struct cups_snmp_string_s /**** String value ****/
{
- unsigned char bytes[CUPS_SNMP_MAX_STRING];
- /* Bytes in string */
unsigned num_bytes; /* Number of bytes */
+ unsigned char bytes[CUPS_SNMP_MAX_STRING + 1];
+ /* Bytes in string */
} cups_snmp_string_t;
union cups_snmp_value_u /**** Object value ****/
diff --git a/cups/snmp.c b/cups/snmp.c
index 54e348f..2fcb38d 100644
--- a/cups/snmp.c
+++ b/cups/snmp.c
@@ -1,7 +1,7 @@
/*
* SNMP functions for CUPS.
*
- * Copyright © 2020-2024 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
* Copyright © 2007-2019 by Apple Inc.
* Copyright © 2006-2007 by Easy Software Products, all rights reserved.
*
@@ -1042,10 +1042,14 @@ asn1_decode_snmp(unsigned char *buffer, /* I - Buffer */
case CUPS_ASN1_OCTET_STRING :
case CUPS_ASN1_BIT_STRING :
case CUPS_ASN1_HEX_STRING :
- packet->object_value.string.num_bytes = length;
asn1_get_string(&bufptr, bufend, length,
(char *)packet->object_value.string.bytes,
sizeof(packet->object_value.string.bytes));
+
+ if (length >= sizeof(packet->object_value.string.bytes))
+ packet->object_value.string.num_bytes = sizeof(packet->object_value.string.bytes) - 1;
+ else
+ packet->object_value.string.num_bytes = length;
break;
case CUPS_ASN1_OID :
--
2.43.7