mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-02 13:29:49 +00:00
Code Issues Projects Releases Wiki Activity

cups: fix CVE-2022-26691

Browse Source 
In scheduler/cert.c the previous algorithm didn't expect the strings can
have a different length, so one string can be a substring of the other
and such substring was reported as equal to the longer string.

Backport patch from upstream to fix:
https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444

CVE: CVE-2022-26691

(From OE-Core rev: cc657868d31cc8b4218a07aa10fa098c379e473c)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Steve Sakoman
2022-06-13 06:11:15 -10:00
committed by Richard Purdie
parent 238fb89434
commit 95cda9d091
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/cups/cups.inc
+2 -1
View File
@@ -13,6 +13,7 @@ SRC_URI = "https://github.com/apple/cups/releases/download/v${PV}/${BP}-source.t
file://0002-don-t-try-to-run-generated-binaries.patch \
file://0003-cups_1.4.6.bb-Fix-build-on-ppc64.patch \
file://0004-cups-fix-multilib-install-file-conflicts.patch\
file://CVE-2022-26691.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/apple/cups/releases"
@@ -119,4 +120,4 @@ cups_sysroot_preprocess () {
# -25317 concerns /var/log/cups having lp ownership. Our /var/log/cups is
# root:root, so this doesn't apply.
CVE_CHECK_WHITELIST += "CVE-2021-25317"
CVE_CHECK_WHITELIST += "CVE-2021-25317"
meta/recipes-extended/cups/cups/CVE-2022-26691.patch
+33
View File
@@ -0,0 +1,33 @@
From de4f8c196106033e4c372dce3e91b9d42b0b9444 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 26 May 2022 06:27:04 +0200
Subject: [PATCH] scheduler/cert.c: Fix string comparison (fixes
CVE-2022-26691)
The previous algorithm didn't expect the strings can have a different
length, so one string can be a substring of the other and such substring
was reported as equal to the longer string.
CVE: CVE-2022-26691
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444]
Signed-off-by: Steve Sakoman
---
diff --git a/scheduler/cert.c b/scheduler/cert.c
index b268bf1b2..9b65b96c9 100644
--- a/scheduler/cert.c
+++ b/scheduler/cert.c
@@ -434,5 +434,12 @@ ctcompare(const char *a, /* I - First string */
b ++;
}
- return (result);
+ /*
+ * The while loop finishes when *a == '\0' or *b == '\0'
+ * so after the while loop either both *a and *b == '\0',
+ * or one points inside a string, so when we apply logical OR on *a,
+ * *b and result, we get a non-zero return value if the compared strings don't match.
+ */
+
+ return (result | *a | *b);
}