diff options
Diffstat (limited to 'meta/recipes-extended/cups/cups/CVE-2023-4504.patch')
-rw-r--r-- | meta/recipes-extended/cups/cups/CVE-2023-4504.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/meta/recipes-extended/cups/cups/CVE-2023-4504.patch b/meta/recipes-extended/cups/cups/CVE-2023-4504.patch new file mode 100644 index 0000000000..e52e43a209 --- /dev/null +++ b/meta/recipes-extended/cups/cups/CVE-2023-4504.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | CVE: CVE-2023-4504 | ||
2 | Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/2431caddb7e6a87f04ac90b5c6366ad268b6ff31 ] | ||
3 | Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> | ||
4 | |||
5 | From 2431caddb7e6a87f04ac90b5c6366ad268b6ff31 Mon Sep 17 00:00:00 2001 | ||
6 | From: Zdenek Dohnal <zdohnal@redhat.com> | ||
7 | Date: Wed, 20 Sep 2023 14:45:17 +0200 | ||
8 | Subject: [PATCH] raster-interpret.c: Fix CVE-2023-4504 | ||
9 | |||
10 | We didn't check for end of buffer if it looks there is an escaped | ||
11 | character - check for NULL terminator there and if found, return NULL | ||
12 | as return value and in `ptr`, because a lone backslash is not | ||
13 | a valid PostScript character. | ||
14 | --- | ||
15 | cups/raster-interpret.c | 14 +++++++++++++- | ||
16 | 1 files changed, 13 insertions(+), 1 deletion(-) | ||
17 | |||
18 | diff --git a/cups/raster-interpret.c b/cups/raster-interpret.c | ||
19 | index 6fcf731b5..b8655c8c6 100644 | ||
20 | --- a/cups/raster-interpret.c | ||
21 | +++ b/cups/raster-interpret.c | ||
22 | @@ -1116,7 +1116,19 @@ scan_ps(_cups_ps_stack_t *st, /* I - Stack */ | ||
23 | |||
24 | cur ++; | ||
25 | |||
26 | - if (*cur == 'b') | ||
27 | + /* | ||
28 | + * Return NULL if we reached NULL terminator, a lone backslash | ||
29 | + * is not a valid character in PostScript. | ||
30 | + */ | ||
31 | + | ||
32 | + if (!*cur) | ||
33 | + { | ||
34 | + *ptr = NULL; | ||
35 | + | ||
36 | + return (NULL); | ||
37 | + } | ||
38 | + | ||
39 | + if (*cur == 'b') | ||
40 | *valptr++ = '\b'; | ||
41 | else if (*cur == 'f') | ||
42 | *valptr++ = '\f'; | ||