From 20b33a26b2efdbf2c35c5cacc54a041855ec764b Mon Sep 17 00:00:00 2001
From: Marcus Meissner <marcus@jet.franken.de>
Date: Wed, 8 Apr 2026 15:15:54 +0200
Subject: [PATCH] Fixed Canon FolderEntry Missing Null Termination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ptp_unpack_Canon_FE() copies filename with strncpy into a 13-byte
buffer without explicit null termination. The EOS variant at line
1451–1452 correctly adds fe->Filename[PTP_CANON_FilenameBufferLen-1]
= 0; confirming this was recognized as necessary but not applied to the
original Canon path.

 CVE-2026-40334

Reported-By: Sebastián Alba <sebasjosue84@gmail.com>

CVE: CVE-2026-40334
Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/259fc7d3bfe534ce4b114c464f55b448670ab873]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 camlibs/ptp2/ptp-pack.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c
index 09dcc24..982b4f4 100644
--- a/camlibs/ptp2/ptp-pack.c
+++ b/camlibs/ptp2/ptp-pack.c
@@ -1369,6 +1369,7 @@ ptp_unpack_Canon_FE (PTPParams *params, const unsigned char* data, PTPCANONFolde
 	fe->ObjectSize       = dtoh32a(data + PTP_cfe_ObjectSize);
 	fe->Time     = (time_t)dtoh32a(data + PTP_cfe_Time);
 	strncpy(fe->Filename, (char*)data + PTP_cfe_Filename, PTP_CANON_FilenameBufferLen);
+	fe->Filename[PTP_CANON_FilenameBufferLen-1] = '\0';
 }
 
 /*
