cups/backport-0001-CVE-2024-47175.patch
zppzhangpan b562f05081 fix CVE-2024-47175
(cherry picked from commit ffdfc20f12fc74a4373c3878c6d26f733c683e52)
2024-10-08 15:14:17 +08:00

69 lines
2.9 KiB
Diff

Backport of:
From 9939a70b750edd9d05270060cc5cf62ca98cfbe5 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 9 Sep 2024 10:03:10 -0400
Subject: [PATCH] Mirror IPP Everywhere printer changes from master.
Reference:https://github.com/OpenPrinting/cups/commit/9939a70b750edd9d05270060cc5cf62ca98cfbe5
Conflict:NA
---
cups/ppd-cache.c | 10 +++++-----
scheduler/ipp.c | 9 ++++++++-
2 files changed, 13 insertions(+), 6 deletions(-)
--- a/cups/ppd-cache.c
+++ b/cups/ppd-cache.c
@@ -4284,10 +4284,10 @@ _ppdCreateFromIPP2(
}
cupsFilePuts(fp, "\"\n");
- if ((attr = ippFindAttribute(supported, "printer-more-info", IPP_TAG_URI)) != NULL)
+ if ((attr = ippFindAttribute(supported, "printer-more-info", IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
cupsFilePrintf(fp, "*APSupplies: \"%s\"\n", ippGetString(attr, 0, NULL));
- if ((attr = ippFindAttribute(supported, "printer-charge-info-uri", IPP_TAG_URI)) != NULL)
+ if ((attr = ippFindAttribute(supported, "printer-charge-info-uri", IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
cupsFilePrintf(fp, "*cupsChargeInfoURI: \"%s\"\n", ippGetString(attr, 0, NULL));
if ((attr = ippFindAttribute(supported, "printer-strings-uri", IPP_TAG_URI)) != NULL)
@@ -4356,10 +4356,10 @@ _ppdCreateFromIPP2(
if (ippGetBoolean(ippFindAttribute(supported, "job-accounting-user-id-supported", IPP_TAG_BOOLEAN), 0))
cupsFilePuts(fp, "*cupsJobAccountingUserId: True\n");
- if ((attr = ippFindAttribute(supported, "printer-privacy-policy-uri", IPP_TAG_URI)) != NULL)
+ if ((attr = ippFindAttribute(supported, "printer-privacy-policy-uri", IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
cupsFilePrintf(fp, "*cupsPrivacyURI: \"%s\"\n", ippGetString(attr, 0, NULL));
- if ((attr = ippFindAttribute(supported, "printer-mandatory-job-attributes", IPP_TAG_KEYWORD)) != NULL)
+ if ((attr = ippFindAttribute(supported, "printer-mandatory-job-attributes", IPP_TAG_KEYWORD)) != NULL && ippValidateAttribute(attr))
{
char prefix = '\"'; // Prefix for string
@@ -4377,7 +4377,7 @@ _ppdCreateFromIPP2(
cupsFilePuts(fp, "\"\n");
}
- if ((attr = ippFindAttribute(supported, "printer-requested-job-attributes", IPP_TAG_KEYWORD)) != NULL)
+ if ((attr = ippFindAttribute(supported, "printer-requested-job-attributes", IPP_TAG_KEYWORD)) != NULL && ippValidateAttribute(attr))
{
char prefix = '\"'; // Prefix for string
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -5364,6 +5364,13 @@ create_local_bg_thread(
cupsdLogMessage(CUPSD_LOG_DEBUG, "%s: IPP/1.1 Get-Printer-Attributes returned %s (%s)", printer->name, ippErrorString(cupsLastError()), cupsLastErrorString());
}
+ // Validate response from printer...
+ if (!ippValidateAttributes(response))
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR, "%s: Printer returned invalid data: %s", printer->name, cupsLastErrorString());
+ return (NULL);
+ }
+
// TODO: Grab printer icon file...
httpClose(http);