mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

cups: patch CVE-2025-58364

Browse Source 
Pick commit mentioned in NVD report

(From OE-Core rev: 09a9653c51ac3eae545deeaa004fbbff8c00c827)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2025-09-25 16:05:11 +02:00
committed by Steve Sakoman
parent a443a81cf8
commit 91844fbbf2
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-extended/cups/cups.inc
View File

@@ -16,6 +16,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
file://volatiles.99_cups \
file://cups-volatiles.conf \
file://CVE-2025-58060.patch \
file://CVE-2025-58364.patch \
"
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"

58
meta/recipes-extended/cups/cups/CVE-2025-58364.patch Normal file
View File

@@ -0,0 +1,58 @@
From e58cba9d6fceed4242980e51dbd1302cf638ab1d Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 11 Sep 2025 14:53:49 +0200
Subject: [PATCH] libcups: Fix handling of extension tag in `ipp_read_io()`
Fixes: CVE-2025-58364
CVE: CVE-2025-58364
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
cups/ipp.c | 26 +-------------------------
1 file changed, 1 insertion(+), 25 deletions(-)
diff --git a/cups/ipp.c b/cups/ipp.c
index 283e386b6..e1e361b2c 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -2949,31 +2949,6 @@ ippReadIO(void *src, /* I - Data source */
*/
tag = (ipp_tag_t)buffer[0];
- if (tag == IPP_TAG_EXTENSION)
- {
- /*
- * Read 32-bit "extension" tag...
- */
-
- if ((*cb)(src, buffer, 4) < 4)
- {
- DEBUG_puts("1ippReadIO: Callback returned EOF/error");
- goto rollback;
- }
-
- tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
-
- if (tag & IPP_TAG_CUPS_CONST)
- {
- /*
- * Fail if the high bit is set in the tag...
- */
-
- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
- goto rollback;
- }
- }
if (tag == IPP_TAG_END)
{
@@ -3196,6 +3171,7 @@ ippReadIO(void *src, /* I - Data source */
if ((*cb)(src, buffer, (size_t)n) < n)
{
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
DEBUG_puts("1ippReadIO: unable to read name.");
goto rollback;
}