cups/0001-Filter-out-control-characters-from-option-values.patch
RHEL Packaging Agent 40ea1a60e8 Fix CVE-2026-34980: control character injection in option values
Resolves: RHEL-177957

Co-Authored: Zdenek Dohnal <zdohnal@redhat.com>
2026-06-23 15:38:34 +02:00

76 lines
2.7 KiB
Diff

From 8d0f51cac24cb5bf949c5b6a221e51a150d982e3 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 31 Mar 2026 14:45:13 -0400
Subject: [PATCH] Filter out control characters from option values.
---
scheduler/job.c | 41 +++++++++++++++++++++++++++++++++++------
1 file changed, 35 insertions(+), 6 deletions(-)
diff --git a/scheduler/job.c b/scheduler/job.c
index 1fef9d0cd..af6390687 100644
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -4118,9 +4118,21 @@ get_options(cupsd_job_t *job, /* I - Job */
case IPP_TAG_URI :
for (valptr = attr->values[i].string.text; *valptr;)
{
- if (strchr(" \t\n\\\'\"", *valptr))
- *optptr++ = '\\';
- *optptr++ = *valptr++;
+ /*
+ * Convert tabs and newlines to spaces, filter out control chars,
+ * and escape \, ', and ".
+ */
+
+ if (isspace(*valptr & 255))
+ {
+ *optptr++ = ' ';
+ }
+ else if ((*valptr & 255) >= ' ' && *valptr != 0x7f)
+ {
+ if (strchr("\\\'\"", *valptr))
+ *optptr++ = '\\';
+ *optptr++ = *valptr++;
+ }
}
*optptr = '\0';
@@ -5395,13 +5407,30 @@ update_job(cupsd_job_t *job) /* I - Job to check */
else if (loglevel == CUPSD_LOG_PPD)
{
/*
- * Set attribute(s)...
+ * Set PPD keyword(s)/value(s)...
*/
+ int i, /* Looping var */
+ num_keywords; /* Number of keywords */
+ cups_option_t *keywords, /* Keywords */
+ *keyword; /* Current keyword */
+
cupsdLogJob(job, CUPSD_LOG_DEBUG, "PPD: %s", message);
- job->num_keywords = cupsParseOptions(message, job->num_keywords,
- &job->keywords);
+ keywords = NULL;
+ num_keywords = cupsParseOptions(message, 0, &keywords);
+
+ for (i = 0, keyword = keywords; i < num_keywords; i ++)
+ {
+ /*
+ * Filter out "special" PPD keywords...
+ */
+
+ if (strcmp(keyword->name, "cupsFilter") && strcmp(keyword->name, "cupsFilter2") && strcmp(keyword->name, "cupsFinishingTemplate") && strcmp(keyword->name, "cupsIPPFinishings") && strcmp(keyword->name, "cupsIPPReason") && strcmp(keyword->name, "cupsMarkerName") && strcmp(keyword->name, "cupsMaxSize") && strncmp(keyword->name, "cupsMediaQualifier", 18) && strcmp(keyword->name, "cupsMinSize") && strcmp(keyword->name, "cupsPageSizeCategory") && strcmp(keyword->name, "cupsPortMonitor") && strcmp(keyword->name, "cupsPreFilter") && strcmp(keyword->name, "cupsPrintQuality") && strcmp(keyword->name, "APPrinterPreset"))
+ job->num_keywords = cupsAddOption(keyword->name, keyword->value, job->num_keywords, &job->keywords);
+ }
+
+ cupsFreeOptions(num_keywords, keywords);
}
else
{
--
2.52.0