rpms/libcupsfilters
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-64611: infinite loop and empty device_ids in ieee1284

Browse Source 
Backport upstream commit 4b343522823403df01f6753082df83f07d18c217
to fix CVE-2026-64611 in libcupsfilters. The patch addresses three
issues in cupsfilters/ieee1284.c: early return when no key:value
pairs are found in a device ID, skipping empty keys/values during
parsing, and preventing an infinite loop in manufacturer name
deduplication by guarding the strncasecmp while loop with a
compare_len > 0 check.

CVE: CVE-2026-64611
Upstream patches:
 - 4b34352282.patch
Resolves: RHEL-214027

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-29 15:25:57 +00:00
parent f447ecff21
commit 028070f04d
2 changed files with 72 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
libcupsfilters-2.0.0-CVE-2026-64611.patch Normal file
View File

@ -0,0 +1,64 @@
From 0a24280aedad332c7fe25f9340c91a450f2eacac Mon Sep 17 00:00:00 2001
From: zdohnal <zdohnal@redhat.com>
Date: Thu, 23 Jul 2026 16:54:46 +0200
Subject: [PATCH] ieee.c: Fix possible infinite loop and avoid empty device_ids
(#170)
If model in device id was empty, library got into infinite loop. There
are several layers of protection now:
- library now does not allow empty strings for key or value
- device ids without values are thrown away
- comparison now happens only when there is actual string to compare
with, aka length > 0
Fixes: CVE-2026-64611
---
cupsfilters/ieee1284.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/cupsfilters/ieee1284.c b/cupsfilters/ieee1284.c
index 8d8cf16c..30f9e6b8 100644
--- a/cupsfilters/ieee1284.c
+++ b/cupsfilters/ieee1284.c
@@ -407,6 +407,12 @@ cfIEEE1284GetMakeModel(
num_values = cfIEEE1284GetValues(device_id, &values);
+ if (!num_values)
+ {
+ DEBUG_puts("cfIEEE1284GetMakeModel: no key:value pairs");
+ return (-1);
+ }
+
if ((mdl = cupsGetOption("MODEL", num_values, values)) == NULL)
mdl = cupsGetOption("MDL", num_values, values);
@@ -573,6 +579,9 @@ cfIEEE1284GetValues(
*ptr = '\0';
device_id ++;
+ if (!key[0] || !value[0])
+ continue;
+
num_values = cupsAddOption(key, value, num_values, values);
}
@@ -668,6 +677,7 @@ cfIEEE1284NormalizeMakeModel(
char *bufptr; // Pointer into buffer
char sepchr = ' '; // Word separator character
int compare = 0, // Format for comparing
+ compare_len = 0, // Length of compared buffer
human = 0, // Format for human-readable string
lower = 0, // All letters lowercase
upper = 0, // All letters uppercase
@@ -1119,7 +1129,8 @@ cfIEEE1284NormalizeMakeModel(
// Remove repeated manufacturer names...
//
- while (strncasecmp(buffer, modelptr, modelptr - buffer) == 0)
+ compare_len = modelptr - buffer;
+ while (compare_len > 0 && strncasecmp(buffer, modelptr, compare_len) == 0)
move_right_part(buffer, bufsize, modelptr, buffer - modelptr);
//

9
libcupsfilters.spec
View File

@ -4,7 +4,7 @@
Name: libcupsfilters
Epoch: 1
Version: 2.0.0
Release: 12%{?dist}
Release: 13%{?dist}
Summary: Library for developing printing filters
# the CUPS exception text is the same as LLVM exception, so using that name with
# agreement from legal team
@ -31,6 +31,9 @@ Patch0006: 0001-configure.ac-Make-CJK-fonts-name-configurable.patch
# RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp()
# https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419acbd0cbcc8340f41a383f35aae12
Patch0007: libcupsfilters-2.0.0-CVE-2026-64612.patch
# RHEL-214027 CVE-2026-64611
# https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217
Patch0008: libcupsfilters-2.0.0-CVE-2026-64611.patch
# for generating configure and Makefile scripts in autogen.h
@ -209,6 +212,10 @@ rm -f %{buildroot}%{_pkgdocdir}/{LICENSE,COPYING,NOTICE}
%changelog
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.0.0-13
- RHEL-214027 CVE-2026-64611 libcupsfilters: Fix infinite loop and
empty device_ids in ieee1284
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.0.0-12
- RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors
via longjmp()/setjmp() to prevent process abort on malformed PNG