Fix CVE-2026-64612: handle libpng errors gracefully in libcupsfilters
Backport upstream commit e8888af31419 to fix CVE-2026-64612.
The patch adds proper libpng error handling via longjmp()/setjmp()
in cupsfilters/image-png.c, so that a malformed PNG results in a
graceful error return instead of aborting the whole process.
CVE: CVE-2026-64612
Upstream patches:
- e8888af314.patch
Resolves: RHEL-212655
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
677f06d48f
commit
f447ecff21
119
libcupsfilters-2.0.0-CVE-2026-64612.patch
Normal file
119
libcupsfilters-2.0.0-CVE-2026-64612.patch
Normal file
@ -0,0 +1,119 @@
|
||||
From 1c767a7118d76c87c4158d028fe1e7dc67541a62 Mon Sep 17 00:00:00 2001
|
||||
From: zdohnal <zdohnal@redhat.com>
|
||||
Date: Thu, 23 Jul 2026 12:50:20 +0200
|
||||
Subject: [PATCH] image-png.c: Handle libpng errors via longjmp()/setjmp()
|
||||
(#168)
|
||||
|
||||
Libpng expects callers to set their own error handlers if they don't
|
||||
want to abort the whole process, and this has to be handled by
|
||||
longjmp()/setjmp().
|
||||
|
||||
It follows the C standard, so any C-standard compliant compiler should
|
||||
work fine. Setting pointers as volatile is to prevent possible undefined
|
||||
behavior.
|
||||
|
||||
Fixes CVE-2026-64612
|
||||
|
||||
Assisted-by: Claude Code by Anthropic
|
||||
---
|
||||
cupsfilters/image-png.c | 73 ++++++++++++++++++++++++++++++++++++++---
|
||||
1 file changed, 68 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/cupsfilters/image-png.c b/cupsfilters/image-png.c
|
||||
index a6fd9a6d..9f482faf 100644
|
||||
--- a/cupsfilters/image-png.c
|
||||
+++ b/cupsfilters/image-png.c
|
||||
@@ -20,6 +20,35 @@
|
||||
|
||||
#ifdef HAVE_LIBPNG
|
||||
# include <png.h> // Portable Network Graphics (PNG) definitions
|
||||
+# include <setjmp.h>
|
||||
+
|
||||
+
|
||||
+//
|
||||
+// Custom error handler for libpng — longjmp() back to the setjmp()
|
||||
+// point in the caller instead of the default abort(), so a malformed
|
||||
+// PNG results in a graceful error return.
|
||||
+//
|
||||
+
|
||||
+static void
|
||||
+cf_image_png_error_callback(png_structp png,
|
||||
+ png_const_charp error_msg)
|
||||
+{
|
||||
+ DEBUG_printf(("DEBUG: libpng error: %s\n", error_msg));
|
||||
+ longjmp(png_jmpbuf(png), 1);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+//
|
||||
+// Custom warning handler for libpng — log non-fatal issues
|
||||
+// and return normally so processing continues.
|
||||
+//
|
||||
+
|
||||
+static void
|
||||
+cf_image_png_warning_callback(png_structp png,
|
||||
+ png_const_charp warning_msg)
|
||||
+{
|
||||
+ DEBUG_printf(("DEBUG: libpng warning: %s\n", warning_msg));
|
||||
+}
|
||||
|
||||
|
||||
//
|
||||
@@ -51,18 +80,52 @@ _cfImageReadPNG(
|
||||
int bpp; // Bytes per pixel
|
||||
int pass, // Current pass
|
||||
passes; // Number of passes required
|
||||
- cf_ib_t *in, // Input pixels
|
||||
- *inptr, // Pointer into pixels
|
||||
- *out; // Output pixels
|
||||
+ cf_ib_t * volatile in = NULL; // Input pixels (volatile for setjmp)
|
||||
+ cf_ib_t *inptr; // Pointer into pixels
|
||||
+ cf_ib_t * volatile out = NULL; // Output pixels (volatile for setjmp)
|
||||
png_color_16 bg; // Background color
|
||||
|
||||
|
||||
//
|
||||
- // Setup the PNG data structures...
|
||||
+ // Setup the PNG data structures with custom error/warning handlers
|
||||
+ // so that a malformed PNG causes an error return instead of abort().
|
||||
+ // Errors during struct creation are handled internally by libpng
|
||||
+ // and result in a NULL return. Errors in any png_*() call after
|
||||
+ // setjmp() trigger our error callback which longjmp()s back.
|
||||
//
|
||||
|
||||
- pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
|
||||
+ pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL,
|
||||
+ cf_image_png_error_callback,
|
||||
+ cf_image_png_warning_callback);
|
||||
+ if (pp == NULL)
|
||||
+ {
|
||||
+ fclose(fp);
|
||||
+ return (1);
|
||||
+ }
|
||||
+
|
||||
info = png_create_info_struct(pp);
|
||||
+ if (info == NULL)
|
||||
+ {
|
||||
+ png_destroy_read_struct(&pp, NULL, NULL);
|
||||
+ fclose(fp);
|
||||
+ return (1);
|
||||
+ }
|
||||
+
|
||||
+ //
|
||||
+ // Error handling jump point — if any png_*() call below triggers
|
||||
+ // png_error(), our callback longjmp()s back here. The 'in' and
|
||||
+ // 'out' pointers are initialized to NULL so free() is safe here
|
||||
+ // even if longjmp() reverts them (C11 §7.13.2.1).
|
||||
+ //
|
||||
+
|
||||
+ if (setjmp(png_jmpbuf(pp)))
|
||||
+ {
|
||||
+ free(in);
|
||||
+ free(out);
|
||||
+ png_destroy_read_struct(&pp, &info, NULL);
|
||||
+ fclose(fp);
|
||||
+ return (1);
|
||||
+ }
|
||||
|
||||
//
|
||||
// Initialize the PNG read "engine"...
|
||||
@ -4,7 +4,7 @@
|
||||
Name: libcupsfilters
|
||||
Epoch: 1
|
||||
Version: 2.0.0
|
||||
Release: 11%{?dist}
|
||||
Release: 12%{?dist}
|
||||
Summary: Library for developing printing filters
|
||||
# the CUPS exception text is the same as LLVM exception, so using that name with
|
||||
# agreement from legal team
|
||||
@ -28,6 +28,9 @@ Patch004: 0001-Fix-issues-reported-by-OpenScanHub-79.patch
|
||||
Patch005: 0001-bannertopdf.c-Fix-segfault-when-printing-banners-tes.patch
|
||||
# RHEL-68430 texttopdf omits Chinese characters when creating PDF documents
|
||||
Patch0006: 0001-configure.ac-Make-CJK-fonts-name-configurable.patch
|
||||
# RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp()
|
||||
# https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419acbd0cbcc8340f41a383f35aae12
|
||||
Patch0007: libcupsfilters-2.0.0-CVE-2026-64612.patch
|
||||
|
||||
|
||||
# for generating configure and Makefile scripts in autogen.h
|
||||
@ -206,6 +209,10 @@ rm -f %{buildroot}%{_pkgdocdir}/{LICENSE,COPYING,NOTICE}
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.0.0-12
|
||||
- RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors
|
||||
via longjmp()/setjmp() to prevent process abort on malformed PNG
|
||||
|
||||
* Mon Aug 04 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.0.0-11
|
||||
- RHEL-68430 texttopdf omits Chinese characters when creating PDF documents
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user