From f447ecff21dbfcdcd0911da3cb7a7f2ed1a53dc2 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 29 Jul 2026 15:21:12 +0000 Subject: [PATCH] Fix CVE-2026-64612: handle libpng errors gracefully in libcupsfilters Backport upstream commit e8888af31419 to fix CVE-2026-64612. The patch adds proper libpng error handling via longjmp()/setjmp() in cupsfilters/image-png.c, so that a malformed PNG results in a graceful error return instead of aborting the whole process. CVE: CVE-2026-64612 Upstream patches: - https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419acbd0cbcc8340f41a383f35aae12.patch Resolves: RHEL-212655 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- libcupsfilters-2.0.0-CVE-2026-64612.patch | 119 ++++++++++++++++++++++ libcupsfilters.spec | 9 +- 2 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 libcupsfilters-2.0.0-CVE-2026-64612.patch diff --git a/libcupsfilters-2.0.0-CVE-2026-64612.patch b/libcupsfilters-2.0.0-CVE-2026-64612.patch new file mode 100644 index 0000000..35819f7 --- /dev/null +++ b/libcupsfilters-2.0.0-CVE-2026-64612.patch @@ -0,0 +1,119 @@ +From 1c767a7118d76c87c4158d028fe1e7dc67541a62 Mon Sep 17 00:00:00 2001 +From: zdohnal +Date: Thu, 23 Jul 2026 12:50:20 +0200 +Subject: [PATCH] image-png.c: Handle libpng errors via longjmp()/setjmp() + (#168) + +Libpng expects callers to set their own error handlers if they don't +want to abort the whole process, and this has to be handled by +longjmp()/setjmp(). + +It follows the C standard, so any C-standard compliant compiler should +work fine. Setting pointers as volatile is to prevent possible undefined +behavior. + +Fixes CVE-2026-64612 + +Assisted-by: Claude Code by Anthropic +--- + cupsfilters/image-png.c | 73 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 68 insertions(+), 5 deletions(-) + +diff --git a/cupsfilters/image-png.c b/cupsfilters/image-png.c +index a6fd9a6d..9f482faf 100644 +--- a/cupsfilters/image-png.c ++++ b/cupsfilters/image-png.c +@@ -20,6 +20,35 @@ + + #ifdef HAVE_LIBPNG + # include // Portable Network Graphics (PNG) definitions ++# include ++ ++ ++// ++// Custom error handler for libpng โ€” longjmp() back to the setjmp() ++// point in the caller instead of the default abort(), so a malformed ++// PNG results in a graceful error return. ++// ++ ++static void ++cf_image_png_error_callback(png_structp png, ++ png_const_charp error_msg) ++{ ++ DEBUG_printf(("DEBUG: libpng error: %s\n", error_msg)); ++ longjmp(png_jmpbuf(png), 1); ++} ++ ++ ++// ++// Custom warning handler for libpng โ€” log non-fatal issues ++// and return normally so processing continues. ++// ++ ++static void ++cf_image_png_warning_callback(png_structp png, ++ png_const_charp warning_msg) ++{ ++ DEBUG_printf(("DEBUG: libpng warning: %s\n", warning_msg)); ++} + + + // +@@ -51,18 +80,52 @@ _cfImageReadPNG( + int bpp; // Bytes per pixel + int pass, // Current pass + passes; // Number of passes required +- cf_ib_t *in, // Input pixels +- *inptr, // Pointer into pixels +- *out; // Output pixels ++ cf_ib_t * volatile in = NULL; // Input pixels (volatile for setjmp) ++ cf_ib_t *inptr; // Pointer into pixels ++ cf_ib_t * volatile out = NULL; // Output pixels (volatile for setjmp) + png_color_16 bg; // Background color + + + // +- // Setup the PNG data structures... ++ // Setup the PNG data structures with custom error/warning handlers ++ // so that a malformed PNG causes an error return instead of abort(). ++ // Errors during struct creation are handled internally by libpng ++ // and result in a NULL return. Errors in any png_*() call after ++ // setjmp() trigger our error callback which longjmp()s back. + // + +- pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); ++ pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, ++ cf_image_png_error_callback, ++ cf_image_png_warning_callback); ++ if (pp == NULL) ++ { ++ fclose(fp); ++ return (1); ++ } ++ + info = png_create_info_struct(pp); ++ if (info == NULL) ++ { ++ png_destroy_read_struct(&pp, NULL, NULL); ++ fclose(fp); ++ return (1); ++ } ++ ++ // ++ // Error handling jump point โ€” if any png_*() call below triggers ++ // png_error(), our callback longjmp()s back here. The 'in' and ++ // 'out' pointers are initialized to NULL so free() is safe here ++ // even if longjmp() reverts them (C11 ยง7.13.2.1). ++ // ++ ++ if (setjmp(png_jmpbuf(pp))) ++ { ++ free(in); ++ free(out); ++ png_destroy_read_struct(&pp, &info, NULL); ++ fclose(fp); ++ return (1); ++ } + + // + // Initialize the PNG read "engine"... diff --git a/libcupsfilters.spec b/libcupsfilters.spec index 30e47d1..1b37e79 100644 --- a/libcupsfilters.spec +++ b/libcupsfilters.spec @@ -4,7 +4,7 @@ Name: libcupsfilters Epoch: 1 Version: 2.0.0 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Library for developing printing filters # the CUPS exception text is the same as LLVM exception, so using that name with # agreement from legal team @@ -28,6 +28,9 @@ Patch004: 0001-Fix-issues-reported-by-OpenScanHub-79.patch Patch005: 0001-bannertopdf.c-Fix-segfault-when-printing-banners-tes.patch # RHEL-68430 texttopdf omits Chinese characters when creating PDF documents Patch0006: 0001-configure.ac-Make-CJK-fonts-name-configurable.patch +# RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp() +# https://github.com/OpenPrinting/libcupsfilters/commit/e8888af31419acbd0cbcc8340f41a383f35aae12 +Patch0007: libcupsfilters-2.0.0-CVE-2026-64612.patch # for generating configure and Makefile scripts in autogen.h @@ -206,6 +209,10 @@ rm -f %{buildroot}%{_pkgdocdir}/{LICENSE,COPYING,NOTICE} %changelog +* Wed Jul 29 2026 RHEL Packaging Agent - 1:2.0.0-12 +- RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors + via longjmp()/setjmp() to prevent process abort on malformed PNG + * Mon Aug 04 2025 Zdenek Dohnal - 1:2.0.0-11 - RHEL-68430 texttopdf omits Chinese characters when creating PDF documents