rpms/cups
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Applied patch to fix CVE-2008-1722 (integer overflow in image filter, bug

Browse Source 
#441692, STR #2790).
This commit is contained in:
Tim Waugh 2008-05-09 10:29:47 +00:00
parent 6298eb18de
commit bf68f1d784
2 changed files with 78 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
cups-CVE-2008-1722.patch Normal file
View File

@ -0,0 +1,71 @@
diff -up cups-1.3.7/filter/image-png.c.CVE-2008-1722 cups-1.3.7/filter/image-png.c
--- cups-1.3.7/filter/image-png.c.CVE-2008-1722 2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.7/filter/image-png.c 2008-05-09 11:27:45.000000000 +0100
@@ -3,7 +3,7 @@
*
* PNG image routines for the Common UNIX Printing System (CUPS).
*
- * Copyright 2007 by Apple Inc.
+ * Copyright 2007-2008 by Apple Inc.
* Copyright 1993-2007 by Easy Software Products.
*
* These coded instructions, statements, and computer programs are the
@@ -170,16 +170,56 @@ _cupsImageReadPNG(
* Interlaced images must be loaded all at once...
*/
+ size_t bufsize; /* Size of buffer */
+
+
if (color_type == PNG_COLOR_TYPE_GRAY ||
color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
- in = malloc(img->xsize * img->ysize);
+ {
+ bufsize = img->xsize * img->ysize;
+
+ if ((bufsize / img->ysize) != img->xsize)
+ {
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
+ (unsigned)width, (unsigned)height);
+ fclose(fp);
+ return (1);
+ }
+ }
else
- in = malloc(img->xsize * img->ysize * 3);
+ {
+ bufsize = img->xsize * img->ysize * 3;
+
+ if ((bufsize / (img->ysize * 3)) != img->xsize)
+ {
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
+ (unsigned)width, (unsigned)height);
+ fclose(fp);
+ return (1);
+ }
+ }
+
+ in = malloc(bufsize);
}
bpp = cupsImageGetDepth(img);
out = malloc(img->xsize * bpp);
+ if (!in || !out)
+ {
+ fputs("DEBUG: Unable to allocate memory for PNG image!\n", stderr);
+
+ if (in)
+ free(in);
+
+ if (out)
+ free(out);
+
+ fclose(fp);
+
+ return (1);
+ }
+
/*
* Read the image, interlacing as needed...
*/

8
cups.spec
View File

@ -7,7 +7,7 @@
Summary: Common Unix Printing System
Name: cups
Version: 1.3.7
Release: 1%{?svn:.svn%{svn}}%{?dist}
Release: 2%{?svn:.svn%{svn}}%{?dist}
License: GPLv2
Group: System Environment/Daemons
Source: ftp://ftp.easysw.com/pub/cups/test//cups-%{version}%{?svn:svn-r%{svn}}-source.tar.bz2
@ -47,6 +47,7 @@ Patch22: cups-strict-ppd-line-length.patch
Patch23: cups-logrotate.patch
Patch25: cups-usb-paperout.patch
Patch29: cups-CVE-2008-1373.patch
Patch30: cups-CVE-2008-1722.patch
Patch100: cups-lspp.patch
Epoch: 1
Url: http://www.cups.org/
@ -164,6 +165,7 @@ lpd emulation.
%patch23 -p1 -b .logrotate
%patch25 -p1 -b .usb-paperout
%patch29 -p1 -b .CVE-2008-1373
%patch30 -p1 -b .CVE-2008-1722
%if %lspp
%patch100 -p1 -b .lspp
@ -440,6 +442,10 @@ rm -rf $RPM_BUILD_ROOT
%{cups_serverbin}/daemon/cups-lpd
%changelog
* Fri May 9 2008 Tim Waugh <twaugh@redhat.com> 1:1.3.7-2
- Applied patch to fix CVE-2008-1722 (integer overflow in image filter,
bug #441692, STR #2790).
* Thu Apr 3 2008 Tim Waugh <twaugh@redhat.com>
- Main package requires exactly-matching libs package.