Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cups-filters ver. bump

Browse Source
This commit is contained in:
Rmys
2024-06-10 22:08:57 +03:00
parent 15b5819404
commit 7895cab90d
4 changed files with 258 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hardware/printer/cups-filters/actions.py
+1
View File
@@ -9,6 +9,7 @@ from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
def setup():
pisitools.cxxflags.add("-std=c++17")
pisitools.dosed("configure", "localstatedir/run/cups", "localstatedir/cups")
shelltools.system("./autogen.sh")
autotools.configure("--sbindir=/usr/bin \
hardware/printer/cups-filters/files/93e60d3df358c0ae6f3dba79e1c9684657683d89.patch
+205
View File
@@ -0,0 +1,205 @@
From 93e60d3df358c0ae6f3dba79e1c9684657683d89 Mon Sep 17 00:00:00 2001
From: Till Kamppeter <till.kamppeter@gmail.com>
Date: Wed, 17 May 2023 11:11:29 +0200
Subject: [PATCH] beh backend: Use execv() instead of system() - CVE-2023-24805
With execv() command line arguments are passed as separate strings and
not the full command line in a single string. This prevents arbitrary
command execution by escaping the quoting of the arguments in a job
with a forged job title.
In addition, done the following fixes and improvements:
- Do not allow '/' in the scheme of the URI (= backend executable
name), to assure that only backends inside /usr/lib/cups/backend/
are used.
- URI must have ':', to split off scheme, otherwise error out.
- Check return value of snprintf() to create call path for backend, to
error out on truncation of a too long scheme or on complete failure
due to a completely odd scheme.
- Use strncat() instead of strncpy() for getting scheme from URI, the latter
does not require setting terminating zero byte in case of truncation.
- Also exclude "." or ".." as scheme, as directories are not valid CUPS
backends.
- Do not use fprintf() in sigterm_handler(), to not interfere with a
fprintf() which could be running in the main process when
sigterm_handler() is triggered.
- Use "static volatile int" for global variable job_canceled.
---
backend/beh.c | 107 +++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 84 insertions(+), 23 deletions(-)
diff --git a/backend/beh.c b/backend/beh.c
index 225fd27d5..8d51235b1 100644
--- a/backend/beh.c
+++ b/backend/beh.c
@@ -22,12 +22,13 @@
#include "backend-private.h"
#include <cups/array.h>
#include <ctype.h>
+#include <sys/wait.h>
/*
* Local globals...
*/
-static int job_canceled = 0; /* Set to 1 on SIGTERM */
+static volatile int job_canceled = 0; /* Set to 1 on SIGTERM */
/*
* Local functions...
@@ -213,21 +214,40 @@ call_backend(char *uri, /* I - URI of final destination */
char **argv, /* I - Command-line arguments */
char *filename) { /* I - File name of input data */
const char *cups_serverbin; /* Location of programs */
+ char *backend_argv[8]; /* Arguments for backend */
char scheme[1024], /* Scheme from URI */
*ptr, /* Pointer into scheme */
- cmdline[65536]; /* Backend command line */
- int retval;
+ backend_path[2048]; /* Backend path */
+ int pid = 0, /* Process ID of backend */
+ wait_pid, /* Process ID from wait() */
+ wait_status, /* Status from child */
+ retval = 0;
+ int bytes;
/*
* Build the backend command line...
*/
- strncpy(scheme, uri, sizeof(scheme) - 1);
- if (strlen(uri) > 1023)
- scheme[1023] = '\0';
+ scheme[0] = '\0';
+ strncat(scheme, uri, sizeof(scheme) - 1);
if ((ptr = strchr(scheme, ':')) != NULL)
*ptr = '\0';
-
+ else {
+ fprintf(stderr,
+ "ERROR: beh: Invalid URI, no colon (':') to mark end of scheme part.\n");
+ exit (CUPS_BACKEND_FAILED);
+ }
+ if (strchr(scheme, '/')) {
+ fprintf(stderr,
+ "ERROR: beh: Invalid URI, scheme contains a slash ('/').\n");
+ exit (CUPS_BACKEND_FAILED);
+ }
+ if (!strcmp(scheme, ".") || !strcmp(scheme, "..")) {
+ fprintf(stderr,
+ "ERROR: beh: Invalid URI, scheme (\"%s\") is a directory.\n",
+ scheme);
+ exit (CUPS_BACKEND_FAILED);
+ }
if ((cups_serverbin = getenv("CUPS_SERVERBIN")) == NULL)
cups_serverbin = CUPS_SERVERBIN;
@@ -235,16 +255,29 @@ call_backend(char *uri, /* I - URI of final destination */
fprintf(stderr,
"ERROR: beh: Direct output into a file not supported.\n");
exit (CUPS_BACKEND_FAILED);
- } else
- snprintf(cmdline, sizeof(cmdline),
- "%s/backend/%s '%s' '%s' '%s' '%s' '%s' %s",
- cups_serverbin, scheme, argv[1], argv[2], argv[3],
- /* Apply number of copies only if beh was called with a
- file name and not with the print data in stdin, as
- backends should handle copies only if they are called
- with a file name */
- (argc == 6 ? "1" : argv[4]),
- argv[5], filename);
+ }
+
+ backend_argv[0] = uri;
+ backend_argv[1] = argv[1];
+ backend_argv[2] = argv[2];
+ backend_argv[3] = argv[3];
+ /* Apply number of copies only if beh was called with a file name
+ and not with the print data in stdin, as backends should handle
+ copies only if they are called with a file name */
+ backend_argv[4] = (argc == 6 ? "1" : argv[4]);
+ backend_argv[5] = argv[5];
+ backend_argv[6] = filename;
+ backend_argv[7] = NULL;
+
+ bytes = snprintf(backend_path, sizeof(backend_path),
+ "%s/backend/%s", cups_serverbin, scheme);
+ if (bytes < 0 || bytes >= sizeof(backend_path))
+ {
+ fprintf(stderr,
+ "ERROR: beh: Invalid scheme (\"%s\"), could not determing backend path.\n",
+ scheme);
+ return (CUPS_BACKEND_FAILED);
+ }
/*
* Overwrite the device URI and run the actual backend...
@@ -253,18 +286,44 @@ call_backend(char *uri, /* I - URI of final destination */
setenv("DEVICE_URI", uri, 1);
fprintf(stderr,
- "DEBUG: beh: Executing backend command line \"%s\"...\n",
- cmdline);
+ "DEBUG: beh: Executing backend command line \"%s '%s' '%s' '%s' '%s' '%s' %s\"...\n",
+ backend_path, backend_argv[1], backend_argv[2], backend_argv[3],
+ backend_argv[4], backend_argv[5], backend_argv[6]);
fprintf(stderr,
"DEBUG: beh: Using device URI: %s\n",
uri);
- retval = system(cmdline) >> 8;
+ if ((pid = fork()) == 0) {
+ /*
+ * Child comes here...
+ */
+
+ /* Run the backend */
+ execv(backend_path, backend_argv);
- if (retval == -1)
fprintf(stderr, "ERROR: Unable to execute backend command line: %s\n",
strerror(errno));
+ exit(1);
+ } else if (pid < 0) {
+ /*
+ * Unable to fork!
+ */
+
+ return (CUPS_BACKEND_FAILED);
+ }
+
+ while ((wait_pid = wait(&wait_status)) < 0 && errno == EINTR);
+
+ if (wait_pid >= 0 && wait_status) {
+ if (WIFEXITED(wait_status))
+ retval = WEXITSTATUS(wait_status);
+ else if (WTERMSIG(wait_status) != SIGTERM)
+ retval = WTERMSIG(wait_status);
+ else
+ retval = 0;
+ }
+
return (retval);
}
@@ -277,8 +336,10 @@ static void
sigterm_handler(int sig) { /* I - Signal number (unused) */
(void)sig;
- fprintf(stderr,
- "DEBUG: beh: Job canceled.\n");
+ const char * const msg = "DEBUG: beh: Job canceled.\n";
+ /* The if() is to eliminate the return value and silence the warning
+ about an unused return value. */
+ if (write(2, msg, strlen(msg)));
if (job_canceled)
_exit(CUPS_BACKEND_OK);
hardware/printer/cups-filters/files/cups-filters-1.28.17-c++17.patch
+31
View File
@@ -0,0 +1,31 @@
https://bugs.gentoo.org/901243
(and https://bugs.gentoo.org/898076)
https://github.com/OpenPrinting/cups-filters/pull/505
From 104fba23b1c0c67c92777b3165c6dca99558a656 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Mon, 6 Feb 2023 18:13:52 -0800
Subject: [PATCH] use noexcept(false) instead of throw() from c++17 onwards
C++17 removed dynamic exception specifications [1]
they had been deprecated since C++11, replace
throw(whatever) with noexcept(false).
[1] https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2016/p0003r5.html
Signed-off-by: Khem Raj <raj.khem@gmail.com>
--- a/filter/pdftoraster.cxx
+++ b/filter/pdftoraster.cxx
@@ -2148,7 +2148,11 @@ int main(int argc, char *argv[]) {
/* For compatibility with g++ >= 4.7 compilers _GLIBCXX_THROW
* should be used as a guard, otherwise use traditional definition */
#ifndef _GLIBCXX_THROW
+#if __cplusplus < 201703L
#define _GLIBCXX_THROW throw
+#else
+#define _GLIBCXX_THROW(x) noexcept(false)
+#endif
#endif
void * operator new(size_t size) _GLIBCXX_THROW (std::bad_alloc)
hardware/printer/cups-filters/pspec.xml
+21 -9
View File
@@ -19,7 +19,7 @@
<IsA>app:console</IsA>
<Summary>OpenPrinting CUPS filters and backends</Summary>
<Description>Contains backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters developed independently of Apple, especially filters for the PDF-centric printing workflow introduced by OpenPrinting.</Description>
<Archive type="tarxz" sha1sum="790b160ec1f7db2ba2148a1f90525f9205957960">https://github.com/OpenPrinting/cups-filters/releases/download/2.0.0/cups-filters-2.0.0.tar.xz</Archive>
<Archive type="tarxz" sha1sum="aff6b20c4bf0a4f80e400f8174c5aa7ffdb7d9a7">https://github.com/OpenPrinting/cups-filters/releases/download/1.28.17/cups-filters-1.28.17.tar.xz</Archive>
<BuildDependencies>
<Dependency>python3-devel</Dependency>
<Dependency>cups-devel</Dependency>
@@ -41,13 +41,15 @@
<Dependency>openldap-client</Dependency>
<Dependency>avahi-devel</Dependency>
<Dependency>avahi-glib-devel</Dependency>
<Dependency>libppd-devel</Dependency>
<Dependency>libcupsfilters-devel</Dependency>
<Dependency versionFrom="11.2.0">qpdf-devel</Dependency>
<Dependency versionFrom="11.9.1">qpdf-devel</Dependency>
<Dependency versionFrom="9.53">ghostscript-devel</Dependency>
<Dependency versionFrom="22.07.0">poppler-devel</Dependency>
<Dependency>mupdf-devel</Dependency>
</BuildDependencies>
<Patches>
<Patch level="1">cups-filters-1.28.17-c++17.patch</Patch>
<Patch level="1">93e60d3df358c0ae6f3dba79e1c9684657683d89.patch</Patch>
</Patches>
</Source>
<Package>
@@ -73,8 +75,6 @@
<Dependency>avahi-glib</Dependency>
<Dependency>avahi-libs</Dependency>
<!-- <Dependency>mupdf</Dependency> -->
<Dependency>libppd</Dependency>
<Dependency>libcupsfilters</Dependency>
<Dependency>openldap-client</Dependency>
</RuntimeDependencies>
<Files>
@@ -84,13 +84,15 @@
<Path fileType="data">/usr/share/ppd</Path>
<Path fileType="executable">/usr/bin</Path>
<Path fileType="data">/usr/share/cups</Path>
<Path fileType="data">/usr/share/ppdc</Path>
<Path fileType="config">/etc/cups/cups-browsed.conf</Path>
<Path fileType="config">/etc/fonts/conf.d/99pdftoopvp.conf</Path>
</Files>
<Replaces>
<Package>libcupsfilters</Package>
</Replaces>
</Package>
<!--Package>
<Package>
<Name>cups-filters-devel</Name>
<Summary>Cups-filters için geliştirme dosyaları</Summary>
<RuntimeDependencies>
@@ -100,9 +102,19 @@
<Path fileType="header">/usr/include</Path>
<Path fileType="library">/usr/lib/pkgconfig</Path>
</Files>
</Package-->
<Replaces>
<Package>libcupsfilters-devel</Package>
</Replaces>
</Package>
<History>
<Update release="29">
<Date>2024-06-10</Date>
<Version>1.28.17</Version>
<Comment>Revert.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="28">
<Date>2024-05-23</Date>
<Version>2.0.0</Version>