Fix multiple security/disclosure issues:

- CVE-2019-8696 and CVE-2019-8675: Fixed SNMP buffer overflows (rdar://51685251)
- Fixed IPP buffer overflow (rdar://50035411)
- Fixed memory disclosure issue in the scheduler (rdar://51373853)
- Fixed DoS issues in the scheduler (rdar://51373929)

diff --git a/CHANGES.md b/CHANGES.md
index 07c21ffc91cea5e4e947734045e8bff69aee08aa..9cc2e206a853444ad55d73af8bf514ce7f4e118d 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,10 +1,11 @@
-CHANGES - 2.2.12 - 2019-08-07
+CHANGES - 2.2.12 - 2019-08-15
 =============================
 
 
 Changes in CUPS v2.2.12
 -----------------------
 
+- CVE-2019-8696 and CVE-2019-8675: Fixed SNMP buffer overflows (rdar://51685251)
 - The `cupsctl` command now prevents setting "cups-files.conf" directives
   (Issue #5530)
 - Updated the systemd service file for cupsd (Issue #5551)
@@ -34,6 +35,9 @@ Changes in CUPS v2.2.12
 - Fixed some PPD parser issues (Issue #5623, Issue #5624)
 - The IPP parser no longer allows invalid member attributes in collections
   (Issue #5630)
+- Fixed IPP buffer overflow (rdar://50035411)
+- Fixed memory disclosure issue in the scheduler (rdar://51373853)
+- Fixed DoS issues in the scheduler (rdar://51373929)
 - The scheduler would restart continuously when idle and printers were not
   shared (rdar://52561199)
 - Fixed a command ordering issue in the Zebra ZPL driver.

diff --git a/cups/http.c b/cups/http.c
index 5c14ef68e11e34a82d9b4536667c8aed08475bb1..3fadb5acb04dcdaa44c1d7e8ce713a89380fe8b9 100644 (file)
--- a/cups/http.c
+++ b/cups/http.c
@@ -1905,7 +1905,7 @@ httpPrintf(http_t     *http,              /* I - HTTP connection */
           ...)                         /* I - Additional args as needed */
 {
   ssize_t      bytes;                  /* Number of bytes to write */
-  char         buf[16384];             /* Buffer for formatted string */
+  char         buf[65536];             /* Buffer for formatted string */
   va_list      ap;                     /* Variable argument pointer */
 
 
@@ -1917,7 +1917,12 @@ httpPrintf(http_t     *http,             /* I - HTTP connection */
 
   DEBUG_printf(("3httpPrintf: (" CUPS_LLFMT " bytes) %s", CUPS_LLCAST bytes, buf));
 
-  if (http->data_encoding == HTTP_ENCODING_FIELDS)
+  if (bytes > (ssize_t)(sizeof(buf) - 1))
+  {
+    http->error = ENOMEM;
+    return (-1);
+  }
+  else if (http->data_encoding == HTTP_ENCODING_FIELDS)
     return ((int)httpWrite2(http, buf, (size_t)bytes));
   else
   {

diff --git a/cups/ipp.c b/cups/ipp.c
index eaa8c78ca4d8e742967cc5271ec44641bd5aac4d..b0762fdcbf370d8e9d0ce2c20316d42189fbef8a 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -4553,9 +4553,7 @@ ippSetValueTag(
         break;
 
     case IPP_TAG_NAME :
-        if (temp_tag != IPP_TAG_KEYWORD && temp_tag != IPP_TAG_URI &&
-            temp_tag != IPP_TAG_URISCHEME && temp_tag != IPP_TAG_LANGUAGE &&
-            temp_tag != IPP_TAG_MIMETYPE)
+        if (temp_tag != IPP_TAG_KEYWORD)
           return (0);
 
         (*attr)->value_tag = (ipp_tag_t)(IPP_TAG_NAME | ((*attr)->value_tag & IPP_TAG_CUPS_CONST));
@@ -4563,10 +4561,7 @@ ippSetValueTag(
 
     case IPP_TAG_NAMELANG :
     case IPP_TAG_TEXTLANG :
-        if (value_tag == IPP_TAG_NAMELANG &&
-            (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD &&
-             temp_tag != IPP_TAG_URI && temp_tag != IPP_TAG_URISCHEME &&
-             temp_tag != IPP_TAG_LANGUAGE && temp_tag != IPP_TAG_MIMETYPE))
+        if (value_tag == IPP_TAG_NAMELANG && (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD))
           return (0);
 
         if (value_tag == IPP_TAG_TEXTLANG && temp_tag != IPP_TAG_TEXT)

diff --git a/cups/snmp.c b/cups/snmp.c
index 8437528dd0dd187ded93788a9a9b1b7ae84a7801..fc93961774f28f281ae4dd94728e526d66a6dd4e 100644 (file)
--- a/cups/snmp.c
+++ b/cups/snmp.c
@@ -1233,6 +1233,9 @@ asn1_get_integer(
   int  value;                          /* Integer value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   if (length > sizeof(int))
   {
     (*buffer) += length;
@@ -1259,6 +1262,9 @@ asn1_get_length(unsigned char **buffer,   /* IO - Pointer in buffer */
   unsigned     length;                 /* Length */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   length = **buffer;
   (*buffer) ++;
 
@@ -1301,6 +1307,9 @@ asn1_get_oid(
   int          number;                 /* OID number */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   valend = *buffer + length;
   oidptr = oid;
   oidend = oid + oidsize - 1;
@@ -1349,9 +1358,12 @@ asn1_get_packed(
   int  value;                          /* Value */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   value = 0;
 
-  while ((**buffer & 128) && *buffer < bufend)
+  while (*buffer < bufend && (**buffer & 128))
   {
     value = (value << 7) | (**buffer & 127);
     (*buffer) ++;
@@ -1379,6 +1391,9 @@ asn1_get_string(
     char          *string,             /* I  - String buffer */
     size_t        strsize)             /* I  - String buffer size */
 {
+  if (*buffer >= bufend)
+    return (NULL);
+
   if (length > (unsigned)(bufend - *buffer))
     length = (unsigned)(bufend - *buffer);
 
@@ -1421,6 +1436,9 @@ asn1_get_type(unsigned char **buffer,     /* IO - Pointer in buffer */
   int  type;                           /* Type */
 
 
+  if (*buffer >= bufend)
+    return (0);
+
   type = **buffer;
   (*buffer) ++;
 

diff --git a/scheduler/client.c b/scheduler/client.c
index a21b909a8cd7d76c087e410504dea27a1f0f3973..68050804727f3a71a6dc5ffec91876db23409f67 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -568,6 +568,17 @@ cupsdReadClient(cupsd_client_t *con)       /* I - Client to read from */
 
   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "cupsdReadClient: error=%d, used=%d, state=%s, data_encoding=HTTP_ENCODING_%s, data_remaining=" CUPS_LLFMT ", request=%p(%s), file=%d", httpError(con->http), (int)httpGetReady(con->http), httpStateString(httpGetState(con->http)), httpIsChunked(con->http) ? "CHUNKED" : "LENGTH", CUPS_LLCAST httpGetRemaining(con->http), con->request, con->request ? ippStateString(ippGetState(con->request)) : "", con->file);
 
+  if (httpError(con->http) == EPIPE && !httpGetReady(con->http) && recv(httpGetFd(con->http), buf, 1, MSG_PEEK) < 1)
+  {
+   /*
+    * Connection closed...
+    */
+
+    cupsdLogClient(con, CUPSD_LOG_DEBUG, "Closing on EOF.");
+    cupsdCloseClient(con);
+    return;
+  }
+
   if (httpGetState(con->http) == HTTP_STATE_GET_SEND ||
       httpGetState(con->http) == HTTP_STATE_POST_SEND ||
       httpGetState(con->http) == HTTP_STATE_STATUS)
@@ -577,17 +588,6 @@ cupsdReadClient(cupsd_client_t *con)       /* I - Client to read from */
     * connection and we need to shut it down...
     */
 
-    if (!httpGetReady(con->http) && recv(httpGetFd(con->http), buf, 1, MSG_PEEK) < 1)
-    {
-     /*
-      * Connection closed...
-      */
-
-      cupsdLogClient(con, CUPSD_LOG_DEBUG, "Closing on EOF.");
-      cupsdCloseClient(con);
-      return;
-    }
-
     cupsdLogClient(con, CUPSD_LOG_DEBUG, "Closing on unexpected HTTP read state %s.", httpStateString(httpGetState(con->http)));
     cupsdCloseClient(con);
     return;
@@ -2209,6 +2209,7 @@ cupsdSendError(cupsd_client_t *con,       /* I - Connection */
   strlcpy(location, httpGetField(con->http, HTTP_FIELD_LOCATION), sizeof(location));
 
   httpClearFields(con->http);
+  httpClearCookie(con->http);
 
   httpSetField(con->http, HTTP_FIELD_LOCATION, location);