From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Wed, 20 Sep 2023 12:45:17 +0000 (+0200)
Subject: raster-interpret.c: Fix CVE-2023-4504
X-Git-Tag: v2.4.7~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2431caddb7e6a87f04ac90b5c6366ad268b6ff31;p=thirdparty%2Fcups.git

raster-interpret.c: Fix CVE-2023-4504

We didn't check for end of buffer if it looks there is an escaped
character - check for NULL terminator there and if found, return NULL
as return value and in `ptr`, because a lone backslash is not
a valid PostScript character.
---

diff --git a/CHANGES.md b/CHANGES.md
index 632e508210..b192616dea 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -4,6 +4,8 @@ CHANGES - OpenPrinting CUPS 2.4.7 - TBA
 Changes in CUPS v2.4.7 (TBA)
 -----------------------------------
 
+- CVE-2023-4504 - Fixed Heap-based buffer overflow when reading Postscript
+  in PPD files
 - Added OpenSSL support for cupsHashData (Issue #762)
 - Fixed delays in lpd backend (Issue #741)
 - Fixed extensive logging in scheduler (Issue #604)
diff --git a/cups/raster-interpret.c b/cups/raster-interpret.c
index 6fcf731b57..b8655c8c67 100644
--- a/cups/raster-interpret.c
+++ b/cups/raster-interpret.c
@@ -1116,7 +1116,19 @@ scan_ps(_cups_ps_stack_t *st,		/* I  - Stack */
 
 	    cur ++;
 
-            if (*cur == 'b')
+	   /*
+	    * Return NULL if we reached NULL terminator, a lone backslash
+	    * is not a valid character in PostScript.
+	    */
+
+	    if (!*cur)
+	    {
+	      *ptr = NULL;
+
+	      return (NULL);
+	    }
+
+	    if (*cur == 'b')
 	      *valptr++ = '\b';
 	    else if (*cur == 'f')
 	      *valptr++ = '\f';