zdohnal [Thu, 4 Dec 2025 07:49:19 +0000 (08:49 +0100)]
conf.c: Fix stopping scheduler on unknown directive
Change the return value to do not trigger stopping the scheduler in case of unknown directive, because stopping the scheduler on config errors should only happen in case of syntax errors.
Lenar Shakirov [Wed, 3 Dec 2025 15:17:09 +0000 (18:17 +0300)]
new usb quirk: no-alt-set - won't even try set_conf or set_int_alt_set
new usb quirk: no-alt-set - won't even try libusb_set_configuration or libusb_set_interface_alt_setting
I noticed that sometimes garbage is printed with my
Samsung ProXpress M3870FD, this happens most often
if the printer has gone to sleep (after 1 min by default).
So if I print something 10 times, I get garbage 3-4 times.
After month of investigating I found that Samsung devices
don't like libusb_set_configuration or
libusb_set_interface_alt_setting.
My device:
04e8:3460 Samsung Electronics Co., Ltd M337x 387x 407x Series
Zdenek Dohnal [Wed, 3 Dec 2025 15:12:54 +0000 (16:12 +0100)]
conf.c: Fix stopping scheduler on unknown directive
Change the return value to do not trigger stopping the scheduler in case
of unknown directive, because stopping the scheduler on config errors
should only happen in case of syntax errors.
zdohnal [Wed, 3 Dec 2025 11:55:30 +0000 (12:55 +0100)]
http.c: Fix infinite loop in GTK apps
GTK has a specific IPP processing which stopped working after
CVE-2025-58436 fix. GTK depends on internal behavior of `_httpUpdate()`
which read a line from connection at the start of function, which was
one of culprits behind CVE-2025-58436.
To mitigate CVE-2025-58436 `_httpUpdate()` started to read from
connection only if there was data in internal HTTP buffer and there
was at least one newline buffered - otherwise the function returns
HTTP_ERROR/HTTP_CONTINUE, which caused the loop in GTK.
The change which fixes GTK behavior in the PR is to read data from
connection at the start of `_httpUpdate()` for non-blocking connections
immediately with no timeout if internal HTTP buffer is not full. The
change mitigates the CVE as well as the previous implementation.
Zdenek Dohnal [Wed, 3 Dec 2025 08:39:02 +0000 (09:39 +0100)]
http.c: Fix infinite loop in GTK print dialog
GTK has a specific IPP processing which stopped working after
CVE-2025-58436 fix. GTK depends on internal behavior of `_httpUpdate()`
which read a line from connection at the start of function, which was
one of culprits behind CVE-2025-58436.
To mitigate CVE-2025-58436 `_httpUpdate()` started to read from
connection only if there was data in internal HTTP buffer and there
was at least one newline buffered - otherwise the function returns
HTTP_ERROR/HTTP_CONTINUE, which caused the loop in GTK.
The change which fixes GTK behavior in the PR is to read data from
connection at the start of `_httpUpdate()` for non-blocking connections
immediately with no timeout if internal HTTP buffer is not full. The
change mitigates the CVE as well as the previous implementation.
Michael R Sweet [Fri, 21 Nov 2025 06:29:53 +0000 (07:29 +0100)]
Fix various issues in cupsd
Various issues were found by @SilverPlate3, recognized as CVE-2025-61915:
- out of bound write when handling IPv6 addresses,
- cupsd crash caused by null dereference when ErrorPolicy value is empty,
On the top of that, Mike Sweet noticed vulnerability via domain socket,
exploitable locally if attacker has access to domain socket and knows username
of user within a group which is present in CUPS system groups:
- rewrite of cupsd.conf via PeerCred authorization via domain socket
The last vulnerability is fixed by introducing PeerCred directive for cups-files.conf,
which controls whether PeerCred is enabled/disabled for user in CUPS system groups.
Michael R Sweet [Tue, 18 Nov 2025 16:14:27 +0000 (17:14 +0100)]
Fix unresponsive cupsd process caused by a slow client
If client is very slow, it will slow cupsd process for other clients.
The fix is the best effort without turning scheduler cupsd into
multithreaded process which would be too complex and error-prone when
backporting to 2.4.x series.
The fix for unencrypted communication is to follow up on communication
only if there is the whole line on input, and the waiting time is
guarded by timeout.
Encrypted communication now starts after we have the whole client hello
packet, which conflicts with optional upgrade support to HTTPS via
methods other than method OPTIONS, so this optional support defined in
RFC 2817, section 3.1 is removed. Too slow or incomplete requests are
handled by connection timeout.
Michael R Sweet [Wed, 12 Nov 2025 21:48:32 +0000 (16:48 -0500)]
Add a new mimeGetFilterTypes function for getting the list of supported document
formats for a printer. The new algorithm is O(n log n) vs. the old O(n^4) (Issue #1392)
Michael R Sweet [Fri, 17 Oct 2025 17:30:00 +0000 (13:30 -0400)]
Update MIME unit test:
- Use test-internal.h header.
- Add support for finding list of source formats for a given dest
format, like cupsd does, and include timing information.
- Migrate to C99 comments.
- Modernize CUPS array API usage.
projects / thirdparty / cups.git / log
