From 2431caddb7e6a87f04ac90b5c6366ad268b6ff31 Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Wed, 20 Sep 2023 14:45:17 +0200 Subject: [PATCH] raster-interpret.c: Fix CVE-2023-4504 We didn't check for end of buffer if it looks there is an escaped character - check for NULL terminator there and if found, return NULL as return value and in `ptr`, because a lone backslash is not a valid PostScript character. --- CHANGES.md | 2 ++ cups/raster-interpret.c | 14 +++++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 632e508210..b192616dea 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -4,6 +4,8 @@ CHANGES - OpenPrinting CUPS 2.4.7 - TBA Changes in CUPS v2.4.7 (TBA) ----------------------------------- +- CVE-2023-4504 - Fixed Heap-based buffer overflow when reading Postscript + in PPD files - Added OpenSSL support for cupsHashData (Issue #762) - Fixed delays in lpd backend (Issue #741) - Fixed extensive logging in scheduler (Issue #604) diff --git a/cups/raster-interpret.c b/cups/raster-interpret.c index 6fcf731b57..b8655c8c67 100644 --- a/cups/raster-interpret.c +++ b/cups/raster-interpret.c @@ -1116,7 +1116,19 @@ scan_ps(_cups_ps_stack_t *st, /* I - Stack */ cur ++; - if (*cur == 'b') + /* + * Return NULL if we reached NULL terminator, a lone backslash + * is not a valid character in PostScript. + */ + + if (!*cur) + { + *ptr = NULL; + + return (NULL); + } + + if (*cur == 'b') *valptr++ = '\b'; else if (*cur == 'f') *valptr++ = '\f'; -- 2.47.2