diff options
author | Michael R Sweet <michael.r.sweet@gmail.com> | 2019-08-15 14:06:47 -0400 |
---|---|---|
committer | Michael R Sweet <michael.r.sweet@gmail.com> | 2019-08-15 14:06:47 -0400 |
commit | 2c030c7a06e0c2b8227c7e85f5c58dfb339731d0 (patch) | |
tree | 87e6adc4798757791b2782935ad5f06132283456 /cups | |
parent | d784ca2f837b6c221d97ec0850b7020d13db75a5 (diff) | |
download | cups-2c030c7a06e0c2b8227c7e85f5c58dfb339731d0.tar.gz |
Multiple security/disclosure issues:
- CVE-2019-8696 and CVE-2019-8675: Fixed SNMP buffer overflows (rdar://51685251)
- Fixed IPP buffer overflow (rdar://50035411)
- Fixed memory disclosure issue in the scheduler (rdar://51373853)
- Fixed DoS issues in the scheduler (rdar://51373929)
Diffstat (limited to 'cups')
-rw-r--r-- | cups/http.c | 9 | ||||
-rw-r--r-- | cups/ipp.c | 9 | ||||
-rw-r--r-- | cups/snmp.c | 20 |
3 files changed, 28 insertions, 10 deletions
diff --git a/cups/http.c b/cups/http.c index 266a15791..fbb1bf13c 100644 --- a/cups/http.c +++ b/cups/http.c @@ -1860,7 +1860,7 @@ httpPrintf(http_t *http, /* I - HTTP connection */ ...) /* I - Additional args as needed */ { ssize_t bytes; /* Number of bytes to write */ - char buf[16384]; /* Buffer for formatted string */ + char buf[65536]; /* Buffer for formatted string */ va_list ap; /* Variable argument pointer */ @@ -1872,7 +1872,12 @@ httpPrintf(http_t *http, /* I - HTTP connection */ DEBUG_printf(("3httpPrintf: (" CUPS_LLFMT " bytes) %s", CUPS_LLCAST bytes, buf)); - if (http->data_encoding == HTTP_ENCODING_FIELDS) + if (bytes > (ssize_t)(sizeof(buf) - 1)) + { + http->error = ENOMEM; + return (-1); + } + else if (http->data_encoding == HTTP_ENCODING_FIELDS) return ((int)httpWrite2(http, buf, (size_t)bytes)); else { diff --git a/cups/ipp.c b/cups/ipp.c index 6fae52a00..1bd59cef1 100644 --- a/cups/ipp.c +++ b/cups/ipp.c @@ -4550,9 +4550,7 @@ ippSetValueTag( break; case IPP_TAG_NAME : - if (temp_tag != IPP_TAG_KEYWORD && temp_tag != IPP_TAG_URI && - temp_tag != IPP_TAG_URISCHEME && temp_tag != IPP_TAG_LANGUAGE && - temp_tag != IPP_TAG_MIMETYPE) + if (temp_tag != IPP_TAG_KEYWORD) return (0); (*attr)->value_tag = (ipp_tag_t)(IPP_TAG_NAME | ((*attr)->value_tag & IPP_TAG_CUPS_CONST)); @@ -4560,10 +4558,7 @@ ippSetValueTag( case IPP_TAG_NAMELANG : case IPP_TAG_TEXTLANG : - if (value_tag == IPP_TAG_NAMELANG && - (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD && - temp_tag != IPP_TAG_URI && temp_tag != IPP_TAG_URISCHEME && - temp_tag != IPP_TAG_LANGUAGE && temp_tag != IPP_TAG_MIMETYPE)) + if (value_tag == IPP_TAG_NAMELANG && (temp_tag != IPP_TAG_NAME && temp_tag != IPP_TAG_KEYWORD)) return (0); if (value_tag == IPP_TAG_TEXTLANG && temp_tag != IPP_TAG_TEXT) diff --git a/cups/snmp.c b/cups/snmp.c index 5cefee454..1d9da01f2 100644 --- a/cups/snmp.c +++ b/cups/snmp.c @@ -1233,6 +1233,9 @@ asn1_get_integer( int value; /* Integer value */ + if (*buffer >= bufend) + return (0); + if (length > sizeof(int)) { (*buffer) += length; @@ -1259,6 +1262,9 @@ asn1_get_length(unsigned char **buffer, /* IO - Pointer in buffer */ unsigned length; /* Length */ + if (*buffer >= bufend) + return (0); + length = **buffer; (*buffer) ++; @@ -1301,6 +1307,9 @@ asn1_get_oid( int number; /* OID number */ + if (*buffer >= bufend) + return (0); + valend = *buffer + length; oidptr = oid; oidend = oid + oidsize - 1; @@ -1349,9 +1358,12 @@ asn1_get_packed( int value; /* Value */ + if (*buffer >= bufend) + return (0); + value = 0; - while ((**buffer & 128) && *buffer < bufend) + while (*buffer < bufend && (**buffer & 128)) { value = (value << 7) | (**buffer & 127); (*buffer) ++; @@ -1379,6 +1391,9 @@ asn1_get_string( char *string, /* I - String buffer */ size_t strsize) /* I - String buffer size */ { + if (*buffer >= bufend) + return (NULL); + if (length > (unsigned)(bufend - *buffer)) length = (unsigned)(bufend - *buffer); @@ -1421,6 +1436,9 @@ asn1_get_type(unsigned char **buffer, /* IO - Pointer in buffer */ int type; /* Type */ + if (*buffer >= bufend) + return (0); + type = **buffer; (*buffer) ++; |