[gentoo-commits] gentoo-x86 commit in net-print/cups/files: cups-1.3.8-CVE-2008-3641.patch cups-1.3.8-CVE-2008-3640.patch cups-1.3.8-str2924.patch cups-1.3.8-CVE-2008-3639.patch

[Timo Gurr (tgurr)]

tgurr       08/10/10 19:38:50

  Added:                cups-1.3.8-CVE-2008-3641.patch
                        cups-1.3.8-CVE-2008-3640.patch
                        cups-1.3.8-str2924.patch
                        cups-1.3.8-CVE-2008-3639.patch
  Log:
  Bump CUPS to new version 1.3.9 and revision 1.3.8-r2 to address some security issues, bug #238976 and fix the broken desktop file, bug #236706 (Thanks to Pacho Ramos). Remove keywords on 1.2.12 to prevent users from installing a unsecure CUPS version.
  (Portage version: 2.2_rc12/cvs/Linux 2.6.26-gentoo-r1 x86_64, RepoMan options: --force)

Revision  Changes    Path
1.1                  net-print/cups/files/cups-1.3.8-CVE-2008-3641.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3641.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3641.patch?rev=1.1&content-type=text/plain

Index: cups-1.3.8-CVE-2008-3641.patch
===================================================================
Index: cups-1.3.8/filter/hpgl-attr.c
===================================================================
--- cups-1.3.8.orig/filter/hpgl-attr.c
+++ cups-1.3.8/filter/hpgl-attr.c
@@ -197,8 +197,18 @@ NP_number_pens(int     num_params,	/* I 
 
   if (num_params == 0)
     PenCount = 8;
-  else if (num_params == 1 && params[0].value.number <= 1024)
-    PenCount = (int)params[0].value.number;
+  else if (num_params == 1)
+  {
+    if (params[0].value.number < 1 || params[0].value.number > MAX_PENS)
+    {
+      fprintf(stderr,
+	      "DEBUG: HP-GL/2 \'NP\' command with invalid number of "
+	      "pens (%d)!\n", (int)params[0].value.number);
+      PenCount = 8;
+    }
+    else
+      PenCount = (int)params[0].value.number;
+  }
   else
     fprintf(stderr,
             "DEBUG: HP-GL/2 \'NP\' command with invalid number of "
@@ -235,7 +245,7 @@ PC_pen_color(int     num_params,	/* I - 
 
   if (num_params == 0)
   {
-    for (i = 0; i <= PenCount; i ++)
+    for (i = 0; i < PenCount; i ++)
       if (i < 8)
       {
         Pens[i].rgb[0] = standard_colors[i][0];
@@ -256,7 +266,14 @@ PC_pen_color(int     num_params,	/* I - 
   }
   else if (num_params == 1 || num_params == 4)
   {
-    i = (int)params[0].value.number;
+    i = (int)params[0].value.number - 1;
+
+    if (i < 0 || i >= PenCount)
+    {
+      fprintf(stderr,
+              "DEBUG: HP-GL/2 \'PC\' command with invalid pen (%d)!\n", i + 1);
+      return;
+    }
 
     if (num_params == 1)
     {
@@ -330,7 +347,15 @@ PW_pen_width(int     num_params,	/* I - 
 
   if (num_params == 2)
   {
-    pen = (int)params[1].value.number;
+    pen = (int)params[1].value.number - 1;
+
+    if (pen < 0 || pen >= PenCount)
+    {
+      fprintf(stderr,
+              "DEBUG: HP-GL/2 \'PW\' command with invalid pen (%d)!\n",
+	      pen + 1);
+      return;
+    }
 
     Pens[pen].width = w;
 
@@ -345,7 +370,7 @@ PW_pen_width(int     num_params,	/* I - 
     * Set width for all pens...
     */
 
-    for (pen = 0; pen <= PenCount; pen ++)
+    for (pen = 0; pen < PenCount; pen ++)
       Pens[pen].width = w;
 
     if (PageDirty)
@@ -399,14 +424,16 @@ SP_select_pen(int     num_params,	/* I -
               param_t *params)		/* I - Parameters */
 {
   if (num_params == 0)
-    PenNumber = 1;
-  else if (params[0].value.number <= PenCount)
-    PenNumber = (int)params[0].value.number;
-  else
+    PenNumber = 0;
+  else if (num_params > 1)
     fprintf(stderr,
-            "DEBUG: HP-GL/2 \'SP\' command with invalid number or value "
-	    "of parameters (%d, %d)!\n", num_params,
+            "DEBUG: HP-GL/2 \'SP\' command with invalid number of parameters "
+	    "(%d)!\n", num_params);
+  else if (params[0].value.number <= 0 || params[0].value.number >= PenCount)
+    fprintf(stderr, "DEBUG: HP-GL/2 \'SP\' command with invalid pen (%d)!\n",
 	    (int)params[0].value.number);
+  else
+    PenNumber = (int)params[0].value.number - 1;
 
   if (PageDirty)
     printf("%.3f %.3f %.3f %.2f SP\n", Pens[PenNumber].rgb[0],
Index: cups-1.3.8/filter/hpgltops.h
===================================================================
--- cups-1.3.8.orig/filter/hpgltops.h
+++ cups-1.3.8/filter/hpgltops.h
@@ -26,6 +26,14 @@
 #  define M_PI	3.14159265358979323846
 #endif /* M_PI */
 
+
+/*
+ * Maximum number of pens we emulate...
+ */
+
+#define MAX_PENS	1024
+
+
 /*
  * Parameter value structure...
  */
@@ -108,10 +116,10 @@ VAR float	PenPosition[2]	VALUE2(0.0f, 0.
 						/* Current pen position */
 		PenScaling	VALUE(1.0f),	/* Pen width scaling factor */
 		PenWidth	VALUE(1.0f);	/* Default pen width */
-VAR pen_t	Pens[1024];			/* State of each pen */
+VAR pen_t	Pens[MAX_PENS];			/* State of each pen */
 VAR int		PenMotion	VALUE(0), 	/* 0 = absolute, 1 = relative */
 		PenValid	VALUE(0),	/* 1 = valid position, 0 = undefined */
-		PenNumber	VALUE(1),	/* Current pen number */
+		PenNumber	VALUE(0),	/* Current pen number */
 		PenCount	VALUE(8),	/* Number of pens */
 		PenDown		VALUE(0),	/* 0 = pen up, 1 = pen down */
 		PolygonMode	VALUE(0),	/* Drawing polygons? */



1.1                  net-print/cups/files/cups-1.3.8-CVE-2008-3640.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3640.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3640.patch?rev=1.1&content-type=text/plain

Index: cups-1.3.8-CVE-2008-3640.patch
===================================================================
Index: cups-1.3.8/filter/texttops.c
===================================================================
--- cups-1.3.8.orig/filter/texttops.c
+++ cups-1.3.8/filter/texttops.c
@@ -173,6 +173,14 @@ WriteProlog(const char *title,		/* I - T
   SizeColumns = (PageRight - PageLeft) / 72.0 * CharsPerInch;
   SizeLines   = (PageTop - PageBottom) / 72.0 * LinesPerInch;
 
+  if (SizeColumns <= 0 || SizeColumns > 32767 ||
+      SizeLines <= 0 || SizeLines > 32767)
+  {
+    _cupsLangPrintf(stderr, _("ERROR: Unable to print %dx%d text page!\n"),
+                    SizeColumns, SizeLines);
+    exit(1);
+  }
+
   Page    = calloc(sizeof(lchar_t *), SizeLines);
   Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
   for (i = 1; i < SizeLines; i ++)
@@ -187,6 +195,13 @@ WriteProlog(const char *title,		/* I - T
   else
     ColumnWidth = SizeColumns;
 
+  if (ColumnWidth <= 0)
+  {
+    _cupsLangPrintf(stderr, _("ERROR: Unable to print %d text columns!\n"),
+                    PageColumns);
+    exit(1);
+  }
+
  /*
   * Output the DSC header...
   */
Index: cups-1.3.8/filter/textcommon.c
===================================================================
--- cups-1.3.8.orig/filter/textcommon.c
+++ cups-1.3.8/filter/textcommon.c
@@ -3,7 +3,7 @@
  *
  *   Common text filter routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -605,14 +605,38 @@ TextMain(const char *name,	/* I - Name o
                 !strcasecmp(val, "yes");
 
   if ((val = cupsGetOption("columns", num_options, options)) != NULL)
+  {
     PageColumns = atoi(val);
 
+    if (PageColumns < 1)
+    {
+      _cupsLangPrintf(stderr, _("ERROR: Bad columns value %d!\n"), PageColumns);
+      return (1);
+    }
+  }
+
   if ((val = cupsGetOption("cpi", num_options, options)) != NULL)
+  {
     CharsPerInch = atof(val);
 
+    if (CharsPerInch <= 0.0)
+    {
+      _cupsLangPrintf(stderr, _("ERROR: Bad cpi value %f!\n"), CharsPerInch);
+      return (1);
+    }
+  }
+
   if ((val = cupsGetOption("lpi", num_options, options)) != NULL)
+  {
     LinesPerInch = atof(val);
 
+    if (LinesPerInch <= 0.0)
+    {
+      _cupsLangPrintf(stderr, _("ERROR: Bad lpi value %f!\n"), LinesPerInch);
+      return (1);
+    }
+  }
+
   if (PrettyPrint)
     PageTop -= 216.0f / LinesPerInch;
 



1.1                  net-print/cups/files/cups-1.3.8-str2924.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-str2924.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-str2924.patch?rev=1.1&content-type=text/plain

Index: cups-1.3.8-str2924.patch
===================================================================
Index: desktop/cups.desktop
===================================================================
--- desktop/cups.desktop	(revision 7908)
+++ desktop/cups.desktop	(working copy)
@@ -1,41 +1,33 @@
 [Desktop Entry]
-Categories=Application;System;X-Red-Hat-Base;
-Encoding=UTF-8
+Categories=System;Printing;HardwareSettings;X-Red-Hat-Base;
 Exec=htmlview http://localhost:631/
-GenericName=
 Icon=cups
-MimeType=
-Path=
 StartupNotify=false
 Terminal=false
-TerminalOptions=
 Type=Application
-X-DCOP-ServiceType=
-X-KDE-SubstituteUID=false
-X-KDE-Username=
 Name=Manage Printing
 Comment=CUPS Web Interface
-Name[de]=Druckerverwaltung
-Comment[de]=CUPS Webinterface
-Name[en_US]=Manage Printing
-Comment[en_US]=CUPS Web Interface
-Name[es]=Administrar impresión
-Comment[es]=Interfaz Web de CUPS
-Name[et]=Trükkimise haldur
-Comment[et]=CUPS-i veebiliides
-Name[fr]=Gestionnaire d'impression
-Comment[fr]=Interface Web de CUPS
-Name[he]=נהל הדפסות
-Comment[he]=ממשק דפדפן של CUPS
-Name[id]=Manajemen Pencetakan
-Comment[id]=Antarmuka Web CUPS
-Name[it]=Gestione stampa
-Comment[it]=Interfaccia web di CUPS
-Name[ja]=印刷の管理
-Comment[ja]=CUPS Web インタフェース
-Name[pl]=Zarządzanie drukowaniem
-Comment[pl]=Interfejs WWW CUPS
-Name[zh]=打印机管理
-Comment[zh]=CUPS网页界面
-Name[zh_TW]=印表管理
-Comment[zh_TW]=CUPS 網頁介面
+Name[de.UTF-8]=Druckerverwaltung
+Comment[de.UTF-8]=CUPS Webinterface
+Name[en_US.UTF-8]=Manage Printing
+Comment[en_US.UTF-8]=CUPS Web Interface
+Name[es.UTF-8]=Administrar impresión
+Comment[es.UTF-8]=Interfaz Web de CUPS
+Name[et.UTF-8]=Trükkimise haldur
+Comment[et.UTF-8]=CUPS-i veebiliides
+Name[fr.UTF-8]=Gestionnaire d'impression
+Comment[fr.UTF-8]=Interface Web de CUPS
+Name[he.UTF-8]=נהל הדפסות
+Comment[he.UTF-8]=ממשק דפדפן של CUPS
+Name[id.UTF-8]=Manajemen Pencetakan
+Comment[id.UTF-8]=Antarmuka Web CUPS
+Name[it.UTF-8]=Gestione stampa
+Comment[it.UTF-8]=Interfaccia web di CUPS
+Name[ja.UTF-8]=印刷の管理
+Comment[ja.UTF-8]=CUPS Web インタフェース
+Name[pl.UTF-8]=Zarządzanie drukowaniem
+Comment[pl.UTF-8]=Interfejs WWW CUPS
+Name[zh.UTF-8]=打印机管理
+Comment[zh.UTF-8]=CUPS网页界面
+Name[zh_TW.UTF-8]=印表管理
+Comment[zh_TW.UTF-8]=CUPS 網頁介面



1.1                  net-print/cups/files/cups-1.3.8-CVE-2008-3639.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3639.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/net-print/cups/files/cups-1.3.8-CVE-2008-3639.patch?rev=1.1&content-type=text/plain

Index: cups-1.3.8-CVE-2008-3639.patch
===================================================================
Index: cups-1.3.8/filter/image-sgilib.c
===================================================================
--- cups-1.3.8.orig/filter/image-sgilib.c
+++ cups-1.3.8/filter/image-sgilib.c
@@ -640,13 +640,14 @@ read_rle8(FILE           *fp,		/* I - Fi
     if (ch & 128)
     {
       for (i = 0; i < count; i ++, row ++, xsize --, length ++)
-        *row = getc(fp);
+        if (xsize > 0)
+	  *row = getc(fp);
     }
     else
     {
       ch = getc(fp);
       length ++;
-      for (i = 0; i < count; i ++, row ++, xsize --)
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --)
         *row = ch;
     }
   }
@@ -685,14 +686,15 @@ read_rle16(FILE           *fp,		/* I - F
     if (ch & 128)
     {
       for (i = 0; i < count; i ++, row ++, xsize --, length ++)
-        *row = getshort(fp);
+        if (xsize > 0)
+	  *row = getshort(fp);
     }
     else
     {
       ch = getshort(fp);
       length ++;
-      for (i = 0; i < count; i ++, row ++, xsize --)
-        *row = ch;
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --)
+	*row = ch;
     }
   }