2150035 - [abrt] cups-filters: __strlen_avx2(): cups-browsed killed by SIGSEGV

0001-beh-backend-Use-execv-instead-of-system-CVE-2023-248.patch

@@ -0,0 +1,208 @@
+From 93e60d3df358c0ae6f3dba79e1c9684657683d89 Mon Sep 17 00:00:00 2001
+From: Till Kamppeter <till.kamppeter@gmail.com>
+Date: Wed, 17 May 2023 11:11:29 +0200
+Subject: [PATCH] beh backend: Use execv() instead of system() - CVE-2023-24805
+
+With execv() command line arguments are passed as separate strings and
+not the full command line in a single string. This prevents arbitrary
+command execution by escaping the quoting of the arguments in a job
+with a forged job title.
+
+In addition, done the following fixes and improvements:
+
+- Do not allow '/' in the scheme of the URI (= backend executable
+  name), to assure that only backends inside /usr/lib/cups/backend/
+  are used.
+
+- URI must have ':', to split off scheme, otherwise error out.
+
+- Check return value of snprintf() to create call path for backend, to
+  error out on truncation of a too long scheme or on complete failure
+  due to a completely odd scheme.
+
+- Use strncat() instead of strncpy() for getting scheme from URI, the latter
+  does not require setting terminating zero byte in case of truncation.
+
+- Also exclude "." or ".." as scheme, as directories are not valid CUPS
+  backends.
+
+- Do not use fprintf() in sigterm_handler(), to not interfere with a
+  fprintf() which could be running in the main process when
+  sigterm_handler() is triggered.
+
+- Use "static volatile int" for global variable job_canceled.
+---
+ backend/beh.c | 107 +++++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 84 insertions(+), 23 deletions(-)
+
+diff --git a/backend/beh.c b/backend/beh.c
+index 225fd27d5..8d51235b1 100644
+--- a/backend/beh.c
++++ b/backend/beh.c
+@@ -22,12 +22,13 @@
+ #include "backend-private.h"
+ #include <cups/array.h>
+ #include <ctype.h>
++#include <sys/wait.h>
+ 
+ /*
+  * Local globals...
+  */
+ 
+-static int		job_canceled = 0; /* Set to 1 on SIGTERM */
++static volatile int	job_canceled = 0; /* Set to 1 on SIGTERM */
+ 
+ /*
+  * Local functions...
+@@ -213,21 +214,40 @@ call_backend(char *uri,                 /* I - URI of final destination */
+ 	     char **argv,		/* I - Command-line arguments */
+ 	     char *filename) {          /* I - File name of input data */
+   const char	*cups_serverbin;	/* Location of programs */
++  char          *backend_argv[8];	/* Arguments for backend */
+   char		scheme[1024],           /* Scheme from URI */
+                 *ptr,			/* Pointer into scheme */
+-		cmdline[65536];		/* Backend command line */
+-  int           retval;
++		backend_path[2048];	/* Backend path */
++  int           pid = 0, 		/* Process ID of backend */
++                wait_pid,		/* Process ID from wait() */
++                wait_status, 		/* Status from child */
++                retval = 0;
++  int           bytes;
+ 
+  /*
+   * Build the backend command line...
+   */
+ 
+-  strncpy(scheme, uri, sizeof(scheme) - 1);
+-  if (strlen(uri) > 1023)
+-    scheme[1023] = '\0';
++  scheme[0] = '\0';
++  strncat(scheme, uri, sizeof(scheme) - 1);
+   if ((ptr = strchr(scheme, ':')) != NULL)
+     *ptr = '\0';
+-
++  else {
++    fprintf(stderr,
++	    "ERROR: beh: Invalid URI, no colon (':') to mark end of scheme part.\n");
++    exit (CUPS_BACKEND_FAILED);
++  }
++  if (strchr(scheme, '/')) {
++    fprintf(stderr,
++	    "ERROR: beh: Invalid URI, scheme contains a slash ('/').\n");
++    exit (CUPS_BACKEND_FAILED);
++  }
++  if (!strcmp(scheme, ".") || !strcmp(scheme, "..")) {
++    fprintf(stderr,
++	    "ERROR: beh: Invalid URI, scheme (\"%s\") is a directory.\n",
++	    scheme);
++    exit (CUPS_BACKEND_FAILED);
++  }
+   if ((cups_serverbin = getenv("CUPS_SERVERBIN")) == NULL)
+     cups_serverbin = CUPS_SERVERBIN;
+ 
+@@ -235,16 +255,29 @@ call_backend(char *uri,                 /* I - URI of final destination */
+     fprintf(stderr,
+ 	    "ERROR: beh: Direct output into a file not supported.\n");
+     exit (CUPS_BACKEND_FAILED);
+-  } else
+-    snprintf(cmdline, sizeof(cmdline),
+-	     "%s/backend/%s '%s' '%s' '%s' '%s' '%s' %s",
+-	     cups_serverbin, scheme, argv[1], argv[2], argv[3],
+-	     /* Apply number of copies only if beh was called with a
+-		file name and not with the print data in stdin, as
+-	        backends should handle copies only if they are called
+-	        with a file name */
+-	     (argc == 6 ? "1" : argv[4]),
+-	     argv[5], filename);
++  }
++
++  backend_argv[0] = uri;
++  backend_argv[1] = argv[1];
++  backend_argv[2] = argv[2];
++  backend_argv[3] = argv[3];
++  /* Apply number of copies only if beh was called with a file name
++     and not with the print data in stdin, as backends should handle
++     copies only if they are called with a file name */
++  backend_argv[4] = (argc == 6 ? "1" : argv[4]);
++  backend_argv[5] = argv[5];
++  backend_argv[6] = filename;
++  backend_argv[7] = NULL;
++
++  bytes = snprintf(backend_path, sizeof(backend_path),
++		   "%s/backend/%s", cups_serverbin, scheme);
++  if (bytes < 0 || bytes >= sizeof(backend_path))
++  {
++    fprintf(stderr,
++	    "ERROR: beh: Invalid scheme (\"%s\"), could not determing backend path.\n",
++	    scheme);
++    return (CUPS_BACKEND_FAILED);
++  }
+ 
+  /*
+   * Overwrite the device URI and run the actual backend...
+@@ -253,18 +286,44 @@ call_backend(char *uri,                 /* I - URI of final destination */
+   setenv("DEVICE_URI", uri, 1);
+ 
+   fprintf(stderr,
+-	  "DEBUG: beh: Executing backend command line \"%s\"...\n",
+-	  cmdline);
++	  "DEBUG: beh: Executing backend command line \"%s '%s' '%s' '%s' '%s' '%s' %s\"...\n",
++	  backend_path, backend_argv[1], backend_argv[2], backend_argv[3],
++	  backend_argv[4], backend_argv[5], backend_argv[6]);
+   fprintf(stderr,
+ 	  "DEBUG: beh: Using device URI: %s\n",
+ 	  uri);
+ 
+-  retval = system(cmdline) >> 8;
++  if ((pid = fork()) == 0) {
++   /*
++    * Child comes here...
++    */
++
++    /* Run the backend */
++    execv(backend_path, backend_argv);
+ 
+-  if (retval == -1)
+     fprintf(stderr, "ERROR: Unable to execute backend command line: %s\n",
+ 	    strerror(errno));
+ 
++    exit(1);
++  } else if (pid < 0) {
++   /*
++    * Unable to fork!
++    */
++
++    return (CUPS_BACKEND_FAILED);
++  }
++
++  while ((wait_pid = wait(&wait_status)) < 0 && errno == EINTR);
++
++  if (wait_pid >= 0 && wait_status) {
++    if (WIFEXITED(wait_status))
++      retval = WEXITSTATUS(wait_status);
++    else if (WTERMSIG(wait_status) != SIGTERM)
++      retval = WTERMSIG(wait_status);
++    else
++      retval = 0;
++  }
++
+   return (retval);
+ }
+ 
+@@ -277,8 +336,10 @@ static void
+ sigterm_handler(int sig) {		/* I - Signal number (unused) */
+   (void)sig;
+ 
+-  fprintf(stderr,
+-	  "DEBUG: beh: Job canceled.\n");
++  const char * const msg = "DEBUG: beh: Job canceled.\n";
++  /* The if() is to eliminate the return value and silence the warning
++     about an unused return value. */
++  if (write(2, msg, strlen(msg)));
+ 
+   if (job_canceled)
+     _exit(CUPS_BACKEND_OK);
+-- 
+2.40.1
+

0001-cups-browsed.c-Ensure-we-always-send-a-valid-name-to.patch

@@ -0,0 +1,24 @@
+diff --git a/utils/cups-browsed.c b/utils/cups-browsed.c
+index 79ece21..80c76d8 100644
+--- a/utils/cups-browsed.c
++++ b/utils/cups-browsed.c
+@@ -5841,10 +5841,18 @@ get_local_queue_name(const char *service_name,
+ 	 make/model info */
+       queue_name = remove_bad_chars(make_model, 0);
+     else if (LocalQueueNamingRemoteCUPS == LOCAL_QUEUE_NAMING_REMOTE_NAME)
++    {
+       /* Not directly used in script generation input later, but taken from
+ 	 packet, so better safe than sorry. (consider second loop with
+ 	 backup_queue_name) */
+-      queue_name = remove_bad_chars(strrchr(resource, '/') + 1, 0);
++
++     /* We can get resource without / or without string after / - use
++      * the original string (possible trailing / will be removed) */
++      if ((str = strrchr(resource, '/')) == NULL || strlen(str) <= 1)
++	str = resource;
++
++      queue_name = remove_bad_chars(str, 0);
++    }
+     else
+       /* Convert DNS-SD service name into a CUPS queue name exactly
+ 	 as CUPS would do it, to override CUPS' own temporary queue

cups-filters.spec

@@ -4,7 +4,7 @@
 Summary: OpenPrinting CUPS filters and backends
 Name:    cups-filters
 Version: 1.28.16
-Release: 2%{?dist}
+Release: 5%{?dist}
 
 # For a breakdown of the licensing, see COPYING file
 # GPLv2:   filters: commandto*, imagetoraster, pdftops, rasterto*,
@@ -19,9 +19,13 @@ License: GPLv2 and GPLv2+ and GPLv3 and GPLv3+ and LGPLv2+ and MIT and BSD with
 
 Url:     http://www.linuxfoundation.org/collaborate/workgroups/openprinting/cups-filters
 Source0: http://www.openprinting.org/download/cups-filters/cups-filters-%{version}.tar.xz
+Source1: lftocrlf.ppd
+Source2: lftocrlf
 
 # backported from upstream
 Patch0001: browsed-updatenetif.patch
+Patch0002: 0001-beh-backend-Use-execv-instead-of-system-CVE-2023-248.patch
+Patch0003: 0001-cups-browsed.c-Ensure-we-always-send-a-valid-name-to.patch
 
 
 # autogen.sh
@@ -206,6 +210,10 @@ The package provides filters and cups-brf backend needed for braille printing.
 %install
 %make_install
 
+# 2229776 - Add textonly driver back, but as lftocrlf
+install -p -m 0755 %{SOURCE2} %{buildroot}%{_cups_serverbin}/filter/lftocrlf
+install -p -m 0644 %{SOURCE1} %{buildroot}%{_datadir}/ppd/cupsfilters/lftocrlf.ppd
+
 # Don't ship libtool la files.
 rm -f %{buildroot}%{_libdir}/lib*.la
 
@@ -285,6 +293,8 @@ done
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetopdf
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetops
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetoraster
+# 2229776 - Add textonly driver back, but as lftocrlf
+%attr(0755,root,root) %{_cups_serverbin}/filter/lftocrlf
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftopdf
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftops
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftoraster
@@ -378,6 +388,15 @@ done
 %{_datadir}/cups/mime/braille.types
 
 %changelog
+* Tue Aug 29 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.16-5
+- 2150035 - [abrt] cups-filters: __strlen_avx2(): cups-browsed killed by SIGSEGV
+
+* Mon Aug 07 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.16-4
+- 2229776 - Add textonly driver back as lftocrlf driver
+
+* Wed May 17 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.16-3
+- 2207970 - CVE-2023-24805 cups-filters: remote code execution in cups-filters, beh CUPS backend
+
 * Wed Sep 21 2022 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.16-2
 - disable frequent network interface data update, which slows down the queue creation
 

lftocrlf

@@ -0,0 +1,124 @@
+#!/bin/bash
+## Copyright (C) 2003-2006 Red Hat, Inc.
+## Copyright (C) 2003-2006 Tim Waugh <twaugh@redhat.com>
+## Changed on 2007/05/17, Opher Shachar, LADPC Ltd.
+##     Added support for page-ranges option.
+##     Added page accounting.
+
+## This program is free software; you can redistribute it and/or
+## modify it under the terms of the GNU General Public License
+## as published by the Free Software Foundation; either version 2
+## of the License, or (at your option) any later version.
+
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+if [ $# == 0 ]; then
+  echo >&2 "ERROR: $0 job-id user title copies options [file]"
+  exit 1
+fi
+
+# Extract the papersize
+SENDFF=`grep '^\*DefaultSendFF' "$PPD" | cut -d\  -f2`
+COPIES=1
+if [ $# -ge 4 ]; then
+  COPIES="$4"
+fi
+
+if [ $# -lt 6 ]; then
+  unset TMPFILE
+  trap -- 'rm -f "$TMPFILE"' EXIT
+  TMPFILE=$(mktemp ${TMPDIR:-/tmp}/lftocrlf.XXXXXX)
+  cat > "$TMPFILE"
+else
+  TMPFILE="$6"
+fi
+
+PR=${5#*page-ranges=}
+# Do options specify page-ranges?
+if [[ "$PR" != "$5" ]]; then
+  PR=${PR%% *}
+else
+  #unset PR
+  PR=1-999999
+fi
+
+if [[ "$PR" ]]; then
+  TMPFILE2=$(mktemp ${TMPDIR:-/tmp}/lftocrlf2.XXXXXX)
+  pagenum=0
+  EOF=
+  { 
+  while [[ "$PR" ]]; do
+    pl=${PR%%,*}		;# take first subrange
+    PR=${PR#$pl};PR=${PR#,}	;# remove from range list
+    pu=${pl#*-}			;# extract upper and lower
+    pl=${pl%-*}			;# pages of subrange
+    # Allows interpreting 0-5,3-10 as 1-5,6-10 rejects 5-1 or 1-
+    (( pagenum >= pl )) && pl=$(( pagenum + 1 ))
+    (( pl > pu )) && continue
+    
+    # Loop reading pages until at or over lower page of subrange.
+    while read -d `echo -ne '\f'` -r; do
+      (( pagenum++ ))
+      (( pagenum == pl )) && break
+    done
+    # Did we reach lower page of subrange or EOF?
+    if (( pagenum < pl )); then
+      [[ ! "$REPLY" ]] && break		;# empty last page - we're done.
+      (( pagenum++ ))
+      EOF=y
+    fi
+    # Output page and report to page log
+    if (( pagenum == pl )); then
+      echo -n "${REPLY}" >>"$TMPFILE2"
+      # If EOF then page has no final FF
+      [[ ! "$EOF" ]] && echo -ne '\f' >>"$TMPFILE2"
+      echo "PAGE: $pagenum $COPIES" >&2
+    fi
+    [[ "$EOF" ]] && break
+    # Is the current subrange a single page?
+    (( pagenum == pu )) && continue
+    while read -d `echo -ne '\f'` -r; do
+      (( pagenum++ ))
+      echo -ne "${REPLY}\f" >>"$TMPFILE2"
+      echo "PAGE: $pagenum $COPIES" >&2
+      (( pagenum == pu )) && break
+    done
+    # Could be that we reached EOF before page boundry
+    if (( pagenum < pu )); then
+      if [[ "$REPLY" ]]; then
+        (( pagenum++ ))
+        echo -n "${REPLY}" >>"$TMPFILE2"
+        echo "PAGE: $pagenum $COPIES" >&2
+      fi
+      break
+    fi
+  done
+  } <"$TMPFILE"
+else
+  TMPFILE2="$TMPFILE"
+  pc=$(grep -co `echo -ne '\f'` "$TMPFILE2")
+  pc=$(( pc * $COPIES ))
+  echo "PAGE: $pc" >&2
+fi
+
+while [ "$COPIES" -gt 0 ]; do
+  # Just translate LF->CRLF at the moment, until the PPD has options added.
+  sed -e 's/$/'`echo -ne '\r'`'/g' "$TMPFILE2"
+
+  if [ "$SENDFF" == "True" ]
+    then
+    echo -ne \\014
+  fi
+
+  COPIES=$(($COPIES - 1))
+done
+# Cleanup
+[[ "$TMPFILE" != "$TMPFILE2" ]] && rm -f "$TMPFILE2"
+exit 0

lftocrlf.ppd

@@ -0,0 +1,47 @@
+*PPD-Adobe: "4.3"
+*%
+*% Text-only printer definition
+*%
+*FormatVersion:	"4.3"
+*FileVersion:	"1.1"
+*LanguageVersion: English
+*LanguageEncoding: ISOLatin1
+*PCFileName:	"LFTOCRLF.PPD"
+*Manufacturer:	"Generic"
+*Product:	"(Generic)"
+*cupsVersion:   1.0
+*cupsManualCopies: True
+*cupsModelNumber:  2
+*cupsFilter:    "text/plain 0 lftocrlf"
+*ModelName:     "Generic LF-to-CRLF printer"
+*ShortNickName: "Generic LF-to-CRLF printer"
+*NickName:      "Generic LF-to-CRLF printer"
+*PSVersion:	"(2017.000) 0"
+*LanguageLevel:	"2"
+*ColorDevice:	False
+*DefaultColorSpace: Gray
+*FileSystem:	False
+*Throughput:	"8"
+*LandscapeOrientation: Plus90
+*VariablePaperSize: False
+*TTRasterizer:	Type42
+*DefaultImageableArea: Letter
+*ImageableArea Letter/US Letter:	"18 36 594 756"
+*DefaultPaperDimension: Letter
+*PaperDimension Letter/Letter:		"612 792"
+*OpenUI *PageSize/Media Size: PickOne
+*OrderDependency: 10 AnySetup *PageSize
+*DefaultPageSize: Letter
+*PageSize Letter/Letter:	"<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
+*CloseUI: *PageSize
+*OpenUI *PageRegion: PickOne
+*OrderDependency: 10 AnySetup *PageRegion
+*DefaultPageRegion: Letter
+*PageRegion Letter/Letter:	"<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
+*CloseUI: *PageRegion
+
+*OpenUI *SendFF: Boolean
+*DefaultSendFF: False
+*SendFF True/True:        ""
+*SendFF False/False:   ""
+*CloseUI: *SendFF