Compare commits
202 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
41507f739c | ||
|
|
a7475c5579 | ||
|
|
a8ee5f8620 | ||
|
|
18de77feb8 | ||
|
|
398b8d5a28 | ||
|
|
480a0f0325 | ||
|
|
66a0dd1a21 | ||
|
|
c1695f504f | ||
|
|
b7ff25e58f | ||
|
|
dbeabdf333 | ||
|
|
1b3fda0c3a | ||
|
|
e1f2a90397 | ||
|
|
076e45cca6 | ||
|
|
c869cf5c9b | ||
|
|
c6632c6f3d | ||
|
|
2b363dc375 | ||
|
|
03fb9b0bd1 | ||
|
|
519dbe7090 | ||
|
|
4e647ff37f | ||
|
|
fdab9d0e8f | ||
|
|
ccbeab52d9 | ||
|
|
393fd69e1d | ||
|
|
1c4f6516ea | ||
|
|
87de6c1b71 | ||
|
|
8b92a1c707 | ||
|
|
67255d297e | ||
|
|
7ae4e25c32 | ||
|
|
f3cae0b36d | ||
|
|
5586866204 | ||
|
|
a5ecb63ada | ||
|
|
7883e3153a | ||
|
|
f0c5de2a54 | ||
|
|
8f9f9c570a | ||
|
|
e6af6aa338 | ||
|
|
45d85af8c2 | ||
|
|
5e7f450887 | ||
|
|
efb7d03fdc | ||
|
|
2b31ce337d | ||
|
|
d3304142ee | ||
|
|
177ffd57f4 | ||
|
|
91d4f55012 | ||
|
|
ad798b5ac0 | ||
|
|
6ac942088c | ||
|
|
ba20eaa5fa | ||
|
|
7b818ff3e9 | ||
|
|
06431fc214 | ||
|
|
c7f670cf9b | ||
|
|
662860bd6d | ||
|
|
62dde7da62 | ||
|
|
6ea383d6ac | ||
|
|
d0a8a52f31 | ||
|
|
86b38d6d57 | ||
|
|
15366e173e | ||
|
|
2c091ba0e4 | ||
|
|
67ee5bbd71 | ||
|
|
ca565205ee | ||
|
|
6e20b40da9 | ||
|
|
faec0dbe07 | ||
|
|
226ec8183a | ||
|
|
948b35290b | ||
|
|
5210c94838 | ||
|
|
73dbd2a677 | ||
|
|
9809963904 | ||
|
|
14621a6e82 | ||
|
|
4ac3a5a53f | ||
|
|
0874da6cc2 | ||
|
|
670e73ad82 | ||
|
|
925c0f3f69 | ||
|
|
5cab1ec88e | ||
|
|
5aab7baafb | ||
|
|
d17a3ad727 | ||
|
|
84a28971d9 | ||
|
|
b712bd6dba | ||
|
|
d456002635 | ||
|
|
3f27a10b68 | ||
|
|
0ffeb35189 | ||
|
|
fe20c1aeb6 | ||
|
|
8404225612 | ||
|
|
7975201239 | ||
|
|
0423ef0468 | ||
|
|
f08a23d0dd | ||
|
|
0b4e8e3f04 | ||
|
|
a2ea1b6f10 | ||
|
|
3a7b047594 | ||
|
|
5d1b2b21fe | ||
|
|
6a6ba51b99 | ||
|
|
d613403cce | ||
|
|
12bd665536 | ||
|
|
7f6989d5c2 | ||
|
|
0a471b82f7 | ||
|
|
d6cf1a69c5 | ||
|
|
08a1bd7590 | ||
|
|
3b950f0025 | ||
|
|
91fd1dacc7 | ||
|
|
1b2594f02a | ||
|
|
47bca23058 | ||
|
|
649f2110e9 | ||
|
|
9003c6ec4b | ||
|
|
592296aa15 | ||
|
|
f282cc8514 | ||
|
|
63ff06c16a | ||
|
|
e0f5d959cd | ||
|
|
bb10dc7b6f | ||
|
|
970239102a | ||
|
|
9866ec1f82 | ||
|
|
a784c2a3f0 | ||
|
|
5b19b86468 | ||
|
|
f62a89ac90 | ||
|
|
401449b6bf | ||
|
|
5ab9f50bd8 | ||
|
|
2ef13432e5 | ||
|
|
69c633e97b | ||
|
|
1fc0a67de9 | ||
|
|
890dbaf30a | ||
|
|
39704fa792 | ||
|
|
3606bde648 | ||
|
|
3154c5b1e8 | ||
|
|
b970f11618 | ||
|
|
719f16e709 | ||
|
|
165fc502ac | ||
|
|
bc3414ce3e | ||
|
|
3a0eca877e | ||
|
|
0cd045c7fe | ||
|
|
3e0de52e39 | ||
|
|
5f198ebd13 | ||
|
|
1d9a177ccf | ||
|
|
c80a629db4 | ||
|
|
2bc24c38e4 | ||
|
|
a667ded3e9 | ||
|
|
8a4dc09994 | ||
|
|
f6fb823829 | ||
|
|
61e9e90047 | ||
|
|
87d6b5e0ba | ||
|
|
a568cb9b30 | ||
|
|
9b15b8eea6 | ||
|
|
6c9c9cf9f5 | ||
|
|
14b31aac55 | ||
|
|
6746325d61 | ||
|
|
63e6f8adf5 | ||
|
|
a8f75f2927 | ||
|
|
cc60395a8c |
||
|
|
0e6742b393 |
||
|
|
2010263180 | ||
|
|
6239c46f66 | ||
|
|
8ab2c03a62 | ||
|
|
ef3e4c55ce | ||
|
|
1b4fbffc07 | ||
|
|
896c4186e8 | ||
|
|
71c6baacf4 | ||
|
|
5d00506944 | ||
|
|
065cfc122f | ||
|
|
8a7e13d197 | ||
|
|
e834146303 | ||
|
|
e8b2b7289a | ||
|
|
adfe73a4b6 | ||
|
|
5a8bdd4187 | ||
|
|
7c37df15dd | ||
|
|
12094716ea | ||
|
|
b5d9adf81e | ||
|
|
eac2d98b5b | ||
|
|
1c0cb681f9 | ||
|
|
805d0c618c | ||
|
|
b28dd5f442 | ||
|
|
36a0663c97 | ||
|
|
8535a417f1 | ||
|
|
24ef2a3912 | ||
|
|
67783211e3 | ||
|
|
5e19ac79ce |
||
|
|
cf615f08f3 | ||
|
|
58bbef731c | ||
|
|
967382e737 | ||
|
|
454cc8b68d |
||
|
|
8aa69860de | ||
|
|
e831834960 | ||
|
|
38fd0c0b75 | ||
|
|
d5b8735cd1 | ||
|
|
6b99ba079f | ||
|
|
65126b9f42 | ||
|
|
46403f753d | ||
|
|
364623be37 | ||
|
|
f2aaf8837d | ||
|
|
6b4df6c249 | ||
|
|
f1894bfee4 | ||
|
|
9a46303505 | ||
|
|
ffd9d39b36 | ||
|
|
89060fc289 | ||
|
|
dc01ed7062 | ||
|
|
77f2a39db4 | ||
|
|
f6e9ef3041 | ||
|
|
69620785b0 | ||
|
|
956b8d3857 | ||
|
|
0382fae99a | ||
|
|
cb3b4680f1 | ||
|
|
74333f3c1d | ||
|
|
6a7134b511 | ||
|
|
e0b443e4e2 | ||
|
|
a28c5c1e8f | ||
|
|
1564b99c73 | ||
|
|
3a0452846e | ||
|
|
70197ea57b | ||
|
|
791cf659d4 | ||
|
|
7cf411250e |
16 changed files with 2843 additions and 320 deletions
1
.fmf/version
Normal file
1
.fmf/version
Normal file
|
|
@ -0,0 +1 @@
|
|||
1
|
||||
73
.gitignore
vendored
73
.gitignore
vendored
|
|
@ -1,72 +1 @@
|
|||
/cups-filters-1.0.20.tar.xz
|
||||
/cups-filters-1.0.22.tar.xz
|
||||
/cups-filters-1.0.23.tar.xz
|
||||
/cups-filters-1.0.24.tar.xz
|
||||
/cups-filters-1.0.25.tar.xz
|
||||
/cups-filters-1.0.28.tar.xz
|
||||
/cups-filters-1.0.29.tar.xz
|
||||
/cups-filters-1.0.30.tar.xz
|
||||
/cups-filters-1.0.31.tar.xz
|
||||
/cups-filters-1.0.32.tar.xz
|
||||
/cups-filters-1.0.33.tar.xz
|
||||
/cups-filters-1.0.34.tar.xz
|
||||
/cups-filters-1.0.35.tar.xz
|
||||
/cups-filters-1.0.36.tar.xz
|
||||
/cups-filters-1.0.37.tar.xz
|
||||
/cups-filters-1.0.38.tar.xz
|
||||
/cups-filters-1.0.39.tar.xz
|
||||
/cups-filters-1.0.40.tar.xz
|
||||
/cups-filters-1.0.41.tar.xz
|
||||
/cups-filters-1.0.42.tar.xz
|
||||
/cups-filters-1.0.43.tar.xz
|
||||
/cups-filters-1.0.44.tar.xz
|
||||
/cups-filters-1.0.45.tar.xz
|
||||
/cups-filters-1.0.46.tar.xz
|
||||
/cups-filters-1.0.47.tar.xz
|
||||
/cups-filters-1.0.48.tar.xz
|
||||
/cups-filters-1.0.49.tar.xz
|
||||
/cups-filters-1.0.50.tar.xz
|
||||
/cups-filters-1.0.51.tar.xz
|
||||
/cups-filters-1.0.52.tar.xz
|
||||
/cups-filters-1.0.53.tar.xz
|
||||
/cups-filters-1.0.54.tar.xz
|
||||
/cups-filters-1.0.55.tar.xz
|
||||
/cups-filters-1.0.58.tar.xz
|
||||
/cups-filters-1.0.59.tar.xz
|
||||
/cups-filters-1.0.60.tar.xz
|
||||
/cups-filters-1.0.61.tar.xz
|
||||
/cups-filters-1.0.65.tar.xz
|
||||
/cups-filters-1.0.66.tar.xz
|
||||
/cups-filters-1.0.67.tar.xz
|
||||
/cups-filters-1.0.68.tar.xz
|
||||
/cups-filters-1.0.69.tar.xz
|
||||
/cups-filters-1.0.70.tar.xz
|
||||
/cups-filters-1.0.71.tar.xz
|
||||
/cups-filters-1.0.73.tar.xz
|
||||
/cups-filters-1.0.74.tar.xz
|
||||
/cups-filters-1.0.75.tar.xz
|
||||
/cups-filters-1.0.76.tar.xz
|
||||
/cups-filters-1.1.0.tar.xz
|
||||
/cups-filters-1.2.0.tar.xz
|
||||
/cups-filters-1.3.0.tar.xz
|
||||
/cups-filters-1.4.0.tar.xz
|
||||
/cups-filters-1.5.0.tar.xz
|
||||
/cups-filters-1.6.0.tar.xz
|
||||
/cups-filters-1.7.0.tar.xz
|
||||
/cups-filters-1.8.0.tar.xz
|
||||
/cups-filters-1.8.1.tar.xz
|
||||
/cups-filters-1.8.2.tar.xz
|
||||
/cups-filters-1.8.3.tar.xz
|
||||
/cups-filters-1.9.0.tar.xz
|
||||
/cups-filters-1.10.0.tar.xz
|
||||
/cups-filters-1.11.2.tar.xz
|
||||
/cups-filters-1.11.3.tar.xz
|
||||
/cups-filters-1.11.4.tar.xz
|
||||
/cups-filters-1.11.5.tar.xz
|
||||
/cups-filters-1.11.6.tar.xz
|
||||
/cups-filters-1.12.0.tar.xz
|
||||
/cups-filters-1.13.0.tar.xz
|
||||
/cups-filters-1.13.1.tar.xz
|
||||
/cups-filters-1.13.2.tar.xz
|
||||
/cups-filters-1.13.3.tar.xz
|
||||
/cups-filters-1.13.4.tar.xz
|
||||
/cups-filters-*.tar.gz
|
||||
|
|
|
|||
27
0001-Fix-build-failure-with-GCC-15-and-std-c23.patch
Normal file
27
0001-Fix-build-failure-with-GCC-15-and-std-c23.patch
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
From 44f59a1aa74c48515d8feba5a61b7ea3aaa592c4 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Dohnal <zdohnal@redhat.com>
|
||||
Date: Fri, 24 Jan 2025 09:44:58 +0100
|
||||
Subject: [PATCH] Fix build failure with GCC 15 and -std=c23
|
||||
|
||||
The newest standard has more strict data type checks, function pointers
|
||||
in function prototypes have to declare data types of its arguments.
|
||||
---
|
||||
filter/foomatic-rip/process.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/filter/foomatic-rip/process.h b/filter/foomatic-rip/process.h
|
||||
index f6e15f65c..54a42923a 100644
|
||||
--- a/filter/foomatic-rip/process.h
|
||||
+++ b/filter/foomatic-rip/process.h
|
||||
@@ -18,7 +18,7 @@
|
||||
#include <sys/wait.h>
|
||||
|
||||
|
||||
-pid_t start_process(const char *name, int (*proc_func)(), void *user_arg,
|
||||
+pid_t start_process(const char *name, int (*proc_func)(FILE*, FILE*, void*), void *user_arg,
|
||||
FILE **fdin, FILE **fdout);
|
||||
pid_t start_system_process(const char *name, const char *command, FILE **fdin,
|
||||
FILE **fdout);
|
||||
--
|
||||
2.48.1
|
||||
|
||||
1485
0001-Introduce-foomatic-hash-and-reject-unauthorized-valu.patch
Normal file
1485
0001-Introduce-foomatic-hash-and-reject-unauthorized-valu.patch
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,79 @@
|
|||
From 0fe46c511e81062575b05936f804eb18c9f0a011 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Dohnal <zdohnal@redhat.com>
|
||||
Date: Wed, 12 Nov 2025 15:47:24 +0100
|
||||
Subject: [PATCH] rastertopclx.c: Fix infinite loop caused by crafted file
|
||||
|
||||
Infinite loop happened because of crafted input raster file, which led
|
||||
into heap buffer overflow of `CompressBuf` array.
|
||||
|
||||
Based on comments there should be always some `count` when compressing
|
||||
the data, and processing of crafted file ended with offset and count
|
||||
being 0.
|
||||
|
||||
Fixes CVE-2025-64524
|
||||
---
|
||||
filter/rastertopclx.c | 25 +++++++++++++++++++++++--
|
||||
1 file changed, 23 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/filter/rastertopclx.c b/filter/rastertopclx.c
|
||||
index ded86f114..39cb378bf 100644
|
||||
--- a/filter/rastertopclx.c
|
||||
+++ b/filter/rastertopclx.c
|
||||
@@ -825,10 +825,10 @@ StartPage(cf_filter_data_t *data, // I - filter data
|
||||
}
|
||||
|
||||
if (header->cupsCompression)
|
||||
- CompBuffer = malloc(DotBufferSize * 4);
|
||||
+ CompBuffer = calloc(DotBufferSize * 4, sizeof(unsigned char));
|
||||
|
||||
if (header->cupsCompression >= 3)
|
||||
- SeedBuffer = malloc(DotBufferSize);
|
||||
+ SeedBuffer = calloc(DotBufferSize, sizeof(unsigned char));
|
||||
|
||||
SeedInvalid = 1;
|
||||
|
||||
@@ -1159,6 +1159,13 @@ CompressData(unsigned char *line, // I - Data to compress
|
||||
seed ++;
|
||||
count ++;
|
||||
}
|
||||
+
|
||||
+ //
|
||||
+ // Bail out if we don't have count to compress
|
||||
+ //
|
||||
+
|
||||
+ if (count == 0)
|
||||
+ break;
|
||||
}
|
||||
|
||||
//
|
||||
@@ -1252,6 +1259,13 @@ CompressData(unsigned char *line, // I - Data to compress
|
||||
|
||||
count = line_ptr - start;
|
||||
|
||||
+ //
|
||||
+ // Bail out if we don't have count to compress
|
||||
+ //
|
||||
+
|
||||
+ if (count == 0)
|
||||
+ break;
|
||||
+
|
||||
#if 0
|
||||
fprintf(stderr,
|
||||
"DEBUG: offset=%d, count=%d, comp_ptr=%p(%d of %d)...\n",
|
||||
@@ -1424,6 +1438,13 @@ CompressData(unsigned char *line, // I - Data to compress
|
||||
|
||||
count = (line_ptr - start) / 3;
|
||||
|
||||
+ //
|
||||
+ // Bail out if we don't have count to compress
|
||||
+ //
|
||||
+
|
||||
+ if (count == 0)
|
||||
+ break;
|
||||
+
|
||||
//
|
||||
// Place mode 10 compression data in the buffer; each sequence
|
||||
// starts with a command byte that looks like:
|
||||
--
|
||||
2.51.1
|
||||
|
||||
1
ci.fmf
Normal file
1
ci.fmf
Normal file
|
|
@ -0,0 +1 @@
|
|||
resultsdb-testcase: separate
|
||||
BIN
cups-filters-1.28.13.tar.xz
Normal file
BIN
cups-filters-1.28.13.tar.xz
Normal file
Binary file not shown.
|
|
@ -1,42 +0,0 @@
|
|||
diff -up cups-filters-1.13.4/utils/cups-browsed.c.apremotequeueid cups-filters-1.13.4/utils/cups-browsed.c
|
||||
--- cups-filters-1.13.4/utils/cups-browsed.c.apremotequeueid 2017-02-24 12:14:22.099865138 +0100
|
||||
+++ cups-filters-1.13.4/utils/cups-browsed.c 2017-02-24 12:18:44.039943820 +0100
|
||||
@@ -1,4 +1,4 @@
|
||||
-/***
|
||||
+ /***
|
||||
This file is part of cups-filters.
|
||||
|
||||
This file is free software; you can redistribute it and/or modify it
|
||||
@@ -3491,7 +3491,8 @@ gboolean handle_cups_queues(gpointer unu
|
||||
cups_job_t *jobs;
|
||||
ipp_t *request;
|
||||
time_t current_time = time(NULL);
|
||||
- int i, new_cupsfilter_line_inserted, cont_line_read, want_raw;
|
||||
+ int i, new_cupsfilter_line_inserted, ap_remote_queue_id_line_inserted,
|
||||
+ cont_line_read, want_raw;
|
||||
char *disabled_str, *ptr, *prefix;
|
||||
const char *loadedppd = NULL;
|
||||
int pass_through_ppd;
|
||||
@@ -3813,6 +3814,7 @@ gboolean handle_cups_queues(gpointer unu
|
||||
" and inhibiting client-side filtering of the job" : ""),
|
||||
buf);
|
||||
new_cupsfilter_line_inserted = 0;
|
||||
+ ap_remote_queue_id_line_inserted = 0;
|
||||
cont_line_read = 0;
|
||||
while (cupsFileGets(in, line, sizeof(line))) {
|
||||
if (pass_through_ppd == 1 &&
|
||||
@@ -3896,6 +3898,14 @@ gboolean handle_cups_queues(gpointer unu
|
||||
cupsFilePrintf(out, "%s\n", line);
|
||||
} else if (cont_line_read == 0 || strncmp(line, "*End", 4)) {
|
||||
cont_line_read = 0;
|
||||
+ /* Write an "APRemoteQueueID" line to make this queue marked
|
||||
+ as remote printer by CUPS */
|
||||
+ if (strncmp(line, "*%", 2) &&
|
||||
+ strncmp(line, "*PPD-Adobe:", 11) &&
|
||||
+ ap_remote_queue_id_line_inserted == 0) {
|
||||
+ ap_remote_queue_id_line_inserted = 1;
|
||||
+ cupsFilePrintf(out, "*APRemoteQueueID: \"\"\n");
|
||||
+ }
|
||||
/* Simply write out the line as we read it */
|
||||
cupsFilePrintf(out, "%s\n", line);
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
13
foomatic-ripdie-error.patch
Normal file
13
foomatic-ripdie-error.patch
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
diff --git a/filter/foomatic-rip/util.c b/filter/foomatic-rip/util.c
|
||||
index 508bc09..ad79fbf 100644
|
||||
--- a/filter/foomatic-rip/util.c
|
||||
+++ b/filter/foomatic-rip/util.c
|
||||
@@ -76,7 +76,7 @@ rip_die(int status,
|
||||
{
|
||||
va_list ap;
|
||||
|
||||
- _log("Process is dying with \"");
|
||||
+ _log("ERROR: Process is dying with \"");
|
||||
va_start(ap, msg);
|
||||
_logv(msg, ap);
|
||||
va_end(ap);
|
||||
188
foomaticrip-reject-unknown-values.patch
Normal file
188
foomaticrip-reject-unknown-values.patch
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
From 41c5f2f6139e4d3693c2483ee4281202a80ae451 Mon Sep 17 00:00:00 2001
|
||||
From: zdohnal <zdohnal@redhat.com>
|
||||
Date: Tue, 22 Jul 2025 15:12:19 +0200
|
||||
Subject: [PATCH] Introduce foomatic-hash and reject unauthorized values in
|
||||
foomatic-rip (#648)
|
||||
|
||||
The change provides a way for users to have control over what values are
|
||||
allowed for the foomatic-rip-related PPD keywords FoomaticRIPCommandLine,
|
||||
FoomaticRIPCommandLinePDF, and FoomaticRIPOptionSetting. Since the
|
||||
values can be later used when constructing a shell command, the filter
|
||||
foomatic-rip was a target of several exploits (caused by issues at
|
||||
different places in CUPS or in different projects of the printing stack) to
|
||||
do arbitrary code execution when the filter is used.
|
||||
|
||||
By default the filter is run by user lp, so the issue is mitigated, but
|
||||
this PR gives admin complete control over what can be run in
|
||||
foomatic-rip and reject anything injected into system via different
|
||||
ways.
|
||||
|
||||
First, the new tool - foomatic-hash - can be called on a PPD file or
|
||||
directory with drivers/PPDs, with scan output and file with hexadecimal
|
||||
representation of hashed values. Once the scan output is reviewed by
|
||||
admin, admin can decide to put the resulting hashes into
|
||||
/etc/foomatic/hashes.d and allow them for the filter.
|
||||
---
|
||||
Makefile.am | 44 ++-
|
||||
README.md | 23 ++
|
||||
configure.ac | 2 +-
|
||||
filter/foomatic-rip/foomatic-hash.1 | 66 ++++
|
||||
filter/foomatic-rip/foomatic-hash.c | 549 ++++++++++++++++++++++++++
|
||||
filter/foomatic-rip/foomatic-rip.1.in | 16 +
|
||||
filter/foomatic-rip/foomaticrip.c | 75 ----
|
||||
filter/foomatic-rip/foomaticrip.h | 40 --
|
||||
filter/foomatic-rip/options.c | 67 ++++
|
||||
filter/foomatic-rip/process.c | 9 +
|
||||
filter/foomatic-rip/process.h | 3 +
|
||||
filter/foomatic-rip/util.c | 341 +++++++++++++++-
|
||||
filter/foomatic-rip/util.h | 67 ++++
|
||||
13 files changed, 1178 insertions(+), 124 deletions(-)
|
||||
create mode 100644 filter/foomatic-rip/foomatic-hash.1
|
||||
create mode 100644 filter/foomatic-rip/foomatic-hash.c
|
||||
|
||||
diff --git a/filter/foomatic-rip/foomatic-rip.1.in b/filter/foomatic-rip/foomatic-rip.1.in
|
||||
index 9685a95f5..3dff5215f 100644
|
||||
--- a/filter/foomatic-rip/foomatic-rip.1.in
|
||||
+++ b/filter/foomatic-rip/foomatic-rip.1.in
|
||||
@@ -193,6 +193,15 @@ friends. Several PPD files use shell constructs that require a more
|
||||
modern shell like \fBbash\fR, \fBzsh\fR, or \fBksh\fR.
|
||||
|
||||
|
||||
+.SH PPD OPTION VALUE RESTRICTIONS AND EXCEPTIONS
|
||||
+
|
||||
+The values of PPD options \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR and \fBFoomaticRIPOptionSetting\fR
|
||||
+are rejected in the default configuration because of security implications. Users can use the tool \fBfoomatic-hash(1)\fR, which provides
|
||||
+values of affected PPD options from found drivers and hashes of those values in hexadecimal format. User is expected to review the found values,
|
||||
+and if there is nothing suspicious in the output, copy the file with hashes into into the directory \fB@sysconfdir@/foomatic/hashes.d\fR
|
||||
+to allow the exceptions for found values.
|
||||
+
|
||||
+
|
||||
.SH FILES
|
||||
.PD 0
|
||||
.TP 0
|
||||
@@ -209,6 +218,13 @@ The PPD files of the currently defined printers
|
||||
|
||||
Configuration file for foomatic-rip
|
||||
|
||||
+.TP 0
|
||||
+@sysconfdir@/foomatic/hashes.d
|
||||
+.TP 0
|
||||
+@datadir@/foomatic/hashes.d
|
||||
+
|
||||
+Directories with hashes of allowed values
|
||||
+
|
||||
.PD 0
|
||||
|
||||
.\".SH SEE ALSO
|
||||
diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
|
||||
index bad833bc1..032fe9ec3 100644
|
||||
--- a/filter/foomatic-rip/options.c
|
||||
+++ b/filter/foomatic-rip/options.c
|
||||
@@ -102,6 +102,42 @@ get_icc_profile_for_qualifier(const char **qualifier)
|
||||
}
|
||||
|
||||
|
||||
+//
|
||||
+// 'is_allowed_value' - Check if the option value is allowed.
|
||||
+//
|
||||
+
|
||||
+int // O - Boolean value - true 1 / false 0
|
||||
+is_allowed_value(cups_array_t *ar, // I - Array of already known hashes from system
|
||||
+ char *value, // I - Scanned value from PPD file
|
||||
+ size_t value_len) // I - Value length
|
||||
+{
|
||||
+ char hash_string[65]; // Help array to store hexadecimal hashed string
|
||||
+
|
||||
+ //
|
||||
+ // Empty string is allowed...
|
||||
+ //
|
||||
+
|
||||
+ if (!value_len)
|
||||
+ return (1);
|
||||
+
|
||||
+ //
|
||||
+ // Hash the value and get hexadecimal string for it...
|
||||
+ //
|
||||
+
|
||||
+ if (hash_data((unsigned char*)value, value_len, hash_string, sizeof(hash_string)))
|
||||
+ return (0);
|
||||
+
|
||||
+ //
|
||||
+ // Check if the found hexadecimal hashed string is in the array -> allowed on the system...
|
||||
+ //
|
||||
+
|
||||
+ if (cupsArrayFind(ar, hash_string))
|
||||
+ return (1);
|
||||
+
|
||||
+ return (0);
|
||||
+}
|
||||
+
|
||||
+
|
||||
// a selector is a general tri-dotted specification.
|
||||
// The 2nd and 3rd elements of the qualifier are optionally modified by
|
||||
// cupsICCQualifier2 and cupsICCQualifier3:
|
||||
@@ -1866,12 +1902,19 @@ read_ppd_file(const char *filename)
|
||||
option_t *opt, *current_opt = NULL;
|
||||
param_t *param;
|
||||
icc_mapping_entry_t *entry;
|
||||
+ cups_array_t *known_hashes = NULL;
|
||||
|
||||
fh = fopen(filename, "r");
|
||||
if (!fh)
|
||||
rip_die(EXIT_PRNERR_NORETRY_BAD_SETTINGS, "Unable to open PPD file %s\n", filename);
|
||||
_log("Parsing PPD file ...\n");
|
||||
|
||||
+ if (load_system_hashes(&known_hashes))
|
||||
+ {
|
||||
+ fclose(fh);
|
||||
+ rip_die(EXIT_PRNERR_NORETRY, "Not enough memory for array allocation\n.");
|
||||
+ }
|
||||
+
|
||||
dstrassure(value, 256);
|
||||
|
||||
qualifier_data = list_create();
|
||||
@@ -1955,10 +1998,26 @@ read_ppd_file(const char *filename)
|
||||
}
|
||||
else if (strcmp(key, "FoomaticRIPCommandLine") == 0)
|
||||
{
|
||||
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
|
||||
+ {
|
||||
+ cupsArrayDelete(known_hashes);
|
||||
+ fclose(fh);
|
||||
+
|
||||
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
|
||||
+ }
|
||||
+
|
||||
unhtmlify(cmd, 4096, value->data);
|
||||
}
|
||||
else if (strcmp(key, "FoomaticRIPCommandLinePDF") == 0)
|
||||
{
|
||||
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
|
||||
+ {
|
||||
+ cupsArrayDelete(known_hashes);
|
||||
+ fclose(fh);
|
||||
+
|
||||
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
|
||||
+ }
|
||||
+
|
||||
unhtmlify(cmd_pdf, 4096, value->data);
|
||||
}
|
||||
else if (!strcmp(key, "cupsFilter"))
|
||||
@@ -2097,6 +2156,14 @@ read_ppd_file(const char *filename)
|
||||
}
|
||||
else if (!strcmp(key, "FoomaticRIPOptionSetting"))
|
||||
{
|
||||
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
|
||||
+ {
|
||||
+ cupsArrayDelete(known_hashes);
|
||||
+ fclose(fh);
|
||||
+
|
||||
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
|
||||
+ }
|
||||
+
|
||||
// "*FoomaticRIPOptionSetting <option>[=<choice>]: <code>
|
||||
// For boolean options <choice> is not given
|
||||
option_set_choice(assure_option(name),
|
||||
--
|
||||
2.50.1
|
||||
|
||||
28
gating.yaml
Normal file
28
gating.yaml
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
--- !Policy
|
||||
product_versions:
|
||||
- fedora-*
|
||||
decision_context: bodhi_update_push_testing
|
||||
subject_type: koji_build
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
|
||||
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/cups-tier1-public.functional}
|
||||
#Rawhide
|
||||
--- !Policy
|
||||
product_versions:
|
||||
- fedora-*
|
||||
decision_context: bodhi_update_push_stable
|
||||
subject_type: koji_build
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
|
||||
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/cups-tier1-public.functional}
|
||||
|
||||
#gating rhel
|
||||
--- !Policy
|
||||
product_versions:
|
||||
- rhel-*
|
||||
decision_context: osci_compose_gate
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional}
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/cups-tier1-public.functional}
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/cups-tier1-internal.functional}
|
||||
124
lftocrlf
Normal file
124
lftocrlf
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
#!/bin/bash
|
||||
## Copyright (C) 2003-2006 Red Hat, Inc.
|
||||
## Copyright (C) 2003-2006 Tim Waugh <twaugh@redhat.com>
|
||||
## Changed on 2007/05/17, Opher Shachar, LADPC Ltd.
|
||||
## Added support for page-ranges option.
|
||||
## Added page accounting.
|
||||
|
||||
## This program is free software; you can redistribute it and/or
|
||||
## modify it under the terms of the GNU General Public License
|
||||
## as published by the Free Software Foundation; either version 2
|
||||
## of the License, or (at your option) any later version.
|
||||
|
||||
## This program is distributed in the hope that it will be useful,
|
||||
## but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
## GNU General Public License for more details.
|
||||
|
||||
## You should have received a copy of the GNU General Public License
|
||||
## along with this program; if not, write to the Free Software
|
||||
## Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||
|
||||
if [ $# == 0 ]; then
|
||||
echo >&2 "ERROR: $0 job-id user title copies options [file]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract the papersize
|
||||
SENDFF=`grep '^\*DefaultSendFF' "$PPD" | cut -d\ -f2`
|
||||
COPIES=1
|
||||
if [ $# -ge 4 ]; then
|
||||
COPIES="$4"
|
||||
fi
|
||||
|
||||
if [ $# -lt 6 ]; then
|
||||
unset TMPFILE
|
||||
trap -- 'rm -f "$TMPFILE"' EXIT
|
||||
TMPFILE=$(mktemp ${TMPDIR:-/tmp}/lftocrlf.XXXXXX)
|
||||
cat > "$TMPFILE"
|
||||
else
|
||||
TMPFILE="$6"
|
||||
fi
|
||||
|
||||
PR=${5#*page-ranges=}
|
||||
# Do options specify page-ranges?
|
||||
if [[ "$PR" != "$5" ]]; then
|
||||
PR=${PR%% *}
|
||||
else
|
||||
#unset PR
|
||||
PR=1-999999
|
||||
fi
|
||||
|
||||
if [[ "$PR" ]]; then
|
||||
TMPFILE2=$(mktemp ${TMPDIR:-/tmp}/lftocrlf2.XXXXXX)
|
||||
pagenum=0
|
||||
EOF=
|
||||
{
|
||||
while [[ "$PR" ]]; do
|
||||
pl=${PR%%,*} ;# take first subrange
|
||||
PR=${PR#$pl};PR=${PR#,} ;# remove from range list
|
||||
pu=${pl#*-} ;# extract upper and lower
|
||||
pl=${pl%-*} ;# pages of subrange
|
||||
# Allows interpreting 0-5,3-10 as 1-5,6-10 rejects 5-1 or 1-
|
||||
(( pagenum >= pl )) && pl=$(( pagenum + 1 ))
|
||||
(( pl > pu )) && continue
|
||||
|
||||
# Loop reading pages until at or over lower page of subrange.
|
||||
while read -d `echo -ne '\f'` -r; do
|
||||
(( pagenum++ ))
|
||||
(( pagenum == pl )) && break
|
||||
done
|
||||
# Did we reach lower page of subrange or EOF?
|
||||
if (( pagenum < pl )); then
|
||||
[[ ! "$REPLY" ]] && break ;# empty last page - we're done.
|
||||
(( pagenum++ ))
|
||||
EOF=y
|
||||
fi
|
||||
# Output page and report to page log
|
||||
if (( pagenum == pl )); then
|
||||
echo -n "${REPLY}" >>"$TMPFILE2"
|
||||
# If EOF then page has no final FF
|
||||
[[ ! "$EOF" ]] && echo -ne '\f' >>"$TMPFILE2"
|
||||
echo "PAGE: $pagenum $COPIES" >&2
|
||||
fi
|
||||
[[ "$EOF" ]] && break
|
||||
# Is the current subrange a single page?
|
||||
(( pagenum == pu )) && continue
|
||||
while read -d `echo -ne '\f'` -r; do
|
||||
(( pagenum++ ))
|
||||
echo -ne "${REPLY}\f" >>"$TMPFILE2"
|
||||
echo "PAGE: $pagenum $COPIES" >&2
|
||||
(( pagenum == pu )) && break
|
||||
done
|
||||
# Could be that we reached EOF before page boundry
|
||||
if (( pagenum < pu )); then
|
||||
if [[ "$REPLY" ]]; then
|
||||
(( pagenum++ ))
|
||||
echo -n "${REPLY}" >>"$TMPFILE2"
|
||||
echo "PAGE: $pagenum $COPIES" >&2
|
||||
fi
|
||||
break
|
||||
fi
|
||||
done
|
||||
} <"$TMPFILE"
|
||||
else
|
||||
TMPFILE2="$TMPFILE"
|
||||
pc=$(grep -co `echo -ne '\f'` "$TMPFILE2")
|
||||
pc=$(( pc * $COPIES ))
|
||||
echo "PAGE: $pc" >&2
|
||||
fi
|
||||
|
||||
while [ "$COPIES" -gt 0 ]; do
|
||||
# Just translate LF->CRLF at the moment, until the PPD has options added.
|
||||
sed -e 's/$/'`echo -ne '\r'`'/g' "$TMPFILE2"
|
||||
|
||||
if [ "$SENDFF" == "True" ]
|
||||
then
|
||||
echo -ne \\014
|
||||
fi
|
||||
|
||||
COPIES=$(($COPIES - 1))
|
||||
done
|
||||
# Cleanup
|
||||
[[ "$TMPFILE" != "$TMPFILE2" ]] && rm -f "$TMPFILE2"
|
||||
exit 0
|
||||
47
lftocrlf.ppd
Normal file
47
lftocrlf.ppd
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
*PPD-Adobe: "4.3"
|
||||
*%
|
||||
*% Text-only printer definition
|
||||
*%
|
||||
*FormatVersion: "4.3"
|
||||
*FileVersion: "1.1"
|
||||
*LanguageVersion: English
|
||||
*LanguageEncoding: ISOLatin1
|
||||
*PCFileName: "LFTOCRLF.PPD"
|
||||
*Manufacturer: "Generic"
|
||||
*Product: "(Generic)"
|
||||
*cupsVersion: 1.0
|
||||
*cupsManualCopies: True
|
||||
*cupsModelNumber: 2
|
||||
*cupsFilter: "text/plain 0 lftocrlf"
|
||||
*ModelName: "Generic LF-to-CRLF printer"
|
||||
*ShortNickName: "Generic LF-to-CRLF printer"
|
||||
*NickName: "Generic LF-to-CRLF printer"
|
||||
*PSVersion: "(2017.000) 0"
|
||||
*LanguageLevel: "2"
|
||||
*ColorDevice: False
|
||||
*DefaultColorSpace: Gray
|
||||
*FileSystem: False
|
||||
*Throughput: "8"
|
||||
*LandscapeOrientation: Plus90
|
||||
*VariablePaperSize: False
|
||||
*TTRasterizer: Type42
|
||||
*DefaultImageableArea: Letter
|
||||
*ImageableArea Letter/US Letter: "18 36 594 756"
|
||||
*DefaultPaperDimension: Letter
|
||||
*PaperDimension Letter/Letter: "612 792"
|
||||
*OpenUI *PageSize/Media Size: PickOne
|
||||
*OrderDependency: 10 AnySetup *PageSize
|
||||
*DefaultPageSize: Letter
|
||||
*PageSize Letter/Letter: "<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
|
||||
*CloseUI: *PageSize
|
||||
*OpenUI *PageRegion: PickOne
|
||||
*OrderDependency: 10 AnySetup *PageRegion
|
||||
*DefaultPageRegion: Letter
|
||||
*PageRegion Letter/Letter: "<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
|
||||
*CloseUI: *PageRegion
|
||||
|
||||
*OpenUI *SendFF: Boolean
|
||||
*DefaultSendFF: False
|
||||
*SendFF True/True: ""
|
||||
*SendFF False/False: ""
|
||||
*CloseUI: *SendFF
|
||||
59
plans.fmf
Normal file
59
plans.fmf
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
/tier1-internal:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/tier1/internal
|
||||
|
||||
/tier1-public:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/tier1/public
|
||||
|
||||
/tier2-tier3-internal:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/tier2-tier3/internal
|
||||
|
||||
/tier2-tier3-public:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/tier2-tier3/public
|
||||
|
||||
/others-internal:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/others/internal
|
||||
|
||||
/others-public:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/others/public
|
||||
|
||||
/multihost:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/multihost/multihost
|
||||
|
||||
/fips-internal:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups-filters.git
|
||||
name: /plans/others/fips
|
||||
|
||||
/cups-tier1-internal:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups.git
|
||||
name: /plans/tier1/internal
|
||||
|
||||
/cups-tier1-public:
|
||||
plan:
|
||||
import:
|
||||
url: https://gitlab.com/redhat/centos-stream/tests/cups.git
|
||||
name: /plans/tier1/public
|
||||
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (cups-filters-1.13.4.tar.xz) = 848451193c9f0b0f397bc2c8efafab20112525eb2357892b5c46a4900d3d7e4ef52e537353c04779de2d17c8918cb1fe653e3c8db81f6ef246deca7e4241ce3b
|
||||
SHA512 (cups-filters-2.0.1.tar.gz) = b5d7b8f5a89a6a6bba0e861dd3c3263195be75996d22129d123f325f6bff74fbabf22f2ee2d953908ffb8294d825af5568af6695896c76ef4082ae98cd19c42c
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue