From 55c80fdfb379c74c7f7e8c260dea02e0150d7614 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 30 Dec 2023 17:58:08 +0100 Subject: [PATCH] package/cups: bump to version 2.4.7 Drop fifth patch (already in version) https://github.com/OpenPrinting/cups/releases/tag/v2.4.7 Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni --- ...raster-interpret.c-Fix-CVE-2023-4504.patch | 45 ------------------- package/cups/cups.hash | 2 +- package/cups/cups.mk | 5 +-- 3 files changed, 2 insertions(+), 50 deletions(-) delete mode 100644 package/cups/0005-raster-interpret.c-Fix-CVE-2023-4504.patch diff --git a/package/cups/0005-raster-interpret.c-Fix-CVE-2023-4504.patch b/package/cups/0005-raster-interpret.c-Fix-CVE-2023-4504.patch deleted file mode 100644 index d1dff4e1fa..0000000000 --- a/package/cups/0005-raster-interpret.c-Fix-CVE-2023-4504.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 2431caddb7e6a87f04ac90b5c6366ad268b6ff31 Mon Sep 17 00:00:00 2001 -From: Zdenek Dohnal -Date: Wed, 20 Sep 2023 14:45:17 +0200 -Subject: [PATCH] raster-interpret.c: Fix CVE-2023-4504 - -We didn't check for end of buffer if it looks there is an escaped -character - check for NULL terminator there and if found, return NULL -as return value and in `ptr`, because a lone backslash is not -a valid PostScript character. - -Upstream: https://github.com/OpenPrinting/cups/commit/2431caddb7e6a87f04ac90b5c6366ad268b6ff31 -[Peter: drop CHANGES hunk] -Signed-off-by: Peter Korsgaard ---- - cups/raster-interpret.c | 14 +++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - -diff --git a/cups/raster-interpret.c b/cups/raster-interpret.c -index 6fcf731b5..b8655c8c6 100644 ---- a/cups/raster-interpret.c -+++ b/cups/raster-interpret.c -@@ -1116,7 +1116,19 @@ scan_ps(_cups_ps_stack_t *st, /* I - Stack */ - - cur ++; - -- if (*cur == 'b') -+ /* -+ * Return NULL if we reached NULL terminator, a lone backslash -+ * is not a valid character in PostScript. -+ */ -+ -+ if (!*cur) -+ { -+ *ptr = NULL; -+ -+ return (NULL); -+ } -+ -+ if (*cur == 'b') - *valptr++ = '\b'; - else if (*cur == 'f') - *valptr++ = '\f'; --- -2.30.2 - diff --git a/package/cups/cups.hash b/package/cups/cups.hash index 501d8c12a6..2d7bbf1aa9 100644 --- a/package/cups/cups.hash +++ b/package/cups/cups.hash @@ -1,4 +1,4 @@ # Locally calculated: -sha256 58e970cf1955e1cc87d0847c32526d9c2ccee335e5f0e3882b283138ba0e7262 cups-2.4.6-source.tar.gz +sha256 dd54228dd903526428ce7e37961afaed230ad310788141da75cebaa08362cf6c cups-2.4.7-source.tar.gz sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 LICENSE sha256 5320b6e3c252423e4153eb2dd63e57e3b630afb21139f44e43b02d85fe33e279 NOTICE diff --git a/package/cups/cups.mk b/package/cups/cups.mk index 4bc5eeedee..2ad5eeb5cf 100644 --- a/package/cups/cups.mk +++ b/package/cups/cups.mk @@ -4,7 +4,7 @@ # ################################################################################ -CUPS_VERSION = 2.4.6 +CUPS_VERSION = 2.4.7 CUPS_SOURCE = cups-$(CUPS_VERSION)-source.tar.gz CUPS_SITE = https://github.com/OpenPrinting/cups/releases/download/v$(CUPS_VERSION) CUPS_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception @@ -13,9 +13,6 @@ CUPS_CPE_ID_VENDOR = openprinting CUPS_SELINUX_MODULES = cups CUPS_INSTALL_STAGING = YES -# 0005-raster-interpret.c-Fix-CVE-2023-4504.patch -CUPS_IGNORE_CVES += CVE-2023-4504 - # Using autoconf, not autoheader, so we cannot use AUTORECONF = YES. define CUPS_RUN_AUTOCONF cd $(@D); $(AUTOCONF) -f