package/cups-filters: upstream patch CVE-2025-64503

This fixes the following vulnerability:

- CVE-2025-64503:
    cups-filters contains backends, filters, and other software required
    to get the cups printing service working on operating systems other
    than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
    with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
    `pdftoraster` tool to write beyond the bounds of an array. First, a
    PDF with a large `MediaBox` width value causes `header.cupsWidth` to
    become large.  Next, the calculation of `bytesPerLine =
    (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
    resulting in a small value. Then, `lineBuf` is allocated with the
    small `bytesPerLine` size. Finally, `convertLineChunked` calls
    `writePixel8`, which attempts to write to `lineBuf` outside of its
    buffer size (out of bounds write). In libcupsfilters, the maintainers
    found the same `bytesPerLine` multiplication without overflow check,
    but the provided test case does not cause an overflow there, because
    the values are different. Commit
    50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
    incorporated into cups-filters version 1.28.18.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-64503
  - 50d94ca0f2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/cups-filters/0005-fix-out-of-bounds-write-in-pdftoraster.patch

@@ -0,0 +1,41 @@
+From 50d94ca0f2fa6177613c97c59791bde568631865 Mon Sep 17 00:00:00 2001
+From: Till Kamppeter <till.kamppeter@gmail.com>
+Date: Mon, 10 Nov 2025 18:31:48 +0100
+Subject: [PATCH] Fix out-of-bounds write in pdftoraster
+
+PDFs with too large page dimensions could cause an integer overflow and then a too small buffer for the pixel line to be allocated.
+
+Fixed this by cropping the page size to the maximum allowed by the standard, 14400x14400pt, 200x200in, 5x5m
+
+https://community.adobe.com/t5/indesign-discussions/maximum-width-of-a-pdf/td-p/9217372
+
+CVE: CVE-2025-64503
+Upstream: https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ filter/pdftoraster.cxx | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/filter/pdftoraster.cxx b/filter/pdftoraster.cxx
+index 7b3af924f..b64b34c62 100755
+--- a/filter/pdftoraster.cxx
++++ b/filter/pdftoraster.cxx
+@@ -1698,6 +1698,18 @@ static void outPage(poppler::document *doc, int pageNo,
+     header.PageSize[0] = (unsigned)l;
+   else
+     header.PageSize[1] = (unsigned)l;
++  /*
++    Maximum allowed page size for PDF is 200x200 inches (~ 5x5 m), or 14400x14400 pt
++    https://community.adobe.com/t5/indesign-discussions/maximum-width-of-a-pdf/td-p/9217372
++  */
++  if (header.PageSize[0] > 14400) {
++    fprintf(stderr, "ERROR: Page width is %dpt, too large, cropping to 14400pt\n", header.PageSize[0]);
++    header.PageSize[0] = 14400;
++  }
++  if (header.PageSize[1] > 14400) {
++    fprintf(stderr, "ERROR: Page height is %dpt, too large, cropping to 14400pt\n", header.PageSize[1]);
++    header.PageSize[1] = 14400;
++  }
+ 
+   memset(paperdimensions, 0, sizeof(paperdimensions));
+   memset(margins, 0, sizeof(margins));

package/cups-filters/cups-filters.mk

@@ -21,6 +21,9 @@ CUPS_FILTERS_IGNORE_CVES += CVE-2023-24805
 # 0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch
 CUPS_FILTERS_IGNORE_CVES += CVE-2025-64524
 
+# 0005-fix-out-of-bounds-write-in-pdftoraster.patch
+CUPS_FILTERS_IGNORE_CVES += CVE-2025-64503
+
 CUPS_FILTERS_DEPENDENCIES = cups libglib2 lcms2 qpdf fontconfig freetype jpeg
 
 CUPS_FILTERS_CONF_OPTS = \