From def2405f39f949813148cc973660845bff30b3ca Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 26 Jun 2026 22:29:59 +0200 Subject: [PATCH] package/cups-filters: upstream patch CVE-2025-64503 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes the following vulnerability: - CVE-2025-64503: cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size. Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-64503 - https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain --- ...x-out-of-bounds-write-in-pdftoraster.patch | 41 +++++++++++++++++++ package/cups-filters/cups-filters.mk | 3 ++ 2 files changed, 44 insertions(+) create mode 100644 package/cups-filters/0005-fix-out-of-bounds-write-in-pdftoraster.patch diff --git a/package/cups-filters/0005-fix-out-of-bounds-write-in-pdftoraster.patch b/package/cups-filters/0005-fix-out-of-bounds-write-in-pdftoraster.patch new file mode 100644 index 0000000000..1da04ca959 --- /dev/null +++ b/package/cups-filters/0005-fix-out-of-bounds-write-in-pdftoraster.patch @@ -0,0 +1,41 @@ +From 50d94ca0f2fa6177613c97c59791bde568631865 Mon Sep 17 00:00:00 2001 +From: Till Kamppeter +Date: Mon, 10 Nov 2025 18:31:48 +0100 +Subject: [PATCH] Fix out-of-bounds write in pdftoraster + +PDFs with too large page dimensions could cause an integer overflow and then a too small buffer for the pixel line to be allocated. + +Fixed this by cropping the page size to the maximum allowed by the standard, 14400x14400pt, 200x200in, 5x5m + +https://community.adobe.com/t5/indesign-discussions/maximum-width-of-a-pdf/td-p/9217372 + +CVE: CVE-2025-64503 +Upstream: https://github.com/OpenPrinting/cups-filters/commit/50d94ca0f2fa6177613c97c59791bde568631865 +Signed-off-by: Thomas Perale +--- + filter/pdftoraster.cxx | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/filter/pdftoraster.cxx b/filter/pdftoraster.cxx +index 7b3af924f..b64b34c62 100755 +--- a/filter/pdftoraster.cxx ++++ b/filter/pdftoraster.cxx +@@ -1698,6 +1698,18 @@ static void outPage(poppler::document *doc, int pageNo, + header.PageSize[0] = (unsigned)l; + else + header.PageSize[1] = (unsigned)l; ++ /* ++ Maximum allowed page size for PDF is 200x200 inches (~ 5x5 m), or 14400x14400 pt ++ https://community.adobe.com/t5/indesign-discussions/maximum-width-of-a-pdf/td-p/9217372 ++ */ ++ if (header.PageSize[0] > 14400) { ++ fprintf(stderr, "ERROR: Page width is %dpt, too large, cropping to 14400pt\n", header.PageSize[0]); ++ header.PageSize[0] = 14400; ++ } ++ if (header.PageSize[1] > 14400) { ++ fprintf(stderr, "ERROR: Page height is %dpt, too large, cropping to 14400pt\n", header.PageSize[1]); ++ header.PageSize[1] = 14400; ++ } + + memset(paperdimensions, 0, sizeof(paperdimensions)); + memset(margins, 0, sizeof(margins)); diff --git a/package/cups-filters/cups-filters.mk b/package/cups-filters/cups-filters.mk index 207c431bee..09e8fa3432 100644 --- a/package/cups-filters/cups-filters.mk +++ b/package/cups-filters/cups-filters.mk @@ -21,6 +21,9 @@ CUPS_FILTERS_IGNORE_CVES += CVE-2023-24805 # 0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch CUPS_FILTERS_IGNORE_CVES += CVE-2025-64524 +# 0005-fix-out-of-bounds-write-in-pdftoraster.patch +CUPS_FILTERS_IGNORE_CVES += CVE-2025-64503 + CUPS_FILTERS_DEPENDENCIES = cups libglib2 lcms2 qpdf fontconfig freetype jpeg CUPS_FILTERS_CONF_OPTS = \