Skip to content

Commit a071f2c

Browse files
authored
http.c: Fix infinite loop in GTK apps
GTK has a specific IPP processing which stopped working after CVE-2025-58436 fix. GTK depends on internal behavior of `_httpUpdate()` which read a line from connection at the start of function, which was one of culprits behind CVE-2025-58436. To mitigate CVE-2025-58436 `_httpUpdate()` started to read from connection only if there was data in internal HTTP buffer and there was at least one newline buffered - otherwise the function returns HTTP_ERROR/HTTP_CONTINUE, which caused the loop in GTK. The change which fixes GTK behavior in the PR is to read data from connection at the start of `_httpUpdate()` for non-blocking connections immediately with no timeout if internal HTTP buffer is not full. The change mitigates the CVE as well as the previous implementation. Fixes #1429
2 parents f3ce6d3 + 6efa179 commit a071f2c

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

cups/http.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2909,7 +2909,7 @@ _httpUpdate(http_t *http, // I - HTTP connection
29092909
// See whether our read buffer is full...
29102910
DEBUG_printf("2_httpUpdate: used=%d", http->used);
29112911

2912-
if (http->used > 0 && !memchr(http->buffer, '\n', (size_t)http->used) && (size_t)http->used < sizeof(http->buffer))
2912+
if ((size_t)http->used < sizeof(http->buffer))
29132913
{
29142914
// No, try filling in more data...
29152915
if ((bytes = http_read(http, http->buffer + http->used, sizeof(http->buffer) - (size_t)http->used, /*timeout*/0)) > 0)

0 commit comments

Comments
 (0)