Skip to content

Commit cdd7302

Browse files
n0y0nDn0y0nD
authored
Fix stack-buffer-overflow in ppdCacheCreateWithPPD() (#70)
1 parent b9c015f commit cdd7302

3 files changed

Lines changed: 265 additions & 4 deletions

File tree

‎ppd/ppd-cache.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1444,10 +1444,14 @@ ppdCacheCreateWithPPD(ppd_file_t *ppd) // I - PPD file
14441444
// Generate custom size data...
14451445
//
14461446

1447-
pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword), "custom", "max",
1448-
PWG_FROM_POINTS(ppd->custom_max[0]),
1449-
PWG_FROM_POINTS(ppd->custom_max[1]), NULL);
1450-
1447+
if (!pwgFormatSizeName(pwg_keyword, sizeof(pwg_keyword),"custom", "max",
1448+
PWG_FROM_POINTS(ppd->custom_max[0]),
1449+
PWG_FROM_POINTS(ppd->custom_max[1]), NULL))
1450+
{
1451+
DEBUG_puts("ppdCacheCreateWithPPD: pwgFormatSizeName failure.");
1452+
goto create_error;
1453+
}
1454+
14511455
// Some PPD files have upper limits too large to be treated with
14521456
// int numbers, if we have an overflow (negative result for one
14531457
// dimension) use a fixed, large value instead

‎ppd/sbo_test.ppd‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
*PPD-Adobe: "4.3"
2+
*%
3+
*% Test PPD file #2 for CUPS.
4+
*%
5+
*% This file is used to test the CUPS PPD API functions and cannot be
6+
*% used with any known printers. Look on the CUPS web site for working PPD
7+
*% files.
8+
*%
9+
*% If you are a PPD file developer, consider using the PPD compiler (ppdc)
10+
*% to create your PPD files - not only will it save you time, it produces
11+
*% consistently high-quality files.
12+
*%
13+
*% Copyright (c) 2007-2018 by Apple Inc.
14+
*% Copyright (c) 2002-2006 by Easy Software Products.
15+
*%
16+
*% Licensed under Apache License v2.0. See the file "LICENSE" for more
17+
*% information.
18+
*FormatVersion: "4.3"
19+
*FileVersion: "2.3"
20+
*LanguageVersion: English
21+
*LanguageEncoding: ISOLatin1
22+
*PCFileName: "TEST.PPD"
23+
*Manufacturer: "Apple"
24+
*Product: "(Test2)"
25+
*cupsVersion: 2.3
26+
*ModelName: "Test2"
27+
*ShortNickName: "Test2"
28+
*NickName: "Test2 for CUPS"
29+
*PSVersion: "(3010.000) 0"
30+
*LanguageLevel: "3"
31+
*ColorDevice: True
32+
*DefaultColorSpace: RGB
33+
*FileSystem: False
34+
*Throughput: "1"
35+
*LandscapeOrientation: Plus90
36+
*TTRasterizer: Type42
37+
38+
*% These constraints are used to test ppdConflicts() and cupsResolveConflicts()
39+
*cupsUIConstraints envelope: "*PageSize Letter *InputSlot Envelope"
40+
41+
*cupsUIConstraints envphoto: "*PageSize Env10 *InputSlot Envelope *Quality Photo"
42+
*cupsUIResolver envphoto: "*Quality Normal"
43+
44+
*% This constraint is used to test ppdInstallableConflict()
45+
*cupsUIConstraints: "*Duplex *InstalledDuplexer False"
46+
47+
*% These constraints are used to test the loop detection code in cupsResolveConflicts()
48+
*cupsUIConstraints loop1: "*PageSize A4 *Quality Photo"
49+
*cupsUIResolver loop1: "*Quality Normal"
50+
*cupsUIConstraints loop2: "*PageSize A4 *Quality Normal"
51+
*cupsUIResolver loop2: "*Quality Photo"
52+
53+
*% For PageSize, we have put all of the translations in-line...
54+
*OpenUI *PageSize/Page Size: PickOne
55+
*fr.Translation PageSize/French Page Size: ""
56+
*fr_CA.Translation PageSize/French Canadian Page Size: ""
57+
*OrderDependency: 10 AnySetup *PageSize
58+
*DefaultPageSize: Letter
59+
*PageSize Letter/US Letter: "PageSize=Letter"
60+
*fr.PageSize Letter/French US Letter: ""
61+
*fr_CA.PageSize Letter/French Canadian US Letter: ""
62+
*PageSize A4/A4: "PageSize=A4"
63+
*fr.PageSize A4/French A4: ""
64+
*fr_CA.PageSize A4/French Canadian A4: ""
65+
*PageSize Env10/#10 Envelope: "PageSize=Env10"
66+
*fr.PageSize Env10/French #10 Envelope: ""
67+
*fr_CA.PageSize Env10/French Canadian #10 Envelope: ""
68+
*CloseUI: *PageSize
69+
70+
*% For PageRegion, we have separated the translations...
71+
*OpenUI *PageRegion/Page Region: PickOne
72+
*OrderDependency: 10 AnySetup *PageRegion
73+
*DefaultPageRegion: Letter
74+
*PageRegion Letter/US Letter: "PageRegion=Letter"
75+
*PageRegion A4/A4: "PageRegion=A4"
76+
*PageRegion Env10/#10 Envelope: "PageRegion=Env10"
77+
*CloseUI: *PageRegion
78+
79+
*fr.Translation PageRegion/French Page Region: ""
80+
*fr.PageRegion Letter/French US Letter: ""
81+
*fr.PageRegion A4/French A4: ""
82+
*fr.PageRegion Env10/French #10 Envelope: ""
83+
84+
*fr_CA.Translation PageRegion/French Canadian Page Region: ""
85+
*fr_CA.PageRegion Letter/French Canadian US Letter: ""
86+
*fr_CA.PageRegion A4/French Canadian A4: ""
87+
*fr_CA.PageRegion Env10/French Canadian #10 Envelope: ""
88+
89+
*DefaultImageableArea: Letter
90+
*ImageableArea Letter: "18 36 594 756"
91+
*ImageableArea A4: "18 36 577 806"
92+
*ImageableArea Env10: "18 36 279 648"
93+
94+
*DefaultPaperDimension: Letter
95+
*PaperDimension Letter: "612 792"
96+
*PaperDimension A4: "595 842"
97+
*PaperDimension Env10: "297 684"
98+
99+
*% This custom page size is used to test ppdCacheCreateWithPPD() with out-of-range dimension
100+
*HWMargins: 0 0 0 0
101+
*NonUIOrderDependency: 100 AnySetup *CustomPageSize True
102+
*CustomPageSize True/Custom Page Size: "PageSize=Custom"
103+
*ParamCustomPageSize Width: 1 points 36 1E80
104+
*ParamCustomPageSize Height: 2 points 36 86400
105+
*ParamCustomPageSize WidthOffset/Width Offset: 3 points 0 0
106+
*ParamCustomPageSize HeightOffset/Height Offset: 4 points 0 0
107+
*ParamCustomPageSize Orientation: 5 int 0 0
108+
109+
*cupsMediaQualifier2: InputSlot
110+
*cupsMediaQualifier3: Quality
111+
*cupsMaxSize .Manual.: "1000 1000"
112+
*cupsMinSize .Manual.: "100 100"
113+
*cupsMinSize .Manual.Photo: "200 200"
114+
*cupsMinSize ..Photo: "300 300"
115+
116+
*OpenUI *InputSlot/Input Slot: PickOne
117+
*OrderDependency: 20 AnySetup *InputSlot
118+
*DefaultInputSlot: Tray
119+
*InputSlot Tray/Tray: "InputSlot=Tray"
120+
*InputSlot Manual/Manual Feed: "InputSlot=Manual"
121+
*InputSlot Envelope/Envelope Feed: "InputSlot=Envelope"
122+
*CloseUI: *InputSlot
123+
124+
*OpenUI *Quality/Output Mode: PickOne
125+
*OrderDependency: 20 AnySetup *Quality
126+
*DefaultQuality: Normal
127+
*Quality Draft: "Quality=Draft"
128+
*Quality Normal: "Quality=Normal"
129+
*Quality Photo: "Quality=Photo"
130+
*CloseUI: *Quality
131+
132+
*OpenUI *Duplex/2-Sided Printing: PickOne
133+
*OrderDependency: 10 DocumentSetup *Duplex
134+
*DefaultDuplex: None
135+
*Duplex None/Off: "Duplex=None"
136+
*Duplex DuplexNoTumble/Long Edge: "Duplex=DuplexNoTumble"
137+
*Duplex DuplexTumble/Short Edge: "Duplex=DuplexTumble"
138+
*CloseUI: *Duplex
139+
140+
*% Installable option...
141+
*OpenGroup: InstallableOptions/Installable Options
142+
*OpenUI InstalledDuplexer/Duplexer Installed: Boolean
143+
*DefaultInstalledDuplexer: False
144+
*InstalledDuplexer False: ""
145+
*InstalledDuplexer True: ""
146+
*CloseUI: *InstalledDuplexer
147+
*CloseGroup: InstallableOptions
148+
149+
*% Custom options...
150+
*OpenGroup: Extended/Extended Options
151+
152+
*OpenUI IntOption/Integer: PickOne
153+
*OrderDependency: 30 AnySetup *IntOption
154+
*DefaultIntOption: None
155+
*IntOption None: ""
156+
*IntOption 1: "IntOption=1"
157+
*IntOption 2: "IntOption=2"
158+
*IntOption 3: "IntOption=3"
159+
*CloseUI: *IntOption
160+
161+
*CustomIntOption True/Custom Integer: "IntOption=Custom"
162+
*ParamCustomIntOption Integer: 1 int -100 100
163+
164+
*OpenUI StringOption/String: PickOne
165+
*OrderDependency: 40 AnySetup *StringOption
166+
*DefaultStringOption: None
167+
*StringOption None: ""
168+
*StringOption foo: "StringOption=foo"
169+
*StringOption bar: "StringOption=bar"
170+
*CloseUI: *StringOption
171+
172+
*CustomStringOption True/Custom String: "StringOption=Custom"
173+
*ParamCustomStringOption String: 1 string 1 10
174+
175+
*CloseGroup: Extended
176+
177+
*% IPP reasons for ppdLocalizeIPPReason tests
178+
*cupsIPPReason foo/Foo Reason: "http://foo/bar.html
179+
help:anchor='foo'%20bookID=Vendor%20Help
180+
/help/foo/bar.html"
181+
*End
182+
*fr.cupsIPPReason foo/La Foo Reason: "text:La%20Long%20
183+
text:Foo%20Reason
184+
http://foo/fr/bar.html
185+
help:anchor='foo'%20bookID=Vendor%20Help
186+
/help/fr/foo/bar.html"
187+
*End
188+
*zh_TW.cupsIPPReason foo/Number 1 Foo Reason: "text:Number%201%20
189+
text:Foo%20Reason
190+
http://foo/zh_TW/bar.html
191+
help:anchor='foo'%20bookID=Vendor%20Help
192+
/help/zh_TW/foo/bar.html"
193+
*End
194+
*zh.cupsIPPReason foo/Number 2 Foo Reason: "text:Number%202%20
195+
text:Foo%20Reason
196+
http://foo/zh/bar.html
197+
help:anchor='foo'%20bookID=Vendor%20Help
198+
/help/zh/foo/bar.html"
199+
*End
200+
201+
*% Marker names for ppdLocalizeMarkerName tests
202+
*cupsMarkerName cyan/Cyan Toner: ""
203+
*fr.cupsMarkerName cyan/La Toner Cyan: ""
204+
*zh_TW.cupsMarkerName cyan/Number 1 Cyan Toner: ""
205+
*zh.cupsMarkerName cyan/Number 2 Cyan Toner: ""
206+
207+
*DefaultFont: Courier
208+
*Font AvantGarde-Book: Standard "(001.006S)" Standard ROM
209+
*Font AvantGarde-BookOblique: Standard "(001.006S)" Standard ROM
210+
*Font AvantGarde-Demi: Standard "(001.007S)" Standard ROM
211+
*Font AvantGarde-DemiOblique: Standard "(001.007S)" Standard ROM
212+
*Font Bookman-Demi: Standard "(001.004S)" Standard ROM
213+
*Font Bookman-DemiItalic: Standard "(001.004S)" Standard ROM
214+
*Font Bookman-Light: Standard "(001.004S)" Standard ROM
215+
*Font Bookman-LightItalic: Standard "(001.004S)" Standard ROM
216+
*Font Courier: Standard "(002.004S)" Standard ROM
217+
*Font Courier-Bold: Standard "(002.004S)" Standard ROM
218+
*Font Courier-BoldOblique: Standard "(002.004S)" Standard ROM
219+
*Font Courier-Oblique: Standard "(002.004S)" Standard ROM
220+
*Font Helvetica: Standard "(001.006S)" Standard ROM
221+
*Font Helvetica-Bold: Standard "(001.007S)" Standard ROM
222+
*Font Helvetica-BoldOblique: Standard "(001.007S)" Standard ROM
223+
*Font Helvetica-Narrow: Standard "(001.006S)" Standard ROM
224+
*Font Helvetica-Narrow-Bold: Standard "(001.007S)" Standard ROM
225+
*Font Helvetica-Narrow-BoldOblique: Standard "(001.007S)" Standard ROM
226+
*Font Helvetica-Narrow-Oblique: Standard "(001.006S)" Standard ROM
227+
*Font Helvetica-Oblique: Standard "(001.006S)" Standard ROM
228+
*Font NewCenturySchlbk-Bold: Standard "(001.009S)" Standard ROM
229+
*Font NewCenturySchlbk-BoldItalic: Standard "(001.007S)" Standard ROM
230+
*Font NewCenturySchlbk-Italic: Standard "(001.006S)" Standard ROM
231+
*Font NewCenturySchlbk-Roman: Standard "(001.007S)" Standard ROM
232+
*Font Palatino-Bold: Standard "(001.005S)" Standard ROM
233+
*Font Palatino-BoldItalic: Standard "(001.005S)" Standard ROM
234+
*Font Palatino-Italic: Standard "(001.005S)" Standard ROM
235+
*Font Palatino-Roman: Standard "(001.005S)" Standard ROM
236+
*Font Symbol: Special "(001.007S)" Special ROM
237+
*Font Times-Bold: Standard "(001.007S)" Standard ROM
238+
*Font Times-BoldItalic: Standard "(001.009S)" Standard ROM
239+
*Font Times-Italic: Standard "(001.007S)" Standard ROM
240+
*Font Times-Roman: Standard "(001.007S)" Standard ROM
241+
*Font ZapfChancery-MediumItalic: Standard "(001.007S)" Standard ROM
242+
*Font ZapfDingbats: Special "(001.004S)" Standard ROM

‎ppd/testppd.c‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1163,7 +1163,22 @@ main(int argc, // I - Number of command-line arguments
11631163
}
11641164

11651165
status += do_ps_tests();
1166+
1167+
fputs("ppdCacheCreateWithPPD(sbo_test.ppd - overflow regression): ",
1168+
stdout);
1169+
if ((ppd = ppdOpenFile("ppd/sbo_test.ppd")) != NULL)
1170+
{
1171+
pc = ppdCacheCreateWithPPD(ppd);
1172+
if (pc)
1173+
ppdCacheDestroy(pc);
1174+
puts("PASS");
11661175
}
1176+
else
1177+
{
1178+
puts("FAIL (Unable to open PPD)");
1179+
status ++;
1180+
}
1181+
}
11671182
else if (!strcmp(argv[1], "--raster"))
11681183
{
11691184
for (status = 0, num_options = 0, options = NULL, i = 1; i < argc; i ++)

0 commit comments

Comments
 (0)