Skip to content

cupsfilters: ieee1284: fix out-of-bounds read in NormalizeMakeModel#139

Merged
tillkamppeter merged 1 commit intoOpenPrinting:masterfrom
nomkar24:fixes_#136
Mar 25, 2026
Merged

cupsfilters: ieee1284: fix out-of-bounds read in NormalizeMakeModel#139
tillkamppeter merged 1 commit intoOpenPrinting:masterfrom
nomkar24:fixes_#136

Conversation

@nomkar24
Copy link
Copy Markdown
Contributor

When a user-supplied make string is longer than bufsize, snprintf() truncates the output but modelptr was still calculated using the original strlen(make), resulting in modelptr pointing past the end of buffer. A subsequent strncasecmp() call then caused an out-of-bounds read.

Key changes:

  • Add bounds check for modelptr after all snprintf() calls that set it to a fixed offset (Xerox, Kodak, Apple, Seiko, EFI, Canon, Fargo, HP, Kyocera, and user-supplied make string cases)
  • Add strlen(buffer) guard before accessing buffer at fixed indices in the known multi-word manufacturer name checks (konica minolta, fuji xerox, lexmark international, kyocera mita)
  • Add strlen(make) < bufsize guard before accessing buffer[strlen(make)] to prevent out-of-bounds access in the make-prefix match check
  • Keep a catch-all safety clamp for modelptr at the end of the manufacturer block
  • #Fixes stack-buffer-overflow in cfIEEE1284NormalizeMakeModel() #136

When a user-supplied make string is longer than bufsize, snprintf()
truncates the output but modelptr was still calculated using the
original strlen(make), resulting in modelptr pointing past the end of
buffer. A subsequent strncasecmp() call then caused an out-of-bounds
read.

Key changes:
- Add bounds check for modelptr after all snprintf() calls that set it
  to a fixed offset (Xerox, Kodak, Apple, Seiko, EFI, Canon, Fargo,
  HP, Kyocera, and user-supplied make string cases)
- Add strlen(buffer) guard before accessing buffer at fixed indices in
  the known multi-word manufacturer name checks (konica minolta,
  fuji xerox, lexmark international, kyocera mita)
- Add strlen(make) < bufsize guard before accessing buffer[strlen(make)]
  to prevent out-of-bounds access in the make-prefix match check
- Keep a catch-all safety clamp for modelptr at the end of the
  manufacturer block
  #Fixes OpenPrinting#136
Signed-off-by: Omkar Nanajkar <nomkar2131@gmail.com>
@tillkamppeter tillkamppeter merged commit 7c45e5f into OpenPrinting:master Mar 25, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

stack-buffer-overflow in cfIEEE1284NormalizeMakeModel()

2 participants