public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Zdenek Dohnal <zdohnal@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/hplip] f43: fix CVE-2026-14544 - incomplete fix after CVE-2026-8631 (fedora#2496773,
Date: Fri, 03 Jul 2026 09:02:04 GMT [thread overview]
Message-ID: <178306932414.1.2969004673029056502.rpms-hplip-f608b603fdbc@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/hplip
Branch : f43
Commit : f608b603fdbcb101d3e64b847b965527a12c29cb
Author : Zdenek Dohnal <zdohnal@redhat.com>
Date : 2026-07-03T10:33:25+02:00
Stats : +14/-13 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/hplip/c/f608b603fdbcb101d3e64b847b965527a12c29cb?branch=f43
Log:
fix CVE-2026-14544 - incomplete fix after CVE-2026-8631 (fedora#2496773,
fedora#2496772)
---
diff --git a/hplip-CVE-2026-8631-osh.patch b/hplip-CVE-2026-8631-osh.patch
index 91baaa7..226a570 100644
--- a/hplip-CVE-2026-8631-osh.patch
+++ b/hplip-CVE-2026-8631-osh.patch
@@ -1,13 +1,10 @@
-diff --git a/prnt/hpcups/genPCLm.cpp b/prnt/hpcups/genPCLm.cpp
-index 0e1650c..5f83cba 100644
---- a/prnt/hpcups/genPCLm.cpp
-+++ b/prnt/hpcups/genPCLm.cpp
-@@ -1917,8 +1917,11 @@ int PCLmGenerator::Encapsulate(void *pInBuffer, int inBufferSize, int thisHeigh
- #ifdef SUPPORT_WHITE_STRIPS
+diff -up hplip-3.21.2/prnt/hpcups/genPCLm.cpp.CVE-2026-8631-osh hplip-3.21.2/prnt/hpcups/genPCLm.cpp
+--- hplip-3.21.2/prnt/hpcups/genPCLm.cpp.CVE-2026-8631-osh 2026-07-03 08:25:17.717888763 +0200
++++ hplip-3.21.2/prnt/hpcups/genPCLm.cpp 2026-07-03 08:48:22.225130940 +0200
+@@ -1922,7 +1922,10 @@ int PCLmGenerator::Encapsulate(void *pI
int whiteStripLen=0;
if(!safe_mul_int_positive(thisHeight, currSourceWidth, &whiteStripLen) ||
-- !safe_mul_int_positive(whiteStripLen, srcNumComponents, &whiteStripLen))
-+ !safe_mul_int_positive(thisHeight, srcNumComponents, &whiteStripLen))
+ !safe_mul_int_positive(whiteStripLen, srcNumComponents, &whiteStripLen))
+ {
+ free(newStripPtr);
return(errorOutAndCleanUp());
@@ -15,7 +12,7 @@ index 0e1650c..5f83cba 100644
bool whiteStrip=isWhiteStrip(pInBuffer, whiteStripLen);
if(DebugIt2)
{
-@@ -1940,11 +1943,17 @@ int PCLmGenerator::Encapsulate(void *pInBuffer, int inBufferSize, int thisHeigh
+@@ -1944,11 +1947,17 @@ int PCLmGenerator::Encapsulate(void *pI
ubyte whitePt=0xff;
size_t tmpStripSize=0;
if(!safe_mul_size_t((size_t)scanlineWidth, (size_t)topMarginInPix, &tmpStripSize))
@@ -33,7 +30,7 @@ index 0e1650c..5f83cba 100644
memset(tmpStrip,whitePt,tmpStripSize);
-@@ -2012,7 +2021,10 @@ int PCLmGenerator::Encapsulate(void *pInBuffer, int inBufferSize, int thisHeigh
+@@ -2016,7 +2025,10 @@ int PCLmGenerator::Encapsulate(void *pI
{
int sourceLen=0;
if(!safe_mul_int_positive(numLinesThisCall, scanlineWidth, &sourceLen))
@@ -44,7 +41,7 @@ index 0e1650c..5f83cba 100644
uint32 len=(uint32)sourceLen;
uLongf destSize=len;
-@@ -2021,12 +2033,18 @@ int PCLmGenerator::Encapsulate(void *pInBuffer, int inBufferSize, int thisHeigh
+@@ -2025,12 +2037,18 @@ int PCLmGenerator::Encapsulate(void *pI
ubyte whitePt=0xff;
size_t tmpStripSize=0;
if(!safe_mul_size_t((size_t)scanlineWidth, (size_t)topMarginInPix, &tmpStripSize))
@@ -63,7 +60,7 @@ index 0e1650c..5f83cba 100644
uLongf tmpDestSize=destSize;
memset(tmpStrip,whitePt,tmpStripSize);
-@@ -2075,20 +2093,29 @@ int PCLmGenerator::Encapsulate(void *pInBuffer, int inBufferSize, int thisHeigh
+@@ -2079,20 +2097,29 @@ int PCLmGenerator::Encapsulate(void *pI
{
int sourceLen=0;
if(!safe_mul_int_positive(numLinesThisCall, scanlineWidth, &sourceLen))
diff --git a/hplip.spec b/hplip.spec
index bfc5286..c0d8219 100644
--- a/hplip.spec
+++ b/hplip.spec
@@ -7,7 +7,7 @@
Summary: HP Linux Imaging and Printing Project
Name: hplip
Version: 3.26.4
-Release: 6%{?dist}
+Release: 7%{?dist}
# most files (base/*, *, ui*/...) - GPL2+
# prnt/hpijs/ jpeg related files - IJG
# prnt/* - BSD-3-Clause-HP - it is modified a little, asked here https://gitlab.com/fedora/legal/fedora-license-data/-/issues/267
@@ -1001,6 +1001,10 @@ find doc/images -type f -exec chmod 644 {} \;
%config(noreplace) %{_sysconfdir}/sane.d/dll.d/hpaio
%changelog
+* Fri Jul 03 2026 Zdenek Dohnal <zdohnal@redhat.com> - 3.26.4-7
+- fix CVE-2026-14544 - incomplete fix after CVE-2026-8631 (fedora#2496773,
+ fedora#2496772)
+
* Mon Jun 15 2026 Zdenek Dohnal <zdohnal@redhat.com> - 3.26.4-6
- Fix more leaks after CVE-2026-8632 fix
reply other threads:[~2026-07-03 9:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178306932414.1.2969004673029056502.rpms-hplip-f608b603fdbc@fedoraproject.org \
--to=zdohnal@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox