[rpms/libcupsfilters] rawhide: fixes CVE-2026-64611 and CVE-2026-64612 (fedora#2506364)

[rpms/libcupsfilters] rawhide: fixes CVE-2026-64611 and CVE-2026-64612 (fedora#2506364)

[Zdenek Dohnal]

A new commit has been pushed.

Repo   : rpms/libcupsfilters
Branch : rawhide
Commit : 00049242e0ea3ec87f366a95694775eb64b99391
Author : Zdenek Dohnal <zdohnal@redhat.com>
Date   : 2026-08-05T16:51:59+02:00
Stats  : +197/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/libcupsfilters/c/00049242e0ea3ec87f366a95694775eb64b99391?branch=rawhide

Log:
fixes CVE-2026-64611 and CVE-2026-64612 (fedora#2506364)

---
diff --git a/0001-ieee.c-Fix-possible-infinite-loop-and-avoid-empty-de.patch b/0001-ieee.c-Fix-possible-infinite-loop-and-avoid-empty-de.patch
new file mode 100644
index 0000000..b15bacc
--- /dev/null
+++ b/0001-ieee.c-Fix-possible-infinite-loop-and-avoid-empty-de.patch
@@ -0,0 +1,67 @@
+From 4b343522823403df01f6753082df83f07d18c217 Mon Sep 17 00:00:00 2001
+From: zdohnal <zdohnal@redhat.com>
+Date: Thu, 23 Jul 2026 16:54:46 +0200
+Subject: [PATCH] ieee.c: Fix possible infinite loop and avoid empty device_ids
+ (#170)
+
+If model in device id was empty, library got into infinite loop. There
+are several layers of protection now:
+
+- library now does not allow empty strings for key or value
+- device ids without values are thrown away
+- comparison now happens only when there is actual string to compare
+  with, aka length > 0
+
+Fixes: CVE-2026-64611
+---
+ cupsfilters/ieee1284.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/cupsfilters/ieee1284.c b/cupsfilters/ieee1284.c
+index 57abee09..7ab5ac6b 100644
+--- a/cupsfilters/ieee1284.c
++++ b/cupsfilters/ieee1284.c
+@@ -407,6 +407,12 @@ cfIEEE1284GetMakeModel(
+ 
+   num_values = cfIEEE1284GetValues(device_id, &values);
+ 
++  if (!num_values)
++  {
++    DEBUG_puts("cfIEEE1284GetMakeModel: no key:value pairs");
++    return (-1);
++  }
++
+   if ((mdl = cupsGetOption("MODEL", num_values, values)) == NULL)
+     mdl = cupsGetOption("MDL", num_values, values);
+ 
+@@ -573,6 +579,9 @@ cfIEEE1284GetValues(
+     *ptr = '\0';
+     device_id ++;
+ 
++    if (!key[0] || !value[0])
++      continue;
++
+     num_values = cupsAddOption(key, value, num_values, values);
+   }
+ 
+@@ -668,6 +677,7 @@ cfIEEE1284NormalizeMakeModel(
+   char	*bufptr;			// Pointer into buffer
+   char  sepchr = ' ';                   // Word separator character
+   int   compare = 0,                    // Format for comparing
++        compare_len = 0,                // Length of compared buffer
+         human = 0,                      // Format for human-readable string
+         lower = 0,                      // All letters lowercase
+         upper = 0,                      // All letters uppercase
+@@ -1151,7 +1161,8 @@ cfIEEE1284NormalizeMakeModel(
+     // Remove repeated manufacturer names...
+     //
+ 
+-    while (strncasecmp(buffer, modelptr, modelptr - buffer) == 0)
++    compare_len = modelptr - buffer;
++    while (compare_len > 0 && strncasecmp(buffer, modelptr, compare_len) == 0)
+       move_right_part(buffer, bufsize, modelptr, buffer - modelptr);
+ 
+     //
+-- 
+2.55.0
+

diff --git a/0001-image-png.c-Handle-libpng-errors-via-longjmp-setjmp-.patch b/0001-image-png.c-Handle-libpng-errors-via-longjmp-setjmp-.patch
new file mode 100644
index 0000000..4a03eeb
--- /dev/null
+++ b/0001-image-png.c-Handle-libpng-errors-via-longjmp-setjmp-.patch
@@ -0,0 +1,122 @@
+From e8888af31419acbd0cbcc8340f41a383f35aae12 Mon Sep 17 00:00:00 2001
+From: zdohnal <zdohnal@redhat.com>
+Date: Thu, 23 Jul 2026 12:50:20 +0200
+Subject: [PATCH] image-png.c: Handle libpng errors via longjmp()/setjmp()
+ (#168)
+
+Libpng expects callers to set their own error handlers if they don't
+want to abort the whole process, and this has to be handled by
+longjmp()/setjmp().
+
+It follows the C standard, so any C-standard compliant compiler should
+work fine. Setting pointers as volatile is to prevent possible undefined
+behavior.
+
+Fixes CVE-2026-64612
+
+Assisted-by: Claude Code by Anthropic
+---
+ cupsfilters/image-png.c | 73 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 68 insertions(+), 5 deletions(-)
+
+diff --git a/cupsfilters/image-png.c b/cupsfilters/image-png.c
+index a6fd9a6d..9f482faf 100644
+--- a/cupsfilters/image-png.c
++++ b/cupsfilters/image-png.c
+@@ -20,6 +20,35 @@
+ 
+ #ifdef HAVE_LIBPNG
+ #  include <png.h>	// Portable Network Graphics (PNG) definitions
++#  include <setjmp.h>
++
++
++//
++// Custom error handler for libpng — longjmp() back to the setjmp()
++// point in the caller instead of the default abort(), so a malformed
++// PNG results in a graceful error return.
++//
++
++static void
++cf_image_png_error_callback(png_structp     png,
++                            png_const_charp error_msg)
++{
++  DEBUG_printf(("DEBUG: libpng error: %s\n", error_msg));
++  longjmp(png_jmpbuf(png), 1);
++}
++
++
++//
++// Custom warning handler for libpng — log non-fatal issues
++// and return normally so processing continues.
++//
++
++static void
++cf_image_png_warning_callback(png_structp     png,
++                              png_const_charp warning_msg)
++{
++  DEBUG_printf(("DEBUG: libpng warning: %s\n", warning_msg));
++}
+ 
+ 
+ //
+@@ -51,18 +80,52 @@ _cfImageReadPNG(
+   int		bpp;			// Bytes per pixel
+   int		pass,			// Current pass
+ 		passes;			// Number of passes required
+-  cf_ib_t	*in,			// Input pixels
+-		*inptr,			// Pointer into pixels
+-		*out;			// Output pixels
++  cf_ib_t	* volatile in = NULL;	// Input pixels (volatile for setjmp)
++  cf_ib_t	*inptr;			// Pointer into pixels
++  cf_ib_t	* volatile out = NULL;	// Output pixels (volatile for setjmp)
+   png_color_16	bg;			// Background color
+ 
+ 
+   //
+-  // Setup the PNG data structures...
++  // Setup the PNG data structures with custom error/warning handlers
++  // so that a malformed PNG causes an error return instead of abort().
++  // Errors during struct creation are handled internally by libpng
++  // and result in a NULL return. Errors in any png_*() call after
++  // setjmp() trigger our error callback which longjmp()s back.
+   //
+ 
+-  pp   = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
++  pp = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL,
++                              cf_image_png_error_callback,
++                              cf_image_png_warning_callback);
++  if (pp == NULL)
++  {
++    fclose(fp);
++    return (1);
++  }
++
+   info = png_create_info_struct(pp);
++  if (info == NULL)
++  {
++    png_destroy_read_struct(&pp, NULL, NULL);
++    fclose(fp);
++    return (1);
++  }
++
++  //
++  // Error handling jump point — if any png_*() call below triggers
++  // png_error(), our callback longjmp()s back here. The 'in' and
++  // 'out' pointers are initialized to NULL so free() is safe here
++  // even if longjmp() reverts them (C11 §7.13.2.1).
++  //
++
++  if (setjmp(png_jmpbuf(pp)))
++  {
++    free(in);
++    free(out);
++    png_destroy_read_struct(&pp, &info, NULL);
++    fclose(fp);
++    return (1);
++  }
+ 
+   //
+   // Initialize the PNG read "engine"...
+-- 
+2.55.0
+

diff --git a/libcupsfilters.spec b/libcupsfilters.spec
index 656ff08..93bfe1c 100644
--- a/libcupsfilters.spec
+++ b/libcupsfilters.spec
@@ -5,7 +5,7 @@
 Name: libcupsfilters
 Epoch: 1
 Version: 2.1.1
-Release: 8%{?dist}
+Release: 9%{?dist}
 Summary: Library for developing printing filters
 # the CUPS exception text is the same as LLVM exception, so using that name with
 # agreement from legal team
@@ -22,6 +22,10 @@ Patch001: 0001-configure.ac-Make-CJK-fonts-name-configurable.patch
 Patch002: lcf-CVE-2025-57812.patch
 # CVE-2025-64503
 Patch003: 0001-Fix-out-of-bounds-write-in-cfFilterPDFToRaster.patch
+# CVE-2026-64611
+Patch004: 0001-ieee.c-Fix-possible-infinite-loop-and-avoid-empty-de.patch
+# CVE-2026-64612
+Patch005: 0001-image-png.c-Handle-libpng-errors-via-longjmp-setjmp-.patch
 
 
 # for generating configure and Makefile scripts in autogen.h
@@ -200,6 +204,9 @@ rm -f %{buildroot}%{_pkgdocdir}/{LICENSE,COPYING,NOTICE}
 
 
 %changelog
+* Wed Aug 05 2026 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.1.1-9
+- fixes CVE-2026-64611 and CVE-2026-64612 (fedora#2506364)
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:2.1.1-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild