Re: [Buildroot] [PATCH v4 07/21] package/cups-filters: add upstream patch to fix CVE-2025-64524

From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: Bernd Kuhls <bernd@kuhls.net>
Cc: Thomas Perale <thomas.perale@mind.be>,
	buildroot@buildroot.org,
	Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>,
	Tudor Holton <buildroot@tudorholton.com>,
	Fabrice Fontaine <fontaine.fabrice@gmail.com>,
	Angelo Compagnucci <angelo.compagnucci@gmail.com>,
	Olivier Schonken <olivier.schonken@gmail.com>,
	Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
	Romain Naour <romain.naour@gmail.com>,
	Giulio Benetti <giulio.benetti@benettiengineering.com>
Subject: Re: [Buildroot] [PATCH v4 07/21] package/cups-filters: add upstream patch to fix CVE-2025-64524
Date: Mon,  4 May 2026 16:55:44 +0200	[thread overview]
Message-ID: <20260504145544.24754-1-thomas.perale@mind.be> (raw)
In-Reply-To: <20260501152758.2610763-8-bernd@kuhls.net>

Hi,

In reply of:
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

> ---
>  ...ix-infinite-loop-caused-by-crafted-f.patch | 83 +++++++++++++++++++
>  package/cups-filters/cups-filters.mk          |  3 +
>  2 files changed, 86 insertions(+)
>  create mode 100644 package/cups-filters/0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch
> 
> diff --git a/package/cups-filters/0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch b/package/cups-filters/0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch
> new file mode 100644
> index 0000000000..e9900e5672
> --- /dev/null
> +++ b/package/cups-filters/0002-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch
> @@ -0,0 +1,83 @@
> +From b03866fd2e251a6d822a5e8c807c8d47b4d2dce2 Mon Sep 17 00:00:00 2001
> +From: Zdenek Dohnal <zdohnal@redhat.com>
> +Date: Wed, 12 Nov 2025 16:02:20 +0100
> +Subject: [PATCH] rastertopclx.c: Fix infinite loop caused by crafted file
> +
> +Infinite loop happened because of crafted input raster file, which led
> +into heap buffer overflow of `CompressBuf` array.
> +
> +Based on comments there should be always some `count` when compressing
> +the data, and processing of crafted file ended with offset and count
> +being 0.
> +
> +Fixes CVE-2025-64524

This line needs to be changed to the following as documented in [1]

```
CVE: CVE-2025-64524
```

To be correctly picked up as a patch. This is not checked yet by `check-package` unfortunately

[1] https://buildroot.org/downloads/manual/manual.html#additional-patch-documentation

> +
> +Upstream: https://github.com/OpenPrinting/cups-filters/commit/b03866fd2e251a6d822a5e8c807c8d47b4d2dce2
> +
> +Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Best regards,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot