From d681747ebf12602cb426725eb8ce2753211e2477 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 26 Sep 2024 23:12:14 +0200
Subject: [PATCH] Prevent PPD generation based on invalid IPP response

Author: Mike Sweet
Minor fixes: Zdenek Dohnal

Fixes CVE-2024-47175
---
 cupsfilters/ppdgenerator.c | 225 +++++++++++++++++++++++++------------
 1 file changed, 156 insertions(+), 69 deletions(-)

diff --git a/cupsfilters/ppdgenerator.c b/cupsfilters/ppdgenerator.c
index 23d519d..1bfcc8a 100644
--- a/cupsfilters/ppdgenerator.c
+++ b/cupsfilters/ppdgenerator.c
@@ -92,6 +92,7 @@ typedef struct _pwg_finishings_s	/**** PWG finishings mapping data ****/
 static void	pwg_ppdize_name(const char *ipp, char *name, size_t namesize);
 static void	pwg_ppdize_resolution(ipp_attribute_t *attr, int element,
                                  int *xres, int *yres, char *name, size_t namesize);
+static void	ppd_put_string(cups_file_t *fp, cups_lang_t *lang, const char *ppd_option, const char *ppd_choice, const char *pwg_msgid);
 
 /*
  * '_cupsSetError()' - Set the last PPD generator status-message.
@@ -1581,9 +1582,10 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
   ipp_t			*media_col,	/* Media collection */
 			*media_size;	/* Media size collection */
   char			make[256],	/* Make and model */
-			*model,		/* Model name */
+			*mptr,		// Pointer into make and model
 			ppdname[PPD_MAX_NAME];
 		    			/* PPD keyword */
+  const char            *model;         /* Model name */
   int			i, j,		/* Looping vars */
 			count = 0,	/* Number of values */
 			bottom,		/* Largest bottom margin */
@@ -1663,6 +1665,68 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
     return (NULL);
   }
 
+  //
+  // Get a sanitized make and model...
+  //
+
+  if ((attr = ippFindAttribute(response, "printer-make-and-model", IPP_TAG_TEXT)) != NULL && ippValidateAttribute(attr))
+  {
+    // Sanitize the model name to only contain PPD-safe characters.
+    strlcpy(make, ippGetString(attr, 0, NULL), sizeof(make));
+
+    for (mptr = make; *mptr; mptr ++)
+    {
+      if (*mptr < ' ' || *mptr >= 127 || *mptr == '\"')
+      {
+        // Truncate the make and model on the first bad character...
+	*mptr = '\0';
+	break;
+      }
+    }
+
+    while (mptr > make)
+    {
+      // Strip trailing whitespace...
+      mptr --;
+      if (*mptr == ' ')
+	*mptr = '\0';
+    }
+
+    if (!make[0])
+    {
+      // Use a default make and model if nothing remains...
+      strlcpy(make, "Unknown", sizeof(make));
+    }
+  }
+  else
+  {
+    // Use a default make and model...
+    strlcpy(make, "Unknown", sizeof(make));
+  }
+
+  if (!strncasecmp(make, "Hewlett Packard ", 16) || !strncasecmp(make, "Hewlett-Packard ", 16))
+  {
+    // Normalize HP printer make and model...
+    model = make + 16;
+    strlcpy(make, "HP", sizeof(make));
+
+    if (!strncasecmp(model, "HP ", 3))
+      model += 3;
+  }
+  else if ((mptr = strchr(make, ' ')) != NULL)
+  {
+    // Separate "MAKE MODEL"...
+    while (*mptr && *mptr == ' ')
+      *mptr++ = '\0';
+
+    model = mptr;
+  }
+  else
+  {
+    // No separate model name...
+    model = "Printer";
+  }
+
  /*
   * Standard stuff for PPD file...
   */
@@ -1691,24 +1755,6 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
     }
   }
 
-  if ((attr = ippFindAttribute(response, "printer-make-and-model",
-			       IPP_TAG_TEXT)) != NULL)
-    strlcpy(make, ippGetString(attr, 0, NULL), sizeof(make));
-  else if (make_model && make_model[0] != '\0')
-    strlcpy(make, make_model, sizeof(make));
-  else
-    strlcpy(make, "Unknown Printer", sizeof(make));
-
-  if (!_cups_strncasecmp(make, "Hewlett Packard ", 16) ||
-      !_cups_strncasecmp(make, "Hewlett-Packard ", 16)) {
-    model = make + 16;
-    strlcpy(make, "HP", sizeof(make));
-  }
-  else if ((model = strchr(make, ' ')) != NULL)
-    *model++ = '\0';
-  else
-    model = make;
-
   cupsFilePrintf(fp, "*Manufacturer: \"%s\"\n", make);
   cupsFilePrintf(fp, "*ModelName: \"%s %s\"\n", make, model);
   cupsFilePrintf(fp, "*Product: \"(%s %s)\"\n", make, model);
@@ -1805,14 +1851,11 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
   cupsFilePuts(fp, "*cupsSNMPSupplies: False\n");
   cupsFilePuts(fp, "*cupsLanguages: \"en\"\n");
 
-  if ((attr = ippFindAttribute(response, "printer-more-info", IPP_TAG_URI)) !=
-      NULL)
+  if ((attr = ippFindAttribute(response, "printer-more-info", IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
     cupsFilePrintf(fp, "*APSupplies: \"%s\"\n", ippGetString(attr, 0, NULL));
 
-  if ((attr = ippFindAttribute(response, "printer-charge-info-uri",
-			       IPP_TAG_URI)) != NULL)
-    cupsFilePrintf(fp, "*cupsChargeInfoURI: \"%s\"\n", ippGetString(attr, 0,
-								    NULL));
+  if ((attr = ippFindAttribute(response, "printer-charge-info-uri", IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
+    cupsFilePrintf(fp, "*cupsChargeInfoURI: \"%s\"\n", ippGetString(attr, 0, NULL));
 
   /* Message catalogs for UI strings */
   if (opt_strings_catalog == NULL) {
@@ -1820,7 +1863,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
     load_opt_strings_catalog(NULL, opt_strings_catalog);
   }
   if ((attr = ippFindAttribute(response, "printer-strings-uri",
-			       IPP_TAG_URI)) != NULL) {
+			       IPP_TAG_URI)) != NULL && ippValidateAttribute(attr))
+  {
     printer_opt_strings_catalog = optArrayNew();
     load_opt_strings_catalog(ippGetString(attr, 0, NULL),
 			     printer_opt_strings_catalog);
@@ -2565,13 +2609,15 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	  break;
 	}
       if (j >= 0)
-	cupsFilePrintf(fp, "*InputSlot %s/%s: \"<</MediaPosition %d>>setpagedevice\"\n",
-		       ppdname, human_readable, j);
+      {
+	cupsFilePrintf(fp, "*InputSlot %s: \"<</MediaPosition %d>>setpagedevice\"\n", ppdname, j);
+	ppd_put_string(fp, lang, "InputSlot", ppdname, human_readable);
+      }
       else
-	cupsFilePrintf(fp, "*InputSlot %s%s%s: \"\"\n",
-		       ppdname,
-		       (human_readable ? "/" : ""),
-		       (human_readable ? human_readable : ""));
+      {
+	cupsFilePrintf(fp, "*InputSlot %s%s%s:\"\"\n", ppdname, human_readable ? "/" : "", human_readable ? human_readable : "");
+	ppd_put_string(fp, lang, "InputSlot", ppdname, human_readable);
+      }
     }
     cupsFilePuts(fp, "*CloseUI: *InputSlot\n");
   }
@@ -2755,11 +2801,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	    human_readable = (char *)_cupsLangString(lang, media_types[j][1]);
 	    break;
 	  }
-      cupsFilePrintf(fp, "*MediaType %s%s%s: \"<</MediaType(%s)>>setpagedevice\"\n",
-		     ppdname,
-		     (human_readable ? "/" : ""),
-		     (human_readable ? human_readable : ""),
-		     ppdname);
+      cupsFilePrintf(fp, "*MediaType %s: \"<</MediaType(%s)>>setpagedevice\"\n", ppdname, ppdname);
+      ppd_put_string(fp, lang, "MediaType", ppdname, human_readable);
     }
     cupsFilePuts(fp, "*CloseUI: *MediaType\n");
   }
@@ -3213,10 +3256,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	    human_readable = (char *)_cupsLangString(lang, output_bins[j][1]);
 	    break;
 	  }
-      cupsFilePrintf(fp, "*OutputBin %s%s%s: \"\"\n",
-		     ppdname,
-		     (human_readable ? "/" : ""),
-		     (human_readable ? human_readable : ""));
+      cupsFilePrintf(fp, "*OutputBin %s: \"\"\n", ppdname);
+      ppd_put_string(fp, lang, "OutputBin", ppdname, human_readable);
       outputorderinfofound = 0;
       faceupdown = 1;
       firsttolast = 1;
@@ -3454,9 +3495,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	      human_readable = (char *)_cupsLangString(lang, finishings[j][1]);
 	      break;
 	    }
-	cupsFilePrintf(fp, "*StapleLocation %s%s%s: \"\"\n", ppd_keyword,
-		       (human_readable ? "/" : ""),
-		       (human_readable ? human_readable : ""));
+	cupsFilePrintf(fp, "*StapleLocation %s: \"\"\n", ppd_keyword);
+	ppd_put_string(fp, lang, "StapleLocation", ppd_keyword, human_readable);
 	cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*StapleLocation %s\"\n",
 		       value, keyword, ppd_keyword);
       }
@@ -3547,9 +3587,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	      human_readable = (char *)_cupsLangString(lang, finishings[j][1]);
 	      break;
 	    }
-	cupsFilePrintf(fp, "*FoldType %s%s%s: \"\"\n", ppd_keyword,
-		       (human_readable ? "/" : ""),
-		       (human_readable ? human_readable : ""));
+	cupsFilePrintf(fp, "*FoldType %s: \"\"\n", ppd_keyword);
+	ppd_put_string(fp, lang, "FoldType", ppd_keyword, human_readable);
 	cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*FoldType %s\"\n",
 		       value, keyword, ppd_keyword);
       }
@@ -3647,9 +3686,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	      human_readable = (char *)_cupsLangString(lang, finishings[j][1]);
 	      break;
 	    }
-	cupsFilePrintf(fp, "*PunchMedia %s%s%s: \"\"\n", ppd_keyword,
-		       (human_readable ? "/" : ""),
-		       (human_readable ? human_readable : ""));
+	cupsFilePrintf(fp, "*PunchMedia %s: \"\"\n", ppd_keyword);
+	ppd_put_string(fp, lang, "PunchMedia", ppd_keyword, human_readable);
 	cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*PunchMedia %s\"\n",
 		       value, keyword, ppd_keyword);
       }
@@ -3740,9 +3778,8 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 	      human_readable = (char *)_cupsLangString(lang, finishings[j][1]);
 	      break;
 	    }
-	cupsFilePrintf(fp, "*CutMedia %s%s%s: \"\"\n", ppd_keyword,
-		       (human_readable ? "/" : ""),
-		       (human_readable ? human_readable : ""));
+	cupsFilePrintf(fp, "*CutMedia %s: \"\"\n", ppd_keyword);
+	ppd_put_string(fp, lang, "CutMedia", ppd_keyword, human_readable);
 	cupsFilePrintf(fp, "*cupsIPPFinishings %d/%s: \"*CutMedia %s\"\n",
 		       value, keyword, ppd_keyword);
       }
@@ -3788,8 +3825,9 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 				     printer_opt_strings_catalog);
       if (human_readable == NULL)
 	human_readable = (char *)keyword;
-      cupsFilePrintf(fp, "*cupsFinishingTemplate %s/%s: \"\n", keyword,
-		     human_readable);
+      pwg_ppdize_name(keyword, ppdname, sizeof(ppdname));
+      cupsFilePrintf(fp, "*cupsFinishingTemplate %s: \"\n", ppdname);
+      ppd_put_string(fp, lang, "cupsFinishingTemplate", ppdname, human_readable);
       for (finishing_attr = ippFirstAttribute(finishing_col); finishing_attr;
 	   finishing_attr = ippNextAttribute(finishing_col)) {
         if (ippGetValueTag(finishing_attr) == IPP_TAG_BEGIN_COLLECTION) {
@@ -4101,13 +4139,11 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
       if (!preset || !preset_name)
         continue;
 
-      if ((localized_name = lookup_option((char *)preset_name,
-					  opt_strings_catalog,
-					  printer_opt_strings_catalog)) == NULL)
-        cupsFilePrintf(fp, "*APPrinterPreset %s: \"\n", preset_name);
-      else
-        cupsFilePrintf(fp, "*APPrinterPreset %s/%s: \"\n", preset_name,
-		       localized_name);
+      pwg_ppdize_name(preset_name, ppdname, sizeof(ppdname));
+
+      localized_name = lookup_option((char *)preset_name, opt_strings_catalog, printer_opt_strings_catalog);
+      cupsFilePrintf(fp, "*APPrinterPreset %s: \"\n", ppdname);
+      ppd_put_string(fp, lang, "APPrinterPreset", ppdname, localized_name);
 
       for (member = ippFirstAttribute(preset); member;
 	   member = ippNextAttribute(preset)) {
@@ -4148,7 +4184,10 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 		 ippGetString(ippFindAttribute(fin_col,
 					       "finishing-template",
 					       IPP_TAG_ZERO), 0, NULL)) != NULL)
-              cupsFilePrintf(fp, "*cupsFinishingTemplate %s\n", keyword);
+            {
+	      pwg_ppdize_name(keyword, ppdname, sizeof(ppdname));
+              cupsFilePrintf(fp, "*cupsFinishingTemplate %s\n", ppdname);
+            }
           }
         } else if (!strcmp(member_name, "media")) {
          /*
@@ -4181,14 +4220,14 @@ ppdCreateFromIPP2(char         *buffer,          /* I - Filename buffer */
 						       IPP_TAG_ZERO), 0,
 				      NULL)) != NULL) {
             pwg_ppdize_name(keyword, ppdname, sizeof(ppdname));
-            cupsFilePrintf(fp, "*InputSlot %s\n", keyword);
+            cupsFilePrintf(fp, "*InputSlot %s\n", ppdname);
 	  }
 
           if ((keyword = ippGetString(ippFindAttribute(media_col, "media-type",
 						       IPP_TAG_ZERO), 0,
 				      NULL)) != NULL) {
             pwg_ppdize_name(keyword, ppdname, sizeof(ppdname));
-            cupsFilePrintf(fp, "*MediaType %s\n", keyword);
+            cupsFilePrintf(fp, "*MediaType %s\n", ppdname);
 	  }
         } else if (!strcmp(member_name, "print-quality")) {
 	 /*
@@ -4452,15 +4491,28 @@ pwg_ppdize_name(const char *ipp,	/* I - IPP keyword */
 	*end;				/* End of name buffer */
 
 
+  if (!ipp || !_cups_isalnum(*ipp))
+  {
+    *name = '\0';
+    return;
+  }
+
   *name = (char)toupper(*ipp++);
 
   for (ptr = name + 1, end = name + namesize - 1; *ipp && ptr < end;) {
-    if (*ipp == '-') {
+    if (*ipp == '-' && isalnum(ipp[1]))
+    {
       ipp ++;
-      if (_cups_isalpha(*ipp))
-	*ptr++ = (char)toupper(*ipp++ & 255);
-    } else
+      *ptr++ = (char)toupper(*ipp++ & 255);
+    }
+    else if (*ipp == '_' || *ipp == '.' || *ipp == '-' || isalnum(*ipp))
+    {
       *ptr++ = *ipp++;
+    }
+    else
+    {
+      ipp ++;
+    }
   }
 
   *ptr = '\0';
@@ -4497,4 +4549,39 @@ pwg_ppdize_resolution(
       snprintf(name, namesize, "%dx%ddpi", *xres, *yres);
   }
 }
+
+
+/*
+ * 'ppd_put_strings()' - Write localization attributes to a PPD file.
+ */
+
+static void
+ppd_put_string(cups_file_t  *fp,	/* I - PPD file */
+               cups_lang_t  *lang,	/* I - Language */
+	       const char   *ppd_option,/* I - PPD option */
+	       const char   *ppd_choice,/* I - PPD choice */
+	       const char   *text)	/* I - Localized text */
+{
+  if (!text)
+    return;
+
+  // Add the first line of localized text...
+#if CUPS_VERSION_MAJOR > 2
+  cupsFilePrintf(fp, "*%s.%s %s/", cupsLangGetName(lang), ppd_option, ppd_choice);
+#else
+  cupsFilePrintf(fp, "*%s.%s %s/", lang->language, ppd_option, ppd_choice);
+#endif // CUPS_VERSION_MAJOR > 2
+
+  while (*text && *text != '\n')
+  {
+    // Escape ":" and "<"...
+    if (*text == ':' || *text == '<')
+      cupsFilePrintf(fp, "<%02X>", *text);
+    else
+      cupsFilePutChar(fp, *text);
+
+    text ++;
+  }
+  cupsFilePuts(fp, ": \"\"\n");
+}
 #endif /* HAVE_CUPS_1_6 */
-- 
2.43.0

