From 97bcde03d1f854c1ad8aa4804113e376214f76f4 Mon Sep 17 00:00:00 2001 From: Pavel Nekrasov Date: Wed, 23 Sep 2026 13:24:14 +0300 Subject: [PATCH] Fix: INTEGER_OVERFLOW Problem: show_supplies() reads the supply level from the "supply%d" field of an unauthenticated GET request with atoi() and never range checks it. The value is stored in printer-supply, read back with atoi() and used as "level * 2", which overflows for both large negative and large positive levels. Solution: Clamped level to the 0..100 range declared by maxcapacity in printer-supply, both after reading the form field and after parsing it back out of printer-supply. Signed-off-by: p.nekrasov@fobos-nt.ru Signed-off-by: Timofei Fedotov sovtouch@altlinux.org --- tools/ippeveprinter.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tools/ippeveprinter.c b/tools/ippeveprinter.c index 7496f7fdf..487f97a0c 100644 --- a/tools/ippeveprinter.c +++ b/tools/ippeveprinter.c @@ -7597,6 +7597,11 @@ show_supplies( { level = atoi(val); // New level + if (level < 0) + level = 0; + else if (level > 100) + level = 100; + snprintf(supply_text, sizeof(supply_text), printer_supply[i], level); if (supply) ippSetOctetString(printer->attrs, &supply, ippGetCount(supply), supply_text, strlen(supply_text)); @@ -7641,6 +7646,11 @@ show_supplies( else level = 50; + if (level < 0) + level = 0; + else if (level > 100) + level = 100; + if (printer->web_forms) html_printf(client, "%s:", ippGetString(supply_desc, i, NULL), (unsigned)i, level); else