From da4902f201e83bc48463e289b7af2c1d35200458 Mon Sep 17 00:00:00 2001 From: Pavel Nekrasov Date: Wed, 23 Sep 2026 13:41:33 +0300 Subject: [PATCH] Fix: TAINTED.INT_OVERFLOW Problem: httpGetDateTime() never range checks day, hour, min, sec and the lower bound of year after sscanf(), so they overflow in the int arithmetic that follows. The date string is remote input - cupsd feeds it the If-Modified-Since request header. Solution: Range checked day, hour, min, sec and year right after sscanf(). Signed-off-by: p.nekrasov@fobos-nt.ru Signed-off-by: Timofei Fedotov sovtouch@altlinux.org --- cups/http-support.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cups/http-support.c b/cups/http-support.c index dfdfb1063..599f696ed 100644 --- a/cups/http-support.c +++ b/cups/http-support.c @@ -772,7 +772,10 @@ httpGetDateTime(const char *s) // I - Date/time string DEBUG_printf("4httpGetDateTime: day=%d, mon=\"%s\", year=%d, hour=%d, min=%d, sec=%d", day, mon, year, hour, min, sec); // Check for invalid year (RFC 7231 says it's 4DIGIT) - if (year > 9999) + if (year < 0 || year > 9999) + return (0); + + if (day < 1 || day > 31 || hour < 0 || hour > 23 || min < 0 || min > 59 || sec < 0 || sec > 60) return (0); // Convert the month name to a number from 0 to 11.