From f13050a4dea5d2f65a8e4823719e18a55ef0dc1e Mon Sep 17 00:00:00 2001 From: Carmelo Date: Fri, 30 Oct 2026 17:48:28 +0800 Subject: [PATCH] Fix out-of-bounds accesses in debug-only code --- cups/jwt.c | 7 ++++++- cups/tls-openssl.c | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/cups/jwt.c b/cups/jwt.c index a06bc6db3..a51003a47 100644 --- a/cups/jwt.c +++ b/cups/jwt.c @@ -405,7 +405,12 @@ cupsJWTHasValidSignature( if (!jwt || !jwt->signature || !jwk) return (false); - DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<%02X%02X%02X%02X...%02X%02X%02X%02X>", jwt->sigalg, (unsigned)jwt->sigsize, jwt->signature[0], jwt->signature[1], jwt->signature[2], jwt->signature[3], jwt->signature[jwt->sigsize - 4], jwt->signature[jwt->sigsize - 3], jwt->signature[jwt->sigsize - 2], jwt->signature[jwt->sigsize - 1]); +#ifdef DEBUG + if (jwt->sigsize >= 8) + DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<%02X%02X%02X%02X...%02X%02X%02X%02X>", jwt->sigalg, (unsigned)jwt->sigsize, jwt->signature[0], jwt->signature[1], jwt->signature[2], jwt->signature[3], jwt->signature[jwt->sigsize - 4], jwt->signature[jwt->sigsize - 3], jwt->signature[jwt->sigsize - 2], jwt->signature[jwt->sigsize - 1]); + else + DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<...>", jwt->sigalg, (unsigned)jwt->sigsize); +#endif // DEBUG switch (jwt->sigalg) { diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c index a1a8b0533..8712ac90a 100644 --- a/cups/tls-openssl.c +++ b/cups/tls-openssl.c @@ -1210,7 +1210,7 @@ cupsSignCredentialsRequest( #ifdef DEBUG char *tempptr; // Pointer into string - for (j = 0, tempptr = temp; j < datalen; j ++, tempptr += 2) + for (j = 0, tempptr = temp; j < datalen && tempptr < (temp + sizeof(temp) - 2); j ++, tempptr += 2) snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), "%02X", data[j]); DEBUG_printf("1cupsSignCredentialsRequest: EXT%d=%s", OBJ_obj2nid(obj), temp);