Attachment 18903 Details for Bug 16033 – Potential fix

[patch] Potential fix

fix.patch (text/plain), 1.45 KB, created by Volker Lendecke on 2026-03-15 19:05:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-03-15 19:05:28 UTC

Size: 1.45 KB

patch

obsolete

>From 863bd2d817301374e33bc79fc0a3e3a28e95c188 Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Sun, 15 Mar 2026 19:15:14 +0100
>Subject: [PATCH] printing: Shell-sanitize jobname passed as %J to "print
> command"
>
>Fix an unauthenticated remote code execution vulnerability with
>printing set to anything *but* cups and iprint, for example "lprng",
>so that "print command" is executed upon job submission. If the
>client-controlled job name is handed to the "print command" via "%J",
>rpcd_spoolssd passes this to the shell without escaping critical
>characters.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=16033
>Signed-off-by: Volker Lendecke <vl@samba.org>
>---
> source3/printing/print_generic.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
>diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
>index 855de4ca1f3..55734363fbd 100644
>--- a/source3/printing/print_generic.c
>+++ b/source3/printing/print_generic.c
>@@ -255,12 +255,17 @@ static int generic_job_submit(int snum, struct printjob *pjob,
> 		return -1;
> 	}
> 
>-	jobname = talloc_strdup(ctx, pjob->jobname);
>-	if (!jobname) {
>-		ret = -1;
>-		goto out;
>+	{
>+		char *name = escape_shell_string(pjob->jobname);
>+		if (name == NULL) {
>+			ret = -1;
>+			goto out;
>+		}
>+
>+		jobname = talloc_string_sub(ctx, name, "'", "_");
>+		SAFE_FREE(name);
> 	}
>-	jobname = talloc_string_sub(ctx, jobname, "'", "_");
>+
> 	if (!jobname) {
> 		ret = -1;
> 		goto out;
>-- 
>2.47.3
>

Flags:

vl: ci-passed+

Actions: View

Attachments on bug 16033: 18903 | 18905 | 18915 | 18916 | 18917 | 18918 | 18919 | 18925 | 18962 | 18968 | 18969 | 18972 | 18973 | 18974 | 18975