CVE-2023-34095 (C, published 2023-06-14T17:15Z)
Description: value: cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/OpenPrinting/cpdb-libs
Files changed:
cpdb/cpdb-frontend.c
tools/cpdb-text-frontend.c
Commit message: Merge pull request from GHSA-25j7-9gfc-f46x

cpdb-libs uses the fscanf() and scanf() functions to parse command
lines and configuration files, dropping the read string components
into fixed-length buffers, but does not limit the length of the
strings to be read by fscanf() and scanf() causing buffer overflows
when a string is longer than 1023 characters.

As all buffers have a length of 1024 characters we limit the maximum string
length to be read to 1023 by replaceing all occurences of "%s" by "%1023s"
in all calls of the fscanf() and scanf() functions.

Simply done by

perl -p -i -e 's/(scanf\(.*?".*?)%s/\1%1023s/' cpdb/cpdb-frontend.c tools/cpdb-text-frontend.c

and verifying with

grep scanf */*.c

Vulnerable code:
    if (fscanf(file, "%s", obj_path) == 0)
        scanf("%s", buf);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s%s", option_name, printer_id, backend_name);
            scanf("%s%s%s", setting_name, printer_id, backend_name);
            scanf("%s%s%s", option_name, printer_id, backend_name);
            scanf("%s %s %s %s", option_name, option_val, printer_id, backend_name);
            scanf("%s%s%s", option_name, printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s", backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s%s", file_path, printer_id, backend_name);
              scanf("%s", final_file_path);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s%s", job_id, printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s%s", option_name, printer_id, backend_name);
            scanf("%s%s%s%s", option_name, choice_name, printer_id, backend_name);
            scanf("%s%s%s", group_name, printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s%s", media, printer_id, backend_name);
            scanf("%s%s%s", media, printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);
            scanf("%s%s", printer_id, backend_name);

Fixed code:
    if (fscanf(file, "%1023s", obj_path) == 0)
        scanf("%1023s", buf);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s%1023s", option_name, printer_id, backend_name);
            scanf("%1023s%1023s%1023s", setting_name, printer_id, backend_name);
            scanf("%1023s%1023s%1023s", option_name, printer_id, backend_name);
            scanf("%1023s %1023s %1023s %1023s", option_name, option_val, printer_id, backend_name);
            scanf("%1023s%1023s%1023s", option_name, printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s", backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s%1023s", file_path, printer_id, backend_name);
              scanf("%1023s", final_file_path);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s%1023s", job_id, printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s%1023s", option_name, printer_id, backend_name);
            scanf("%1023s%1023s%1023s%1023s", option_name, choice_name, printer_id, backend_name);
            scanf("%1023s%1023s%1023s", group_name, printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s%1023s", media, printer_id, backend_name);
            scanf("%1023s%1023s%1023s", media, printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);
            scanf("%1023s%1023s", printer_id, backend_name);