Integer overflow in httpGetDateTime()
Maintainers usually reply within 1 day
@michaelrsweet is already working on this.
Since Sep 24, 2026.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
Research direction
The bug is in cups/http-support.c lines 769-807 in the httpGetDateTime() function. Start by examining the sscanf parsing and the subsequent arithmetic for overflow. Write a test that passes extreme date values to trigger the overflow. Verify the fix by building CUPS and running the HTTP date parsing tests.
Written by the indexing model from the issue text.
Description
Problem:
httpGetDateTime() in cups/http-support.c parses an HTTP date with sscanf() and only rejects a year above 9999 - day, hour, min, sec and the lower bound of year are not checked at all. The unchecked values overflow in int arithmetic at "leap_days[i] + day - 1", "normal_days[i] + day - 1", "(year - 1970) * 365" and "hour * 3600" / "min * 60".
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Reporter: Pavel Nekrasov ([email protected]).
- Dominant language
- C
- Stars
- 1.8k
- Forks
- 341
- Avg merge
- 15h 28m
- Merged PRs (30d)
- 5
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenPrinting/cups
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenPrinting/cups#1721 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
OpenPrinting/cups#1724 ·
Maintainers usually reply within 1 day
-
Buffer overflow in cupsSideChannelSNMPGet()Possibly taken @michaelrsweet claimed this 4 days ago. Openinvestigating
Difficulty 4/5 3-5 days Newbie friendliness 45/100
OpenPrinting/cups#1719 · 1 assignee ·
Maintainers usually reply within 1 day
-
Integer overflow in show_supplies()Possibly taken @michaelrsweet claimed this 4 days ago. Openenhancement investigating
Difficulty 3/5 1-2 days Newbie friendliness 65/100
OpenPrinting/cups#1715 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
OpenPrinting/cups#1707 · 4 comments ·
Maintainers usually reply within 1 day
All issues in OpenPrinting/cups
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
BasedHardware/omi#19711 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
microsoft/ebpf-for-windows#5604 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
trezor/trezor-firmware#7985 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 2 days