@@ -24,6 +24,9 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
file://CVE-2026-27447-regression_p1.patch \
file://CVE-2026-27447-regression_p2.patch \
file://CVE-2026-34978.patch \
+ file://CVE-2026-34980.patch \
+ file://CVE-2026-34980-regression_p1.patch \
+ file://CVE-2026-34980-regression_p2.patch \
"
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
new file mode 100644
@@ -0,0 +1,31 @@
+From 3f2bdc293243bca938c6de23ba50e6d783189629 Mon Sep 17 00:00:00 2001
+From: Michael R Sweet <msweet@msweet.org>
+Date: Tue, 28 Apr 2026 17:42:41 -0400
+Subject: [PATCH] Fix filter PPD keyword processing (Issue #1562)
+
+CVE: CVE-2026-34980
+Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/3f2bdc293243bca938c6de23ba50e6d783189629]
+
+(cherry picked from commit 3f2bdc293243bca938c6de23ba50e6d783189629)
+Signed-off-by: Anil Dongare <adongare@cisco.com>
+---
+ scheduler/job.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scheduler/job.c b/scheduler/job.c
+index 895b2d9..915ba94 100644
+--- a/scheduler/job.c
++++ b/scheduler/job.c
+@@ -5419,7 +5419,7 @@ update_job(cupsd_job_t *job) /* I - Job to check */
+ keywords = NULL;
+ num_keywords = cupsParseOptions(message, 0, &keywords);
+
+- for (i = 0, keyword = keywords; i < num_keywords; i ++)
++ for (i = 0, keyword = keywords; i < num_keywords; i ++, keyword ++)
+ {
+ /*
+ * Filter out "special" PPD keywords...
+--
+2.43.7
+
+
new file mode 100644
@@ -0,0 +1,75 @@
+From 52cfb028dc211a0fd9ba6fe6eba6d482ccc6c9af Mon Sep 17 00:00:00 2001
+From: Michael R Sweet <msweet@msweet.org>
+Date: Wed, 8 Apr 2026 16:42:48 -0400
+Subject: [PATCH] Fix get_options regression (Issue #1532)
+
+CVE: CVE-2026-34980
+Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/52cfb028dc211a0fd9ba6fe6eba6d482ccc6c9af]
+
+(cherry picked from commit 52cfb028dc211a0fd9ba6fe6eba6d482ccc6c9af)
+Signed-off-by: Anil Dongare <adongare@cisco.com>
+---
+ scheduler/job.c | 4 ++--
+ test/5.5-lp.sh | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/scheduler/job.c b/scheduler/job.c
+index 6b9d366..cf019e1 100644
+--- a/scheduler/job.c
++++ b/scheduler/job.c
+@@ -4144,7 +4144,7 @@ get_options(cupsd_job_t *job, /* I - Job */
+ case IPP_TAG_CHARSET :
+ case IPP_TAG_LANGUAGE :
+ case IPP_TAG_URI :
+- for (valptr = attr->values[i].string.text; *valptr;)
++ for (valptr = attr->values[i].string.text; *valptr; valptr ++)
+ {
+ /*
+ * Convert tabs and newlines to spaces, filter out control chars,
+@@ -4159,7 +4159,7 @@ get_options(cupsd_job_t *job, /* I - Job */
+ {
+ if (strchr("\\\'\"", *valptr))
+ *optptr++ = '\\';
+- *optptr++ = *valptr++;
++ *optptr++ = *valptr;
+ }
+ }
+
+diff --git a/test/5.5-lp.sh b/test/5.5-lp.sh
+index 25e9d65..fe60890 100644
+--- a/test/5.5-lp.sh
++++ b/test/5.5-lp.sh
+@@ -2,7 +2,7 @@
+ #
+ # Test the lp command.
+ #
+-# Copyright © 2020-2024 by OpenPrinting.
++# Copyright © 2020-2026 by OpenPrinting.
+ # Copyright © 2007-2019 by Apple Inc.
+ # Copyright © 1997-2005 by Easy Software Products, all rights reserved.
+ #
+@@ -72,8 +72,8 @@ echo ""
+
+ echo "LP Flood Test ($1 times in parallel)"
+ echo ""
+-echo " lp -d Test1 testfile.jpg"
+-echo " lp -d Test2 testfile.jpg"
++echo " lp -d Test1 -t 'Flood Test N' testfile.jpg"
++echo " lp -d Test2 -t 'Flood Test N' testfile.jpg"
+ i=0
+ pids=""
+ while test $i -lt $1; do
+@@ -83,9 +83,9 @@ while test $i -lt $1; do
+ j=`expr $j + 1`
+ done
+
+- $runcups $VALGRIND ../systemv/lp -d Test1 ../examples/testfile.jpg 2>&1 &
++ $runcups $VALGRIND ../systemv/lp -d Test1 -t "Flood Test $j" ../examples/testfile.jpg 2>&1 &
+ pids="$pids $!"
+- $runcups $VALGRIND ../systemv/lp -d Test2 ../examples/testfile.jpg 2>&1 &
++ $runcups $VALGRIND ../systemv/lp -d Test2 -t "Flood Test $j" ../examples/testfile.jpg 2>&1 &
+ pids="$pids $!"
+
+ i=`expr $i + 1`
+--
+2.43.7
new file mode 100644
@@ -0,0 +1,97 @@
+From e206c7643a7574cab2e9457eac4c9f755dbf44ff Mon Sep 17 00:00:00 2001
+From: Michael R Sweet <msweet@msweet.org>
+Date: Tue, 31 Mar 2026 14:45:13 -0400
+Subject: [PATCH] Filter out control characters from option values.
+
+CVE: CVE-2026-34980
+Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/8d0f51cac24cb5bf949c5b6a221e51a150d982e3]
+
+Backport Changes:
+- Rebase CHANGES.md placement and scheduler/job.c option-handling context to
+ the CUPS 2.4.11 source carried by this recipe.
+
+(cherry picked from commit 8d0f51cac24cb5bf949c5b6a221e51a150d982e3)
+Signed-off-by: Anil Dongare <adongare@cisco.com>
+---
+ CHANGES.md | 2 ++
+ scheduler/job.c | 41 +++++++++++++++++++++++++++++++++++------
+ 2 files changed, 37 insertions(+), 6 deletions(-)
+
+diff --git a/CHANGES.md b/CHANGES.md
+index 7e24840..9863c17 100644
+--- a/CHANGES.md
++++ b/CHANGES.md
+@@ -9,6 +9,8 @@ Changes in CUPS v2.4.10 (2024-06-18)
+ - Fixed cupsd crash if user does not exist (Issue #1555)
+ - CVE-2026-34978: The RSS notifier could write outside the scheduler's RSS
+ directory.
++- CVE-2026-34980: The scheduler did not filter control characters from option
++ values.
+ - Fixed error handling when reading a mixed `1setOf` attribute.
+ - Fixed scheduler start if there is only domain socket to listen on (Issue #985)
+
+diff --git a/scheduler/job.c b/scheduler/job.c
+index 822a247..895b2d9 100644
+--- a/scheduler/job.c
++++ b/scheduler/job.c
+@@ -4121,9 +4121,21 @@ get_options(cupsd_job_t *job, /* I - Job */
+ case IPP_TAG_URI :
+ for (valptr = attr->values[i].string.text; *valptr;)
+ {
+- if (strchr(" \t\n\\\'\"", *valptr))
+- *optptr++ = '\\';
+- *optptr++ = *valptr++;
++ /*
++ * Convert tabs and newlines to spaces, filter out control chars,
++ * and escape \, ', and ".
++ */
++
++ if (isspace(*valptr & 255))
++ {
++ *optptr++ = ' ';
++ }
++ else if ((*valptr & 255) >= ' ' && *valptr != 0x7f)
++ {
++ if (strchr("\\\'\"", *valptr))
++ *optptr++ = '\\';
++ *optptr++ = *valptr++;
++ }
+ }
+
+ *optptr = '\0';
+@@ -5394,13 +5409,30 @@ update_job(cupsd_job_t *job) /* I - Job to check */
+ else if (loglevel == CUPSD_LOG_PPD)
+ {
+ /*
+- * Set attribute(s)...
++ * Set PPD keyword(s)/value(s)...
+ */
+
++ int i, /* Looping var */
++ num_keywords; /* Number of keywords */
++ cups_option_t *keywords, /* Keywords */
++ *keyword; /* Current keyword */
++
+ cupsdLogJob(job, CUPSD_LOG_DEBUG, "PPD: %s", message);
+
+- job->num_keywords = cupsParseOptions(message, job->num_keywords,
+- &job->keywords);
++ keywords = NULL;
++ num_keywords = cupsParseOptions(message, 0, &keywords);
++
++ for (i = 0, keyword = keywords; i < num_keywords; i ++)
++ {
++ /*
++ * Filter out "special" PPD keywords...
++ */
++
++ if (strcmp(keyword->name, "cupsFilter") && strcmp(keyword->name, "cupsFilter2") && strcmp(keyword->name, "cupsFinishingTemplate") && strcmp(keyword->name, "cupsIPPFinishings") && strcmp(keyword->name, "cupsIPPReason") && strcmp(keyword->name, "cupsMarkerName") && strcmp(keyword->name, "cupsMaxSize") && strncmp(keyword->name, "cupsMediaQualifier", 18) && strcmp(keyword->name, "cupsMinSize") && strcmp(keyword->name, "cupsPageSizeCategory") && strcmp(keyword->name, "cupsPortMonitor") && strcmp(keyword->name, "cupsPreFilter") && strcmp(keyword->name, "cupsPrintQuality") && strcmp(keyword->name, "APPrinterPreset"))
++ job->num_keywords = cupsAddOption(keyword->name, keyword->value, job->num_keywords, &job->keywords);
++ }
++
++ cupsFreeOptions(num_keywords, keywords);
+ }
+ else
+ {
+--
+2.43.7