rpms/cups
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Use upstream patch for stringpool corruption issue (bug #974048).

Browse Source 
Resolves: rhbz#974048
This commit is contained in:
Tim Waugh 2013-11-07 13:30:13 +00:00
parent 46aab5fd7c
commit 1e73bb4f8e
3 changed files with 99 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
cups-stringpool-rdar15382819.patch Normal file
View File

@ -0,0 +1,93 @@
diff -up cups-1.7.0/scheduler/printers.c.stringpool-rdar15382819 cups-1.7.0/scheduler/printers.c
--- cups-1.7.0/scheduler/printers.c.stringpool-rdar15382819 2013-11-07 13:26:56.077499193 +0000
+++ cups-1.7.0/scheduler/printers.c 2013-11-07 13:27:54.665787144 +0000
@@ -1876,12 +1876,13 @@ void
cupsdSetPrinterAttr(
cupsd_printer_t *p, /* I - Printer */
const char *name, /* I - Attribute name */
- char *value) /* I - Attribute value string */
+ const char *value) /* I - Attribute value string */
{
ipp_attribute_t *attr; /* Attribute */
int i, /* Looping var */
count; /* Number of values */
- char *ptr, /* Pointer into value */
+ char *temp, /* Temporary copy of value string */
+ *ptr, /* Pointer into value */
*start, /* Start of value */
quote; /* Quote character */
ipp_tag_t value_tag; /* Value tag for this attribute */
@@ -1898,10 +1899,21 @@ cupsdSetPrinterAttr(
}
/*
+ * Copy the value string so we can do what we want with it...
+ */
+
+ if ((temp = strdup(value)) == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+ "Unable to duplicate value for \"%s\" attribute.", name);
+ return;
+ }
+
+ /*
* Count the number of values...
*/
- for (count = 1, quote = '\0', ptr = value;
+ for (count = 1, quote = '\0', ptr = temp;
*ptr;
ptr ++)
{
@@ -1949,15 +1961,15 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0; i < count; i ++)
+ for (i = 0, start = temp; i < count; i ++)
{
- if ((ptr = strchr(value, ',')) != NULL)
+ if ((ptr = strchr(start, ',')) != NULL)
*ptr++ = '\0';
- attr->values[i].integer = strtol(value, NULL, 10);
+ attr->values[i].integer = strtol(start, NULL, 10);
if (ptr)
- value = ptr;
+ start = ptr;
}
}
else
@@ -1999,7 +2011,7 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0, quote = '\0', ptr = value; i < count; i ++)
+ for (i = 0, quote = '\0', ptr = temp; i < count; i ++)
{
for (start = ptr; *ptr; ptr ++)
{
@@ -2028,6 +2040,8 @@ cupsdSetPrinterAttr(
attr->values[i].string.text = _cupsStrAlloc(start);
}
}
+
+ free(temp);
}
diff -up cups-1.7.0/scheduler/printers.h.stringpool-rdar15382819 cups-1.7.0/scheduler/printers.h
--- cups-1.7.0/scheduler/printers.h.stringpool-rdar15382819 2013-05-29 12:51:34.000000000 +0100
+++ cups-1.7.0/scheduler/printers.h 2013-11-07 13:27:54.666787149 +0000
@@ -166,7 +166,8 @@ extern int cupsdSetAuthInfoRequired(cup
ipp_attribute_t *attr);
extern void cupsdSetDeviceURI(cupsd_printer_t *p, const char *uri);
extern void cupsdSetPrinterAttr(cupsd_printer_t *p,
- const char *name, char *value);
+ const char *name,
+ const char *value);
extern void cupsdSetPrinterAttrs(cupsd_printer_t *p);
extern int cupsdSetPrinterReasons(cupsd_printer_t *p,
const char *s);

64
cups-stringpool-setprinterattr.patch
View File

@ -1,64 +0,0 @@
diff -up cups-1.7b1/scheduler/printers.c.stringpool-setprinterattr cups-1.7b1/scheduler/printers.c
--- cups-1.7b1/scheduler/printers.c.stringpool-setprinterattr 2013-06-13 12:18:04.678129506 +0100
+++ cups-1.7b1/scheduler/printers.c 2013-06-13 12:18:04.721129670 +0100
@@ -1881,6 +1881,7 @@ cupsdSetPrinterAttr(
ipp_attribute_t *attr; /* Attribute */
int i, /* Looping var */
count; /* Number of values */
+ char *value_dup; /* Copy of attribute value string */
char *ptr, /* Pointer into value */
*start, /* Start of value */
quote; /* Quote character */
@@ -1949,16 +1950,24 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0; i < count; i ++)
+ if ((value_dup = strdup(value)) == NULL)
{
- if ((ptr = strchr(value, ',')) != NULL)
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
+ return;
+ }
+
+ for (i = 0, start = value_dup; i < count; i ++)
+ {
+ if ((ptr = strchr(start, ',')) != NULL)
*ptr++ = '\0';
- attr->values[i].integer = strtol(value, NULL, 10);
+ attr->values[i].integer = strtol(start, NULL, 10);
if (ptr)
- value = ptr;
+ start = ptr;
}
+
+ free(value_dup);
}
else
{
@@ -1999,7 +2008,13 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0, quote = '\0', ptr = value; i < count; i ++)
+ if ((value_dup = strdup(value)) == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
+ return;
+ }
+
+ for (i = 0, quote = '\0', ptr = value_dup; i < count; i ++)
{
for (start = ptr; *ptr; ptr ++)
{
@@ -2027,6 +2042,8 @@ cupsdSetPrinterAttr(
attr->values[i].string.text = _cupsStrAlloc(start);
}
+
+ free(value_dup);
}
}

9
cups.spec
View File

@ -11,7 +11,7 @@ Summary: CUPS printing system
Name: cups Name: cups
Epoch: 1 Epoch: 1
Version: 1.7.0 Version: 1.7.0
Release: 4%{?dist} Release: 5%{?dist}
License: GPLv2 License: GPLv2
Group: System Environment/Daemons Group: System Environment/Daemons
Url: http://www.cups.org/ Url: http://www.cups.org/
@ -56,7 +56,7 @@ Patch25: cups-systemd-socket.patch
Patch26: cups-lpd-manpage.patch Patch26: cups-lpd-manpage.patch
Patch27: cups-avahi-address.patch Patch27: cups-avahi-address.patch
Patch29: cups-enum-all.patch Patch29: cups-enum-all.patch
Patch30: cups-stringpool-setprinterattr.patch Patch30: cups-stringpool-rdar15382819.patch
Patch31: cups-dymo-deviceid.patch Patch31: cups-dymo-deviceid.patch
Patch32: cups-freebind.patch Patch32: cups-freebind.patch
Patch33: cups-no-gcry.patch Patch33: cups-no-gcry.patch
@ -242,7 +242,7 @@ Sends IPP requests to the specified URI and tests and/or displays the results.
# Return from cupsEnumDests() once all records have been returned. # Return from cupsEnumDests() once all records have been returned.
%patch29 -p1 -b .enum-all %patch29 -p1 -b .enum-all
# Prevent stringpool damage leading to memory leaks (bug #974048). # Prevent stringpool damage leading to memory leaks (bug #974048).
%patch30 -p1 -b .stringpool-setprinterattr %patch30 -p1 -b .stringpool-rdar15382819
# Added IEEE 1284 Device ID for a Dymo device (bug #747866). # Added IEEE 1284 Device ID for a Dymo device (bug #747866).
%patch31 -p1 -b .dymo-deviceid %patch31 -p1 -b .dymo-deviceid
# Use IP_FREEBIND socket option when binding listening sockets (bug #970809). # Use IP_FREEBIND socket option when binding listening sockets (bug #970809).
@ -652,6 +652,9 @@ rm -f %{cups_serverbin}/backend/smb
%{_mandir}/man5/ipptoolfile.5.gz %{_mandir}/man5/ipptoolfile.5.gz
%changelog %changelog
* Thu Nov 7 2013 Tim Waugh <twaugh@redhat.com> - 1:1.7.0-5
- Use upstream patch for stringpool corruption issue (bug #974048).
* Mon Nov 4 2013 Tim Waugh <twaugh@redhat.com> - 1:1.7.0-4 * Mon Nov 4 2013 Tim Waugh <twaugh@redhat.com> - 1:1.7.0-4
- Adjusted commented out default for SyncOnClose in cups-files.conf. - Adjusted commented out default for SyncOnClose in cups-files.conf.