From ce806a465d51ada9c6248c914c1c7a1aceecd5dc Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 13 Apr 2023 07:27:40 +0200
Subject: [PATCH] Fix crash in `write_log()` due invalid buffer size

I've encountered it when I was starting lprint service and it crashed on
this function - the crash itself appeared because pappl is now built
with _FORTIFY_SOURCE=3, which detects this invalid buffer size and crash
the application.

The problem was that higher pointer was subtracted from a lower to get
buffer size, so it ended up negative. The fix is from upstream, see the
link in SPEC file.
---
 pappl-writelog.patch | 45 ++++++++++++++++++++++++++++++++++++++++++++
 pappl.spec           |  8 +++++++-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 pappl-writelog.patch

diff --git a/pappl-writelog.patch b/pappl-writelog.patch
new file mode 100644
index 0000000..21c95dc
--- /dev/null
+++ b/pappl-writelog.patch
@@ -0,0 +1,45 @@
+diff --git a/pappl/log.c b/pappl/log.c
+index 0559034..f740c3b 100644
+--- a/pappl/log.c
++++ b/pappl/log.c
+@@ -565,7 +565,7 @@ write_log(pappl_system_t   *system,	// I - System
+ 	case 'e' :
+ 	case 'f' :
+ 	case 'g' :
+-	    snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, double));
++	    snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, double));
+ 	    bufptr += strlen(bufptr);
+ 	    break;
+ 
+@@ -579,18 +579,18 @@ write_log(pappl_system_t   *system,	// I - System
+ 	case 'x' :
+ #  ifdef HAVE_LONG_LONG
+             if (size == 'L')
+-	      snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, long long));
++	      snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, long long));
+ 	    else
+ #  endif // HAVE_LONG_LONG
+             if (size == 'l')
+-	      snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, long));
++	      snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, long));
+ 	    else
+-	      snprintf(bufptr, (size_t)(bufptr - bufend + 1), tformat, va_arg(ap, int));
++	      snprintf(bufptr, (size_t)(bufend - bufptr), tformat, va_arg(ap, int));
+             bufptr += strlen(bufptr);
+             break;
+ 
+         case 'p' : // Log a pointer
+-            snprintf(bufptr, (size_t)(bufptr - bufend + 1), "%p", va_arg(ap, void *));
++            snprintf(bufptr, (size_t)(bufend - bufptr), "%p", va_arg(ap, void *));
+             bufptr += strlen(bufptr);
+             break;
+ 
+@@ -651,7 +651,7 @@ write_log(pappl_system_t   *system,	// I - System
+             break;
+ 
+         default : // Something else we don't support
+-            papplCopyString(bufptr, tformat, (size_t)(bufptr - bufend + 1));
++            papplCopyString(bufptr, tformat, (size_t)(bufend - bufptr));
+             bufptr += strlen(bufptr);
+             break;
+       }
diff --git a/pappl.spec b/pappl.spec
index a4a099c..cce2fbc 100644
--- a/pappl.spec
+++ b/pappl.spec
@@ -10,11 +10,14 @@
 Summary: Printer Application Framework (PAPPL)
 Name: pappl
 Version: 1.3.1
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Apache-2.0
 Source: https://github.com/michaelrsweet/pappl/releases/download/v%{version}/pappl-%{version}.tar.gz
 Url: https://www.msweet.org/pappl
 
+# https://github.com/michaelrsweet/pappl/pull/272
+Patch0001: pappl-writelog.patch
+
 BuildRequires: avahi-devel
 BuildRequires: cups-devel
 BuildRequires: gcc
@@ -88,6 +91,9 @@ rm -f %{buildroot}/%{_libdir}/libpappl.a
 %{_libdir}/pkgconfig/pappl.pc
 
 %changelog
+* Thu Apr 13 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.3.1-3
+- fix crash due invalid buffer size in `write_log()`
+
 * Thu Feb 16 2023 Richard Lescak <rlescak@redhat.com> - 1.3.1-2
 - SPDX migration