cupsd segfaults when SLP browsing is enabled #259

michaelrsweet · 2003-09-02T06:45:56Z

Version: 1.1.19
CUPS.org User: seitz.ergon

On my Debian System cupsd segfaults when browsing using SLP is
switched on.

I identified a write to a NULL pointer as the problem.

A patch that seems to solve the problem follows:

diff -Naur cupsys-1.1.19-orig/scheduler/dirsvc.c cupsys-1.1.19-patched/scheduler/dirsvc.c
--- cupsys-1.1.19-orig/scheduler/dirsvc.c Mon May 12 22:51:53 2003
+++ cupsys-1.1.19-patched/scheduler/dirsvc.c Thu Aug 28 15:24:27 2003
@@ -1636,8 +1636,7 @@
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute */

         char       _valbuf,      /_ O - Value */

         int        valbuflen)    /\* I - Max length of value */

```
         char       *valbuf)      /* O - Value */
```
{
char ptr1, / Pointer into string /
*ptr2; / ... */
@@ -1651,7 +1650,7 @@

if ((ptr2 = strchr(ptr1,')')) != NULL)
{
```
 if (valbuflen > (ptr2 - ptr1))
```
```
 if (IPP_MAX_NAME > (ptr2 - ptr1))
```
{
/*
* Copy the value...
@@ -1659,7 +1658,6 @@
```
 strncpy(valbuf, ptr1, ptr2 - ptr1);
valbuf[ptr2 - ptr1] = '\0';
```
```
/*
 * Dequote the value...
*/
```
@@ -1708,23 +1706,20 @@
- Parse the attrlist to obtain things needed to build CUPS browse packet
  */
memset(p, 0, sizeof(printer_t));

p->type = CUPS_PRINTER_REMOTE;

if (GetSlpAttrVal(attrlist, "(printer-location=", p->location,
```
               sizeof(p->location)))
```
if (GetSlpAttrVal(attrlist, "(printer-location=", p->location))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model,
```
               sizeof(p->make_model)))
```
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(color-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(color-supported=", tmp))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;
if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;
@@ -1733,7 +1728,7 @@
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;
if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;
@@ -1820,6 +1815,10 @@
resource[HTTP_MAX_URI]; /* Resource portion of URI /
int port; / Port portion of URI */
/* initialize p */
memset(&p, 0, sizeof(printer_t));
p.make_model=(char*)malloc(IPP_MAX_NAME);
p.location=(char*)malloc(IPP_MAX_NAME);

LogMessage(L_DEBUG, "UpdateSLPBrowse() Start...");

@@ -1893,6 +1892,8 @@

 free(s);

}

free(p.location);
free(p.make_model);

LogMessage(L_DEBUG, "UpdateSLPBrowse() End...");
}

The text was updated successfully, but these errors were encountered:

michaelrsweet · 2003-09-02T20:12:30Z

CUPS.org User: mike

OK, thanks for reporting this - that might be a reason that things have not been working as expected in recent releases.

The patch you've submitted is not quite correct (at least it is not how we want to implement the fix), however I will update this STR with the official patch once the fix is created.

Thanks for the report!

michaelrsweet · 2003-09-02T20:38:15Z

CUPS.org User: mike

Please try the attached patch to confirm that it fixes your problem.

michaelrsweet · 2003-09-03T14:54:09Z

CUPS.org User: mike

OK, new patch against 1.1.19 that cleans things up...

Please let me know how you all make out...

michaelrsweet · 2003-09-03T15:11:47Z

CUPS.org User: paul.cunningham.sun

Where can I find the new version of the patch?

michaelrsweet · 2003-09-03T15:32:14Z

CUPS.org User: mike

Look under the "trouble report files" section of the STR page and download str259v2.patch...

michaelrsweet · 2003-09-04T11:34:14Z

CUPS.org User: paul.cunningham.sun

Hi,

I applied the str259v2.patch to dirsrc.c in CUPs 1.1.19 but it failed to build with a link problem .....

Linking cupsd...
Undefined first referenced
symbol in file
cups_strcpy dirsvc.o

I could not find cups_strcpy() in the source code so temporarily changed it to strcpy(), it then built okay.

But when I ran this patched cupsd against slp, a printer add (with lpadmin) still locked up as before.

Any ideas?

I have checked that the patch was applied successfully but will check again now.

Paul

michaelrsweet · 2003-09-05T13:02:50Z

CUPS.org User: paul.cunningham.sun

Hi,

I did a bit of debugging on solaris 9 for the failure that I get and it looks like my problem is with null pointers for '*src' on the following lines ....

for (src = p->make_model, dst = make_model; *src;)

for (src = p->location, dst = location; *src;)

for (src = p->info, dst = info; *src;)

in function SendSLPBrowse() in module schedule/dirsvc.c.

I think if any of the following are null, p->make_model, p->location or src = p->info, then the *src check will cause the problem (ie. there were on specified on the lpadmin command line).

I applied the ammended patch dirsvc.c.patch and then it seems to work okay against SLP on Solaris.

paul

michaelrsweet · 2003-09-05T19:09:42Z

CUPS.org User: paul.cunningham.sun

I spoke to soon, it now fails somewhere else after a printer has been added okay and the cupsd has been up and running for a while ......

stopped in _poll at 0xdd98d2c9
0xdd98d2c9: _poll+0x000c: jae _poll+0x21 <0xdd98d2de>
(/ws/on81-tools/SUNWspro/SC6.1/bin/dbx) cont
signal SEGV (no mapping at the fault address) in _smalloc at 0xdd99de09
0xdd99de09: _smalloc+0x0078: movl 8(%eax),%ecx
(/ws/on81-tools/SUNWspro/SC6.1/bin/dbx) where
=>[1] _smalloc(0x8), at 0xdd99de09
[2] _malloc_unlocked(0x8), at 0xdd99e066
[3] malloc(0x5), at 0xdd99de57
[4] _strdup(0x8083ad2, 0x1, 0xdda12494, 0xddb08152), at 0xdd9a85a3
[5] ippAddString(), at 0xddb08214
[6] add_printer_state_reasons(0x80c34ac, 0x81da3f8, 0x44, 0x806c71d,
0x8099594, 0x80c34ac, 0x8083645, 0x0, 0x8099594, 0x80c5ab6, 0x80c38dc, 0x2, 0x0,
0x0, 0x0, 0x3f589587, 0x1, 0x989680, 0x0, 0x81d8938, 0x81dc300, 0x2, 0x7f000001,
0x0, 0xddb2875d, 0x1, 0xdda12494, 0xa, 0x0, 0x803a3b8, 0x0, 0x803a3b8,
0xdd9a676e, 0xdd9a6804, 0x803a334, 0x1, 0x3e8, 0xa, 0xdd99dd9b, 0x20,
0xdda0e000, 0xdd9ef759, 0xdda0e000, 0x803a35c, 0xdd9ef8cb, 0xdda12494,
0xdda0e000, 0x803a370, 0xdd99de67, 0xdda12494, 0x20, 0xdd99dd9b, 0x0,
0xdda0e000, 0xdd9ef759, 0xdda0e000, 0x803a390, 0xdd9ef8cb, 0xdd9a863e, 0x44,
0x81dc300, 0xddb27568), at 0x80687be
[7] get_printers(), at 0x806ca13
[8] ProcessIPPRequest(), at 0x80668fa
[9] ReadClient(0x80c34ac, 0x809be48, 0x200, 0x8065be4), at 0x805b631
[10] main(0x1, 0x8047e50, 0x8047e58), at 0x80659f7

I will investigate this further on Monday.

Any comments ?

paul

michaelrsweet · 2003-09-05T20:59:19Z

CUPS.org User: mike

This looks like a malloc heap corruption problem; if you are working from CVS, make sure you update everything on Monday or try the 1.1.20rc1 release to see if the problem continues - the fd set size code was not compatible with Sun's odd implementation...

I'll run tests against Valgrind on Linux to see if there are any pending issues...

michaelrsweet · 2003-09-09T12:41:22Z

CUPS.org User: paul.cunningham.sun

I have tidied up my patch to make it more understandable and efficient, and added it as dirsvc.c.patch.v2

I have now also built cups-1.1.20rc1 but when configured for slp it still fails with a malloc memory problem .....

(/ws/on81-tools/SUNWspro/SC6.1/bin/dbx) where
=>[1] _smalloc(0x8), at 0xdd99de09
[2] _malloc_unlocked(0x8), at 0xdd99e066
[3] malloc(), at 0xdd99de57
[4] GetSlpAttrVal(0x81de884, 0x80838f2, 0x804232c, 0x8064d16), at 0x8064cb4
[5] AttrCallback(), at 0x8064da8
[6] ProcessAttrRplyCallback(0x0, 0x80423f0, 0x81de858, 0x81e0530), at 0xddb64c28
[7] NetworkRqstRply(), at 0xddb64590
[8] ProcessAttrRqst(), at 0xddb6494a
[9] SLPFindAttrs(), at 0xddb64b8e
[10] UpdateSLPBrowse(0xddbf1834, 0x8047e04, 0x8047e88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x809bdc0, 0x809bddc, 0x3f5dc6b5, 0x3f5dc6bd, 0x0, 0x809dea8, 0x809dc98, 0x0, 0x1, 0x0, 0x1000, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,seram# /opt/sfw/cups/sbin/lpadmin -p 0x0, 0x0, 0x0, 0x0), at 0x8065001
[11] main(0x1, 0x8047e48, 0x8047e50), at 0x8065ef7

This occurs after a printer has been added and the cupsd has been running for a few minutes ....

seram# /opt/sfw/cups/bin/lpstat -v
seram# /opt/sfw/cups/sbin/lpadmin -p seram1 -E -v socket://129.156.199.188
seram# /opt/sfw/cups/bin/lpstat -v
device for seram1: socket://129.156.199.188:9100/

This malloc problem does not always occur in the same place.

michaelrsweet · 2003-09-12T14:10:03Z

CUPS.org User: paul.cunningham.sun

I think I have found the malloc problem now. The 'strcpy' in
GetSlpAttrVal() was overrunning the malloced memory if the 'tag' searched for in 'attr' was not the last in the 'attr' list, eg.

    tag: "(xxx="
    attr: "(aaa=bbbb),(xxx=zzzz),(yyy=uuuu)"

I have done a patch for this.

I have also identified a memory leak, function AttrCallback() uses GetSlpAttrVal() to get p->make_model, p->location and tmp (3 times). This memory is malloced by GetSlpAttrVal() but it does not seem to be freed off. My patch also frees of the tmp (using ClearString(), but
the other two I don't think are freed still.

Looking at the code for UpdateSLPBrowse() it calls SLFindAttrs() with AttrCallback() as the call back function, but UpdateSLPBrowse() seems to process the 'p' items within itself. I think it's possible that AttrCallback() may not have set them up by the time UpdateSLPBrowse() tries to process them (but I may be wrong - as I don't know the SLP API - see
http://www.openslp.org/doc/html/ProgrammersGuide/Callbacks.html).

I have posted v3 of the patch : dirsvc.c.patch.v3

michaelrsweet · 2003-09-16T08:37:00Z

CUPS.org User: paul.cunningham.sun

I have change my patch slightly to correct my error in not termination a string copied with strncpy().

The cupsd daemon with slp configured now seems to be running okay.

michaelrsweet · 2003-09-16T20:41:54Z

CUPS.org User: mike

OK, I've added your changes plus a couple buffer checks, and all seems happy with Valgrind, etc. We'll be doing a 1.1.20rc2 release with the combined changes so that others can do testing...

michaelrsweet · 2003-09-27T14:25:19Z

CUPS.org User: christophe.saout

At least on the server side (well, the cups daemon that actually has the printer) it seems to be more or less stable.

A cups daemon on an other machine immediately segfaults when it's configured to support slp browsing and finds the printer on the other server. It reports to have found the printer (in the log file) and then dies.

Is this enough information to reproduce? Tell me if you need more.

Another thing: One time the printer suddenly disapperead from the slp directory agent, but the cups daemon was still running.

michaelrsweet · 2003-09-27T15:35:09Z

CUPS.org User: christophe.saout

Forgot to mention: The crash occurst with 1.1.20rc2 plain and with dirsvc.patch.v4 applied (with a little hand applying)

michaelrsweet · 2003-10-01T14:55:56Z

CUPS.org User: paul.cunningham.sun

Hi,

I think I may have a fix for this later problem, ie. remote cupsd crashes when trying to setup printers read via SLP on another print server. It looks like a problem with a NULL pointer.

Change dirsvc.c function ProcessBrowseData() as follows ...

change from ...

  if (!p->info || strcmp(p->info, info))
  {
    SetString(&p->info, info);
    update = 1;
  }

to ...

  if (( info != NULL) && (!p->info || strcmp(p->info, info)))
  {
    SetString(&p->info, info);
    update = 1;
  }

It may also be a good idea to put NULL checks on all the other string parameters passed into the ...

void
ProcessBrowseData(const char *uri,
cups_ptype_t type,
ipp_pstate_t state,
const char *location,
const char *info,
const char *make_model)

function, ie. on uri, location and make_model, so that they do not have a similar problem in the future.

I will update my dirsvc.c.patch later for cups-1.1.19

michaelrsweet · 2003-10-02T11:05:13Z

CUPS.org User: paul.cunningham.sun

I have now posted the updated patch for dirsvc.v: dirsvc.c.patch.v5, it only deals with 'info' though.

michaelrsweet · 2003-10-04T13:51:29Z

CUPS.org User: chtephan-cups.saout

Yes, this fixes the crash. Thanks.

I found out that this is triggered because the code forgets to retrieve the printer description from the SLP attributes.

Patch posted (line numbers might be a bit off though).

michaelrsweet · 2003-10-04T23:06:50Z

CUPS.org User: chtephan-cups.saout

One more thing: When using slp only browsing the server disables browsing after some time due to "Transport endpoint not connected". It appears that BrowseSocket has to be initialized to -1 in BrowseStart when CUPS browsing is not enabled (adding an else clause to the big if or something). Also it is explicitly set to 0 in StopBrowsing. This should be -1 I assume (because it seems that fd 0 can be on the InputSet for some other reason).

michaelrsweet · 2003-10-09T19:29:22Z

CUPS.org User: mike

OK, I think we are synced up in CVS now; the 1.1.20rc3 release will have all of the combined changes, so let me know if there is anything missing from there (and patches against 1.1.20rc3 or CVS, please...)

michaelrsweet · 2003-10-11T12:53:46Z

CUPS.org User: chtephan-cups.saout

What about the last five text posts? I don't see any of these fixes in rc3... (I've posted a patch for my last post, it's just a small change from = 0 to = -1 and an added else statement anyway)?

michaelrsweet · 2003-10-13T08:41:35Z

CUPS.org User: paul.cunningham.sun

I can not see the last couple of patches either for the update of 'info' state, unless they have been done in a different way.

michaelrsweet · 2003-10-14T08:54:57Z

CUPS.org User: chtephan-cups.saout

There is no CVS access to cups, am I right (or blind)?

Well, I've just posted the patch I was talking about. CUPS has now been rock solid (on both server and clients) using SLP with all patches applied!

michaelrsweet · 2003-10-15T22:34:10Z

CUPS.org User: mike

Sorry, things should be sorted out tonight - the primary CVS server changed but the mirror server wasn't updated...

michaelrsweet · 2003-10-22T11:26:34Z

CUPS.org User: chtephan-cups.saout

Sorry for posting again... but could you please also consider the last patch I posted?

http://www.cups.org/strfiles/259/dirsvc-fdset-zero-fix.patch

The problem description this patch fixes:
When using slp only browsing the server disables browsing after some time due to "Transport endpoint not connected". It appears that BrowseSocket has to be initialized to -1 in BrowseStart when CUPS browsing is not enabled (adding an else clause to the big if or something). Also it is explicitly set to 0 in StopBrowsing. This should be -1 I assume (because it seems that fd 0 can be on the InputSet for some other reason).

michaelrsweet · 2003-10-22T14:42:28Z

CUPS.org User: mike

Thanks, I've applied the patch to CVS; it will be part of the next release candidate!

michaelrsweet · 2003-11-07T19:35:20Z

"str259.patch":

Index: dirsvc.c

RCS file: /development/cvs/cups/scheduler/dirsvc.c,v
retrieving revision 1.118
diff -u -r1.118 dirsvc.c
--- dirsvc.c 2003/08/01 20:00:53 1.118
+++ dirsvc.c 2003/09/02 20:37:35
@@ -1641,8 +1641,7 @@
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute */

         char       _valbuf,  /_ O - Value */

         int        valbuflen)    /\* I - Max length of value */

```
         char       **valbuf) /* O - Value */
```
{
char ptr1, / Pointer into string /
*ptr2; / ... */
@@ -1656,25 +1655,24 @@

if ((ptr2 = strchr(ptr1,')')) != NULL)
{
```
 if (valbuflen > (ptr2 - ptr1))
```
```
 {
```
```
  /*
```
```
   \* Copy the value...
```

- */

```
   strncpy(valbuf, ptr1, ptr2 - ptr1);
```

- valbuf[ptr2 - ptr1] = '\0';

```
  /*
```
```
   \* Dequote the value...
```

- */

for (ptr1 = valbuf; *ptr1; ptr1 ++)
```
if (*ptr1 == '\' && ptr1[1])
```
```
  cups_strcpy(ptr1, ptr1 + 1);
```
```
/*
```
```
 \* Copy the value...
```
```
 */
```
```
   return (0);
```
```
 }
```
```
 ClearString(valbuf);
```
```
 *valbuf = malloc(ptr2 - ptr1 + 1);
```
```
 strcpy(valbuf, ptr1);
```
```
/*
```
```
 \* Dequote the value...
```
```
 */
```
```
 for (ptr1 = valbuf; *ptr1; ptr1 ++)
```
if (*ptr1 == '' && ptr1[1])
```
cups_strcpy(ptr1, ptr1 + 1);
```
```
 return (0);
```
}
}

@@ -1692,7 +1690,7 @@
SLPError errcode,
void *cookie)
{

char tmp[IPP_MAX_NAME];
char tmp = 0;
printer_t *p = (printer_t)cookie;

@@ -1717,19 +1715,17 @@

p->type = CUPS_PRINTER_REMOTE;

if (GetSlpAttrVal(attrlist, "(printer-location=", p->location,
```
               sizeof(p->location)))
```
if (GetSlpAttrVal(attrlist, "(printer-location=", &(p->location)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model,
```
               sizeof(p->make_model)))
```
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", &(p->make_model))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(color-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(color-supported=", &tmp))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;
if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(finishings-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;
@@ -1738,10 +1734,12 @@
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;
if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(sides-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;

ClearString(&tmp);

return (SLP_TRUE);
}

michaelrsweet · 2003-11-07T19:35:20Z

"str259-corrected.patch":

Index: dirsvc.c

RCS file: /home/anoncvs/cups/scheduler/dirsvc.c,v
retrieving revision 1.118
diff -u -r1.118 dirsvc.c
--- dirsvc.c 1 Aug 2003 20:00:53 -0000 1.118
+++ dirsvc.c 3 Sep 2003 07:19:34 -0000
@@ -1641,42 +1641,38 @@
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute */

         char       _valbuf,  /_ O - Value */

         int        valbuflen)    /\* I - Max length of value */

```
         char       *_valbuf) /_ O - Value _/
```
{
char *ptr1, /_ Pointer into string /
*ptr2; / ... */

- valbuf[0] = '\0';

ClearString(valbuf);
if ((ptr1 = strstr(attrlist, tag)) != NULL)
{
ptr1 += strlen(tag);

if ((ptr2 = strchr(ptr1,')')) != NULL)
{
```
 if (valbuflen > (ptr2 - ptr1))
```
```
 {
```
```
  /*
```
```
   \* Copy the value...
```

- */

```
   strncpy(valbuf, ptr1, ptr2 - ptr1);
```

- valbuf[ptr2 - ptr1] = '\0';

```
  /*
```
```
   \* Dequote the value...
```

- */

for (ptr1 = valbuf; *ptr1; ptr1 ++)
```
if (*ptr1 == '\' && ptr1[1])
```
```
  cups_strcpy(ptr1, ptr1 + 1);
```
```
/*
```
```
 \* Copy the value...
```
```
 */
```
```
 *valbuf = malloc(ptr2 - ptr1 + 1);
```
```
 strcpy(*valbuf, ptr1);
```
```
/*
```
```
 \* Dequote the value...
```
```
 */
```
```
 for (ptr1 = *valbuf; *ptr1; ptr1 ++)
```
```
   if (*ptr1 == '\' && ptr1[1])
```
```
     cups_strcpy(ptr1, ptr1 + 1);
```
```
   return (0);
```
```
 }
```
```
 return (0);
```
}
}
*valbuf = malloc(1);
(*valbuf)[0] = '\0';

return (-1);
}
@@ -1692,7 +1688,7 @@
SLPError errcode,
void *cookie)
{

char tmp[IPP_MAX_NAME];
char tmp = 0;
printer_t *p = (printer_t)cookie;

@@ -1717,19 +1713,17 @@

p->type = CUPS_PRINTER_REMOTE;

if (GetSlpAttrVal(attrlist, "(printer-location=", p->location,
```
               sizeof(p->location)))
```
if (GetSlpAttrVal(attrlist, "(printer-location=", &(p->location)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model,
```
               sizeof(p->make_model)))
```
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", &(p->make_model)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(color-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(color-supported=", &tmp))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;
if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(finishings-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;
@@ -1738,10 +1732,12 @@
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;
if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(sides-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;

ClearString(&tmp);

return (SLP_TRUE);
}

michaelrsweet · 2003-11-07T19:35:20Z

"str259v2.patch":

Index: dirsvc.c

RCS file: /development/cvs/cups/scheduler/dirsvc.c,v
retrieving revision 1.115
retrieving revision 1.122
diff -u -r1.115 -r1.122
--- dirsvc.c 2003/05/12 20:51:53 1.115
+++ dirsvc.c 2003/09/03 14:51:31 1.122
@@ -886,15 +886,20 @@
if (setgid(Group))
exit(errno);

if (setgroups(1, &Group))
```
     exit(errno);
```
if (setuid(User))
exit(errno);
}
```
/*
```

 \* Reset group membership to just the main one we belong to.

```
 */
```
```
 else
```
```
 {
```
```
  /*
```
* Reset group membership to just the main one we belong to.
*/
```
 setgroups(0, NULL);
```
setgroups(1, &Group);
```
 }
```
/*
- Redirect stdin and stdout to /dev/null, and stderr to the
  @@ -1362,7 +1367,7 @@
  - Copy over the buffer data we've used up...
    */
strcpy(buffer, lineptr);
cups_strcpy(buffer, lineptr);
bufused -= lineptr - buffer;

if (bufused < 0)
@@ -1636,14 +1641,13 @@
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute */

         char       _valbuf,  /_ O - Value */

         int        valbuflen)    /\* I - Max length of value */

```
         char       **valbuf) /* O - Value */
```
{
char ptr1, / Pointer into string /
*ptr2; / ... */
valbuf[0] = '\0';
ClearString(valbuf);

if ((ptr1 = strstr(attrlist, tag)) != NULL)
{
@@ -1651,25 +1655,22 @@

if ((ptr2 = strchr(ptr1,')')) != NULL)
{

```
 if (valbuflen > (ptr2 - ptr1))
```
```
 {
```
```
  /*
```
```
   \* Copy the value...
```
*/
```
/*
```
```
 \* Copy the value...
```
```
 */
```
```
   strncpy(valbuf, ptr1, ptr2 - ptr1);
```
valbuf[ptr2 - ptr1] = '\0';
```
 *valbuf = malloc(ptr2 - ptr1 + 1);
```
```
 strcpy(*valbuf, ptr1);
```
```
  /*
```
```
   \* Dequote the value...
```
*/
```
/*
```
```
 \* Dequote the value...
```
```
 */
```
for (ptr1 = valbuf; *ptr1; ptr1 ++)
```
if (*ptr1 == '\' && ptr1[1])
```
```
  strcpy(ptr1, ptr1 + 1);
```
```
 for (ptr1 = *valbuf; *ptr1; ptr1 ++)
```
if (*ptr1 == '' && ptr1[1])
```
cups_strcpy(ptr1, ptr1 + 1);
```
```
   return (0);
```
```
 }
```
```
 return (0);
```
}
}

@@ -1687,7 +1688,7 @@
SLPError errcode,
void *cookie)
{

char tmp[IPP_MAX_NAME];
char tmp = 0;
printer_t *p = (printer_t)cookie;

@@ -1712,19 +1713,17 @@

p->type = CUPS_PRINTER_REMOTE;

if (GetSlpAttrVal(attrlist, "(printer-location=", p->location,
```
               sizeof(p->location)))
```
if (GetSlpAttrVal(attrlist, "(printer-location=", &(p->location)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model,
```
               sizeof(p->make_model)))
```
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", &(p->make_model)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(color-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(color-supported=", &tmp))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;
if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(finishings-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;
@@ -1733,11 +1732,13 @@
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;
if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp, sizeof(tmp)))
if (GetSlpAttrVal(attrlist, "(sides-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;
ClearString(&tmp);

return (SLP_TRUE);
}

michaelrsweet · 2003-11-07T19:35:20Z

"dirsvc.c.patch":

*** cups-1.1.19/scheduler/dirsvc.c.orig Fri Sep 5 13:34:34 2003
--- cups-1.1.19/scheduler/dirsvc.c Fri Sep 5 13:43:23 2003

*** 886,901 ****
if (setgid(Group))
exit(errno);

if (setuid(User))
        exit(errno);
    }

! /*
! * Reset group membership to just the main one we belong to.
! */

- setgroups(0, NULL);

   /*
    * Redirect stdin and stdout to /dev/null, and stderr to the
    * status pipe.  Close all other files.

--- 886,906 ----
if (setgid(Group))
exit(errno);

if (setgroups(1, &Group))
```
      exit(errno);
```
if (setuid(User))
exit(errno);
}
```
  else
```
```
  {
```
```
   /*
```
* Reset group membership to just the main one we belong to.
*/

! setgroups(1, &Group);
! }

   /*
    * Redirect stdin and stdout to /dev/null, and stderr to the
    * status pipe.  Close all other files.

*** 1507,1513 ****
* structure, so no buffer overflow is possible...)
*/

! for (src = p->make_model, dst = make_model; _src;)
{
if (_src == ',' || *src == '' || *src == ')')
*dst++ = '';
--- 1512,1519 ----
* structure, so no buffer overflow is possible...)
*/

! //for (src = p->make_model, dst = make_model; _src;)
! for (src = p->make_model, dst = make_model; ( src != NULL) && (_src != '\0');)
{
if (*src == ',' || *src == '' || *src == ')')
*dst++ = '';

*** 1520,1526 ****
if (!make_model[0])
strcpy(make_model, "Unknown");

! for (src = p->location, dst = location; _src;)
{
if (_src == ',' || *src == '' || *src == ')')
*dst++ = '';
--- 1526,1533 ----
if (!make_model[0])
strcpy(make_model, "Unknown");

! //for (src = p->location, dst = location; _src;)
! for (src = p->location, dst = location; ( src != NULL) && ( *src != '\0');)
{
if (_src == ',' || *src == '' || *src == ')')
*dst++ = '';

*** 1533,1539 ****
if (!location[0])
strcpy(location, "Unknown");

! for (src = p->info, dst = info; _src;)
{
if (_src == ',' || *src == '' || *src == ')')
*dst++ = '';
--- 1540,1547 ----
if (!location[0])
strcpy(location, "Unknown");

! //for (src = p->info, dst = info; _src;)
! for (src = p->info, dst = info; ( src != NULL) && ( *src != '\0');)
{
if (_src == ',' || *src == '' || *src == ')')
*dst++ = '';

*** 1636,1649 ****
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute /
! char *valbuf, / O - Value /
! int valbuflen) / I - Max length of value /
{
char *ptr1, / Pointer into string /
*ptr2; / ... */

! valbuf[0] = '\0';

if ((ptr1 = strstr(attrlist, tag)) != NULL)
{

--- 1644,1656 ----
int /* O - 0 on success /
GetSlpAttrVal(const char *attrlist, / I - Attribute list string /
const char *tag, / I - Name of attribute _/
! char *_valbuf) /* O - Value /
{
char *ptr1, / Pointer into string /
*ptr2; / ... */

! ClearString(valbuf);

if ((ptr1 = strstr(attrlist, tag)) != NULL)
{

*** 1651,1675 ****

  if ((ptr2 = strchr(ptr1,')')) != NULL)
  {

! if (valbuflen > (ptr2 - ptr1))
! {
! /*
! * Copy the value...
! */

! strncpy(valbuf, ptr1, ptr2 - ptr1);
! valbuf[ptr2 - ptr1] = '\0';

! /*
! * Dequote the value...
! */

! for (ptr1 = valbuf; _ptr1; ptr1 ++)
! if (_ptr1 == '' && ptr1[1])
! strcpy(ptr1, ptr1 + 1);

! return (0);
! }
}
}

--- 1658,1679 ----

  if ((ptr2 = strchr(ptr1,')')) != NULL)
  {

! /*
! * Copy the value...
! */

! _valbuf = malloc(ptr2 - ptr1 + 1);
! strcpy(_valbuf, ptr1);

! /*
! * Dequote the value...
! */

! for (ptr1 = _valbuf; *ptr1; ptr1 ++)
! if (_ptr1 == '' && ptr1[1])
! strcpy(ptr1, ptr1 + 1);

! return (0);
}
}

*** 1687,1693 ****
SLPError errcode,
void cookie)
{
! char tmp[IPP_MAX_NAME];
printer_t *p = (printer_t)cookie;

--- 1691,1697 ----
SLPError errcode,
void cookie)
{
! char *tmp = 0;
printer_t *p = (printer_t)cookie;

*** 1712,1730 ****

p->type = CUPS_PRINTER_REMOTE;

! if (GetSlpAttrVal(attrlist, "(printer-location=", p->location,
! sizeof(p->location)))
return (SLP_FALSE);
! if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", p->make_model,
! sizeof(p->make_model)))
return (SLP_FALSE);

! if (GetSlpAttrVal(attrlist, "(color-supported=", tmp, sizeof(tmp)))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;

! if (GetSlpAttrVal(attrlist, "(finishings-supported=", tmp, sizeof(tmp)))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;
--- 1716,1732 ----

p->type = CUPS_PRINTER_REMOTE;

! if (GetSlpAttrVal(attrlist, "(printer-location=", &(p->location)))
return (SLP_FALSE);
! if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", &(p->make_model)))
return (SLP_FALSE);

! if (GetSlpAttrVal(attrlist, "(color-supported=", &tmp))
return (SLP_FALSE);
if (strcasecmp(tmp, "true") == 0)
p->type |= CUPS_PRINTER_COLOR;

! if (GetSlpAttrVal(attrlist, "(finishings-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp, "staple"))
p->type |= CUPS_PRINTER_STAPLE;

*** 1733,1743 ****
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;

! if (GetSlpAttrVal(attrlist, "(sides-supported=", tmp, sizeof(tmp)))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;

return (SLP_TRUE);

}

--- 1735,1747 ----
if (strstr(tmp, "punch"))
p->type |= CUPS_PRINTER_PUNCH;

! if (GetSlpAttrVal(attrlist, "(sides-supported=", &tmp))
return (SLP_FALSE);
if (strstr(tmp,"two-sided"))
p->type |= CUPS_PRINTER_DUPLEX;

ClearString(&tmp);
return (SLP_TRUE);
}

michaelrsweet · 2003-11-07T19:35:20Z

"slp-get-printer-info.patch":

--- cups-1.1.20rc2.orig/scheduler/dirsvc.c 2003-10-04 15:46:34.949573880 +0200
+++ cups-1.1.20rc2/scheduler/dirsvc.c 2003-10-04 15:43:23.646038592 +0200
@@ -1732,6 +1732,8 @@

if (GetSlpAttrVal(attrlist, "(printer-location=", &(p->location)))
return (SLP_FALSE);

if (GetSlpAttrVal(attrlist, "(printer-info=", &(p->info)))
return (SLP_FALSE);
if (GetSlpAttrVal(attrlist, "(printer-make-and-model=", &(p->make_model)))
return (SLP_FALSE);

michaelrsweet · 2003-11-07T19:35:20Z

"dirsvc-fdset-zero-fix.patch":

diff -Nur cups-1.1.19.orig/scheduler/dirsvc.c cups-1.1.19/scheduler/dirsvc.c
--- cups-1.1.19.orig/scheduler/dirsvc.c 2003-05-12 22:51:53.000000000 +0200
+++ cups-1.1.19/scheduler/dirsvc.c 2003-10-14 10:48:57.901149608 +0200
@@ -781,6 +781,8 @@

 FD_SET(BrowseSocket, InputSet);

}

else
BrowseSocket = -1;

#ifdef HAVE_LIBSLP
if (BrowseProtocols & BROWSE_SLP)
@@ -1001,7 +1003,7 @@
BrowseSocket);

 FD_CLR(BrowseSocket, InputSet);

```
 BrowseSocket = 0;
```
```
 BrowseSocket = -1;
```
}
}

michaelrsweet closed this as completed Nov 7, 2003

michaelrsweet added the priority-high label Mar 17, 2016

michaelrsweet added this to the Stable milestone Mar 17, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cupsd segfaults when SLP browsing is enabled #259

cupsd segfaults when SLP browsing is enabled #259

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 4, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 9, 2003

michaelrsweet commented Sep 12, 2003

michaelrsweet commented Sep 16, 2003

michaelrsweet commented Sep 16, 2003

michaelrsweet commented Sep 27, 2003

michaelrsweet commented Sep 27, 2003

michaelrsweet commented Oct 1, 2003

michaelrsweet commented Oct 2, 2003

michaelrsweet commented Oct 4, 2003

michaelrsweet commented Oct 4, 2003

michaelrsweet commented Oct 9, 2003

michaelrsweet commented Oct 11, 2003

michaelrsweet commented Oct 13, 2003

michaelrsweet commented Oct 14, 2003

michaelrsweet commented Oct 15, 2003

michaelrsweet commented Oct 22, 2003

michaelrsweet commented Oct 22, 2003

michaelrsweet commented Nov 7, 2003

michaelrsweet commented Nov 7, 2003

michaelrsweet commented Nov 7, 2003

if (setuid(User))
exit(errno);
}

michaelrsweet commented Nov 7, 2003

michaelrsweet commented Nov 7, 2003

michaelrsweet commented Nov 7, 2003

cupsd segfaults when SLP browsing is enabled #259

cupsd segfaults when SLP browsing is enabled #259

Comments

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 2, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 3, 2003

michaelrsweet commented Sep 4, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 5, 2003

michaelrsweet commented Sep 9, 2003

michaelrsweet commented Sep 12, 2003

michaelrsweet commented Sep 16, 2003

michaelrsweet commented Sep 16, 2003

michaelrsweet commented Sep 27, 2003

michaelrsweet commented Sep 27, 2003

michaelrsweet commented Oct 1, 2003

michaelrsweet commented Oct 2, 2003

michaelrsweet commented Oct 4, 2003

michaelrsweet commented Oct 4, 2003

michaelrsweet commented Oct 9, 2003

michaelrsweet commented Oct 11, 2003

michaelrsweet commented Oct 13, 2003

michaelrsweet commented Oct 14, 2003

michaelrsweet commented Oct 15, 2003

michaelrsweet commented Oct 22, 2003

michaelrsweet commented Oct 22, 2003

michaelrsweet commented Nov 7, 2003

Index: dirsvc.c

- */

- valbuf[ptr2 - ptr1] = '\0';

- */

michaelrsweet commented Nov 7, 2003

Index: dirsvc.c

- valbuf[0] = '\0';

- */

- valbuf[ptr2 - ptr1] = '\0';

- */

michaelrsweet commented Nov 7, 2003

Index: dirsvc.c

if (setuid(User)) exit(errno); }

michaelrsweet commented Nov 7, 2003

- setgroups(0, NULL);

michaelrsweet commented Nov 7, 2003

michaelrsweet commented Nov 7, 2003

if (setuid(User))
exit(errno);
}