Add long-forgotten patch to make papd safer.

etc/papd/main.c

@@ -75,6 +75,17 @@ char *strchr (), *strrchr ();
 
 #define PIPED_STATUS	"status: print spooler processing job"
 
+/* This maps to TReq and TResp, per "Inside AppleTalk" 10-13 */
+
+typedef struct __attribute__((__packed__)) {
+	u_int8_t user_bytes[4];
+	u_int8_t data_bytes[4];
+	u_int8_t buf_len;
+	char buf[255];
+} rbuf_t;
+
+static rbuf_t r_buf;
+
 struct printer	defprinter;
 struct printer	*printers = NULL;
 
@@ -91,7 +102,7 @@ char		*uamlist;
 char		*uampath = _PATH_PAPDUAMPATH;
 
 /* Prototypes for locally used functions */
-int getstatus( struct printer *pr, char *buf );
+int getstatus( struct printer *pr, rbuf_t *buf );
 int rprintcap( struct printer *pr );
 static void getprinters( char *cf );
 
@@ -159,8 +170,6 @@ reap(int sig _U_)
     return;
 }
 
-static char rbuf[ 255 + 1 + 8 ];
-
 int main(int ac, char **av)
 {
     extern char         *optarg;
@@ -560,45 +569,51 @@ int main(int ac, char **av)
  * We assume buf is big enough for 255 bytes of data and a length byte.
  */
 
-int getstatus(struct printer *pr, char *buf)
+int getstatus(struct printer *pr, rbuf_t *buf)
 {
-
 #ifdef HAVE_CUPS
     if ( pr->p_flags & P_PIPED ) {
-	*buf = strlen( cannedstatus );
-	strncpy( &buf[ 1 ], cannedstatus, *buf );
-	return( *buf + 1 );
+	buf->buf_len = strlen(cannedstatus);
+	snprintf(buf->buf, 254, cannedstatus);
+	return (buf->buf_len + 1);
     } else {
 	cups_get_printer_status( pr );
-	*buf = strlen ( pr->p_status );
-	strncpy ( &buf[1], pr->p_status, *buf);
-	return ( *buf + 1);
+	buf->buf_len = strlen(pr->p_status);
+	snprintf(buf->buf, 254, pr->p_status);
+	return (buf->buf_len + 1);
     }
 #else
-
     char		path[ MAXPATHLEN ];
-    int			fd = -1, rc;
+    char getstatus_buffer[255];
+    char *temp;
+    FILE *fd = NULL;
+    int rc;
 
     if ( pr->p_flags & P_SPOOLED && ( pr->p_spool != NULL )) {
-	strcpy( path, pr->p_spool );
-	strcat( path, "/status" );
-	fd = open( path, O_RDONLY);
+	snprintf(path, MAXPATHLEN - 1, "%s/status", pr->p_spool);
+	fd = fopen(path, O_RDONLY);
     }
 
-    if (( pr->p_flags & P_PIPED ) || ( fd < 0 )) {
-	*buf = strlen( cannedstatus );
-	strncpy( &buf[ 1 ], cannedstatus, *buf );
-	return( *buf + 1 );
+    if ((pr->p_flags & P_PIPED) || (fd == NULL)) {
+	buf->buf_len = strlen(cannedstatus);
+	snprintf(buf->buf, 254, cannedstatus);
+	return (buf->buf_len + 1);
     } else {
-	if (( rc = read( fd, &buf[ 1 ], 255 )) < 0 ) {
-	    rc = 0;
-	}
-	close( fd );
-	if ( rc && buf[ rc ] == '\n' ) {	/* remove trailing newline */
-	    rc--;
+	rc = fread(getstatus_buffer, 255, sizeof(unsigned char), fd);
+	fclose(fd);
+
+	if (rc > 0) {
+		if (temp != NULL) {
+			temp[strcspn(temp, "\n")] = '\0';
+			snprintf(buf->buf, 254, temp);
+			buf->buf_len = strlen(buf->buf);
+		}
+	} else {
+		snprintf(buf->buf, 254, "thisisanemptystring");
+		buf->buf_len = 0;
 	}
-	*buf = rc;
-	return( rc + 1 );
+
+	return (buf->buf_len + 1);
     }
 #endif /* HAVE_CUPS */
 }