sane-backends' canon driver segfault

[fogti]

Describe the bug

simple-scan segfaults while trying to scan using a canon scanner at
https://gitlab.com/sane-project/backends/-/blob/1.2.1/backend/canon.c#L1764
because it tries to copy a null pointer (s->hw->tpu.ControlMode = 3).

Steps To Reproduce

Steps to reproduce the behavior:
idk...

Expected behavior

such segfaults shouldn't happen. scanning should work.

Additional context

simple-scan backtrace, with enabled debug symbols for glibc, sane-backends, simple-scan (gathered using coredumpctl):

#0  __strlen_sse2 () at ../sysdeps/x86_64/multiarch/strlen-sse2.S:142
#1  0x00007fe7c722cb02 in __GI___strdup (s=0x0) at strdup.c:41
#2  0x00007fe7a5ca4e57 in init_options (s=s@entry=0x7fe7a01c64d0) at canon.c:1764
#3  0x00007fe7a5ca8be1 in sane_canon_open (devnam=<optimized out>, handle=0x7fe7b4ffea48) at /build/sane-backends-1.2.1/backend/canon-sane.c:205
#4  0x00007fe7c7458ff4 in sane_dll_open (full_name=<optimized out>, meta_handle=meta_handle@entry=0x7fe7b4ffeab0) at dll.c:1294
#5  0x00007fe7c745599e in sane_open (name=<optimized out>, h=h@entry=0x7fe7b4ffeab0) at dll-s.c:27
#6  0x000000000043c897 in scanner_do_open (self=self@entry=0x1485850) at src/simple-scan.p/scanner.c:5419
#7  0x000000000043e0ee in scanner_scan_thread (self=self@entry=0x1485850) at src/simple-scan.p/scanner.c:7320
#8  0x000000000043e12b in _scanner_scan_thread_gthread_func (self=0x1485850) at src/simple-scan.p/scanner.c:7355
#9  0x00007fe7c82ab64d in g_thread_proxy () from /nix/store/cgmbz0wglid7v5m0m0a70ksvgyxppsgn-glib-2.76.3/lib/libglib-2.0.so.0
#10 0x00007fe7c7216dd4 in start_thread (arg=<optimized out>) at pthread_create.c:444
#11 0x00007fe7c72989b0 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Notify maintainers

@symphorien

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.1.34, NixOS, 23.11 (Tapir), 23.11.20230621.faee04a`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.16.0pre20230518_b1c34c0`
 - nixpkgs: `/etc/nix-flake-channels/nixpkgs` (faee04a8a407c9bb2f1f370ec1fb45946f936288)

[symphorien]

That sounds like an upstream issue and I found no comparable issue in the issue tracker. Would you mind reporting it upstream?

[fogti]

I don't have a gitlab account and would find creating one just for such a tiny issue a bit cumbersome, so I would rather not deal with that myself... for now, I'll patch it locally with: (In accordance with https://gitlab.com/sane-project/backends/-/blob/1.2.1/backend/canon-sane.c#L676, urgh I hate hardcoded string values)

diff --git a/backend/canon.c b/backend/canon.c
index d17cd01a4..6a0b8aa07 100644
--- a/backend/canon.c
+++ b/backend/canon.c
@@ -166,6 +166,7 @@ static const SANE_String_Const mode_list_fb1200[] = {
 static const SANE_String_Const tpu_dc_mode_list[] = {
   SANE_I18N("No transparency correction"),
   SANE_I18N("Correction according to film type"),
+  SANE_I18N("Correction according to transparency ratio (unhandled)"),
   SANE_I18N("Correction according to transparency ratio"),
   0
 };

[symphorien]

Note that you can use your github account to login to gitlab.com. Please also consider that only people with access to the hardware can reproduce, so it would be nonsensical for me to report the issue on your behalf.
If gitlab is really a problem to you, sane seems to have mailing lists http://www.sane-project.org/mailing-lists.html

[fogti]

ok, I'll send a mail.