cups-browsed SEGV

[joakim-tjernlund]

in utils/cups-browsed.c there is:

2852	    if (temp->media_source == NULL) {
2853	      if (cluster_supports_given_attribute(cluster_name, IPP_TAG_KEYWORD,
2854						   "media-source-supported")) {
2855	        strcpy(temp->media_source,AUTO_OPTION);

strcpy to a NULL dst will SEGV

[joakim-tjernlund]

FYI fixes it:

--- cups-filters-1.25.12/utils/cups-browsed.c.org	2019-11-13 17:32:08.389918928 +0100
+++ cups-filters-1.25.12/utils/cups-browsed.c	2019-11-13 17:38:55.822553303 +0100
@@ -2849,7 +2849,7 @@
       debug_printf("Default MediaSource: %s\n", media_source);
     }
 
-    if (temp->media_source == NULL) {
+    if (temp->media_source != NULL) {
       if (cluster_supports_given_attribute(cluster_name, IPP_TAG_KEYWORD,
 					   "media-source-supported")) {
         strcpy(temp->media_source,AUTO_OPTION);
@@ -2857,7 +2857,7 @@
       }
     }
 
-    if (temp->media_type == NULL) {
+    if (temp->media_type != NULL) {
       if (cluster_supports_given_attribute(cluster_name, IPP_TAG_KEYWORD,
 					   "media-type-supported")) {
         strcpy(temp->media_type, AUTO_OPTION);

[joakim-tjernlund]

The above naive fix might instead be:

--- cups-browsed.c.org	2019-11-13 17:32:08.389918928 +0100
+++ cups-browsed.c	2019-11-13 18:12:52.496860530 +0100
@@ -2852,7 +2852,8 @@
     if (temp->media_source == NULL) {
       if (cluster_supports_given_attribute(cluster_name, IPP_TAG_KEYWORD,
 					   "media-source-supported")) {
-        strcpy(temp->media_source,AUTO_OPTION);
+        strcpy(media_source, AUTO_OPTION);
+        temp->media_source = strdup(AUTO_OPTION);
         debug_printf("Default MediaSource: %s\n", media_source);
       }
     }
@@ -2860,7 +2861,8 @@
     if (temp->media_type == NULL) {
       if (cluster_supports_given_attribute(cluster_name, IPP_TAG_KEYWORD,
 					   "media-type-supported")) {
-        strcpy(temp->media_type, AUTO_OPTION);
+        strcpy(media_type, AUTO_OPTION);
+        temp->media_type = strdup(AUTO_OPTION);
         debug_printf("Default MediaType: %s\n", media_type);
       }
     }

This might leak memory as there is no obvious free

[tillkamppeter]

Fixed in commit 9bf6937. Thank you for your report.