Signal handler should not call malloc/free

[michaelrsweet]

Version: 1.1.19
CUPS.org User: mike

The SIGCHLD handler calls LogMessage which calls cupsFileOpen/Close to rotate the log files. This can cause heap corruption since malloc/free are not safe to call from a signal handler.

Need to add a global to prevent LogMessage and friends from rotating the log files when called from the signal handlers.

[michaelrsweet]

CUPS.org User: mike

Fixed in CVS for the next releases. Patch attached.

[michaelrsweet]

"str190.patch":

Index: cupsd.h

RCS file: /development/cvs/cups/scheduler/cupsd.h,v
retrieving revision 1.47
diff -u -r1.47 cupsd.h
--- cupsd.h 2003/04/10 20:14:05 1.47
+++ cupsd.h 2003/07/19 21:10:56
@@ -184,8 +184,11 @@
VAR fd_set InputSet, / Input files for select() /
*OutputSet; / Output files for select() */

-VAR int NeedReload VALUE(RELOAD_ALL);
+VAR int NeedReload VALUE(RELOAD_ALL),
/* Need to load configuration? */

•       SignalCount VALUE(0);
  

•               /\* Signal handler level _/
  

  VAR char *TZ VALUE(NULL);
  /_ Timezone configuration */

Index: log.c

RCS file: /development/cvs/cups/scheduler/log.c,v
retrieving revision 1.32
diff -u -r1.32 log.c
--- log.c 2003/04/10 20:14:06 1.32
+++ log.c 2003/07/19 21:10:58
@@ -108,15 +108,14 @@

• 'LogMessage()' - Log a message to the error log file.
  */

-int /* O - 1 on success, 0 on error /
-LogMessage(int level, / I - Log level */

•       const char _message,    /_ I - printf-style message string */
  

•  ...)         /\* I - Additional args as needed _/
  

  +int /_ O - 1 on success, 0 on error /
  +LogMessage(int level, / I - Log level */

•       const char _message,        /_ I - printf-style message string */
  

•  ...)             /\* I - Additional args as needed */
  

  {
• int len; /* Length of message */
• char line[1024]; /* Line for output file */
• va_list ap; /* Argument pointer */
• static const char levels[] = /* Log levels... */
• int len; /* Length of message */
• va_list ap; /* Argument pointer */
• static const char levels[] = /* Log levels... */
  {
  ' ',
  'X',
  @@ -130,7 +129,7 @@
  'd'
  };
  #ifdef HAVE_VSYSLOG
• static const int syslevels[] =/* SYSLOG levels... */
• static const int syslevels[] = /* SYSLOG levels... /
  {
  0,
  LOG_EMERG,
  @@ -144,6 +143,8 @@
  LOG_DEBUG
  };
  #endif / HAVE_VSYSLOG */
• static int linesize = 0; /* Size of line for output file */
• static char line = NULL; / Line for output file */

/*
@@ -194,17 +195,53 @@
*/

va_start(ap, message);

• len = vsnprintf(line, sizeof(line), message, ap);
• len = vsnprintf(line, linesize, message, ap);
  va_end(ap);
• if (len >= linesize && !SignalCount)
• {
• len ++;

• if (len < 8192)

•  len = 8192;
  

• else if (len > 65536)

•  len = 65536;
  
• if (!linesize)

•  line = malloc(len);
  

• else

•  line = realloc(line, len);
  
• if (line)

•  linesize = len;
  

• else
• {

•  cupsFilePrintf(ErrorFile,
  

•                 "ERROR: Unable to allocate memory for line - %s\n",
  

•                 strerror(errno));
  

•  cupsFileFlush(ErrorFile);
  

•  ReleaseSignals();
  

•  return (0);
  

• }

• va_start(ap, message);
• len = vsnprintf(line, linesize, message, ap);
• va_end(ap);
• }

/*

• Then a newline...
  */
• if (len >= linesize)
• len = linesize - 1;

• cupsFilePuts(ErrorFile, line);

if (len > 0 && line[len - 1] != '\n')

• cupsFilePrintf(ErrorFile, "%s\n", line);
• else
• cupsFilePuts(ErrorFile, line);
• cupsFilePutChar(ErrorFile, '\n');

cupsFileFlush(ErrorFile);

@@ -371,10 +408,10 @@

/*

• * See if we have a log file to check...
• • See if we have a log file to check or we are handling a signal...
    */
• if (log == NULL || logname == NULL || !logname[0])
• if (log == NULL || logname == NULL || !logname[0] || SignalCount)
  return (1);

/*

Index: main.c

RCS file: /development/cvs/cups/scheduler/main.c,v
retrieving revision 1.104
diff -u -r1.104 main.c
--- main.c 2003/05/09 15:11:13 1.104
+++ main.c 2003/07/19 21:11:00
@@ -68,7 +68,7 @@
*/

static int parent_signal = 0; /* Set to signal number from child /
-static int holdcount = 0; / Number of time "hold" was called /
+static int holdcount = 0; / Number of times "hold" was called /
#if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
static sigset_t holdmask; / Old POSIX signal mask /
#endif / HAVE_SIGACTION && !HAVE_SIGSET */
@@ -906,6 +906,12 @@
(void)sig;

/*

• * Bump the signal count...
• */

• SignalCount ++;

• /*
  • Save the original error value (wait might overwrite it...)
    */

@@ -1000,6 +1006,12 @@
#elif !defined(HAVE_SIGACTION)
signal(SIGCLD, sigchld_handler);
#endif /* HAVE_SIGSET */
+

• /*
• * Restore the signal count...
• */

• SignalCount --;
  }

@@ -1035,6 +1047,12 @@

(void)sig; /* remove compiler warnings... */
+

• /*
• * Bump the signal count...
• */

• SignalCount ++;

/*

• Log an error...