Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid invalid read in cupsAddDest #3448

Closed
michaelrsweet opened this issue Dec 10, 2009 · 2 comments
Closed

Avoid invalid read in cupsAddDest #3448

michaelrsweet opened this issue Dec 10, 2009 · 2 comments
Labels
Milestone

Comments

@michaelrsweet
Copy link
Collaborator

@michaelrsweet michaelrsweet commented Dec 10, 2009

Version: 1.4.2
CUPS.org User: twaugh.redhat

The result of cupsGetDest() is invalid as soon as cups_add_dest() is called because the dests array has been reallocated.

Original bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=537460

@michaelrsweet

This comment has been minimized.

Copy link
Collaborator Author

@michaelrsweet michaelrsweet commented Dec 15, 2009

CUPS.org User: mike

Fixed in Subversion repository.

@michaelrsweet

This comment has been minimized.

Copy link
Collaborator Author

@michaelrsweet michaelrsweet commented Dec 15, 2009

"0001-Avoid-invalid-read-in-cupsAddDest.patch":

From 68e28ba21229617fcd16ebe511bf31bb8119e40f Mon Sep 17 00:00:00 2001
From: Tim Waugh twaugh@redhat.com
Date: Thu, 10 Dec 2009 18:13:08 +0000
Subject: [PATCH] Avoid invalid read in cupsAddDest.

The result of cupsGetDest() is invalid as soon as cups_add_dest() is
called because the dests array has been reallocated.

Original bug report:

https://bugzilla.redhat.com/show_bug.cgi?id=537460

cups/dest.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/cups/dest.c b/cups/dest.c
index 1a3ff31..6a349be 100644
--- a/cups/dest.c
+++ b/cups/dest.c
@@ -144,6 +144,12 @@ cupsAddDest(const char name, / I - Destination name */

 dest = cups_add_dest(name, instance, &num_dests, dests);
  • /*
  • * Find the base dest again now the array has been realloc'd.
  • */
  • parent = cupsGetDest(name, NULL, num_dests, _dests);

if (instance && parent && parent->num_options > 0)
{
/_

1.6.5.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.