From 1e73bb4f8e433c63c60a280560081c6bf379cbf1 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Nov 07 2013 13:30:13 +0000 Subject: Use upstream patch for stringpool corruption issue (bug #974048). Resolves: rhbz#974048 --- diff --git a/cups-stringpool-rdar15382819.patch b/cups-stringpool-rdar15382819.patch new file mode 100644 index 0000000..0a22a39 --- /dev/null +++ b/cups-stringpool-rdar15382819.patch @@ -0,0 +1,93 @@ +diff -up cups-1.7.0/scheduler/printers.c.stringpool-rdar15382819 cups-1.7.0/scheduler/printers.c +--- cups-1.7.0/scheduler/printers.c.stringpool-rdar15382819 2013-11-07 13:26:56.077499193 +0000 ++++ cups-1.7.0/scheduler/printers.c 2013-11-07 13:27:54.665787144 +0000 +@@ -1876,12 +1876,13 @@ void + cupsdSetPrinterAttr( + cupsd_printer_t *p, /* I - Printer */ + const char *name, /* I - Attribute name */ +- char *value) /* I - Attribute value string */ ++ const char *value) /* I - Attribute value string */ + { + ipp_attribute_t *attr; /* Attribute */ + int i, /* Looping var */ + count; /* Number of values */ +- char *ptr, /* Pointer into value */ ++ char *temp, /* Temporary copy of value string */ ++ *ptr, /* Pointer into value */ + *start, /* Start of value */ + quote; /* Quote character */ + ipp_tag_t value_tag; /* Value tag for this attribute */ +@@ -1898,10 +1899,21 @@ cupsdSetPrinterAttr( + } + + /* ++ * Copy the value string so we can do what we want with it... ++ */ ++ ++ if ((temp = strdup(value)) == NULL) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to duplicate value for \"%s\" attribute.", name); ++ return; ++ } ++ ++ /* + * Count the number of values... + */ + +- for (count = 1, quote = '\0', ptr = value; ++ for (count = 1, quote = '\0', ptr = temp; + *ptr; + ptr ++) + { +@@ -1949,15 +1961,15 @@ cupsdSetPrinterAttr( + return; + } + +- for (i = 0; i < count; i ++) ++ for (i = 0, start = temp; i < count; i ++) + { +- if ((ptr = strchr(value, ',')) != NULL) ++ if ((ptr = strchr(start, ',')) != NULL) + *ptr++ = '\0'; + +- attr->values[i].integer = strtol(value, NULL, 10); ++ attr->values[i].integer = strtol(start, NULL, 10); + + if (ptr) +- value = ptr; ++ start = ptr; + } + } + else +@@ -1999,7 +2011,7 @@ cupsdSetPrinterAttr( + return; + } + +- for (i = 0, quote = '\0', ptr = value; i < count; i ++) ++ for (i = 0, quote = '\0', ptr = temp; i < count; i ++) + { + for (start = ptr; *ptr; ptr ++) + { +@@ -2028,6 +2040,8 @@ cupsdSetPrinterAttr( + attr->values[i].string.text = _cupsStrAlloc(start); + } + } ++ ++ free(temp); + } + + +diff -up cups-1.7.0/scheduler/printers.h.stringpool-rdar15382819 cups-1.7.0/scheduler/printers.h +--- cups-1.7.0/scheduler/printers.h.stringpool-rdar15382819 2013-05-29 12:51:34.000000000 +0100 ++++ cups-1.7.0/scheduler/printers.h 2013-11-07 13:27:54.666787149 +0000 +@@ -166,7 +166,8 @@ extern int cupsdSetAuthInfoRequired(cup + ipp_attribute_t *attr); + extern void cupsdSetDeviceURI(cupsd_printer_t *p, const char *uri); + extern void cupsdSetPrinterAttr(cupsd_printer_t *p, +- const char *name, char *value); ++ const char *name, ++ const char *value); + extern void cupsdSetPrinterAttrs(cupsd_printer_t *p); + extern int cupsdSetPrinterReasons(cupsd_printer_t *p, + const char *s); diff --git a/cups-stringpool-setprinterattr.patch b/cups-stringpool-setprinterattr.patch deleted file mode 100644 index a7710dc..0000000 --- a/cups-stringpool-setprinterattr.patch +++ /dev/null @@ -1,64 +0,0 @@ -diff -up cups-1.7b1/scheduler/printers.c.stringpool-setprinterattr cups-1.7b1/scheduler/printers.c ---- cups-1.7b1/scheduler/printers.c.stringpool-setprinterattr 2013-06-13 12:18:04.678129506 +0100 -+++ cups-1.7b1/scheduler/printers.c 2013-06-13 12:18:04.721129670 +0100 -@@ -1881,6 +1881,7 @@ cupsdSetPrinterAttr( - ipp_attribute_t *attr; /* Attribute */ - int i, /* Looping var */ - count; /* Number of values */ -+ char *value_dup; /* Copy of attribute value string */ - char *ptr, /* Pointer into value */ - *start, /* Start of value */ - quote; /* Quote character */ -@@ -1949,16 +1950,24 @@ cupsdSetPrinterAttr( - return; - } - -- for (i = 0; i < count; i ++) -+ if ((value_dup = strdup(value)) == NULL) - { -- if ((ptr = strchr(value, ',')) != NULL) -+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value."); -+ return; -+ } -+ -+ for (i = 0, start = value_dup; i < count; i ++) -+ { -+ if ((ptr = strchr(start, ',')) != NULL) - *ptr++ = '\0'; - -- attr->values[i].integer = strtol(value, NULL, 10); -+ attr->values[i].integer = strtol(start, NULL, 10); - - if (ptr) -- value = ptr; -+ start = ptr; - } -+ -+ free(value_dup); - } - else - { -@@ -1999,7 +2008,13 @@ cupsdSetPrinterAttr( - return; - } - -- for (i = 0, quote = '\0', ptr = value; i < count; i ++) -+ if ((value_dup = strdup(value)) == NULL) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value."); -+ return; -+ } -+ -+ for (i = 0, quote = '\0', ptr = value_dup; i < count; i ++) - { - for (start = ptr; *ptr; ptr ++) - { -@@ -2027,6 +2042,8 @@ cupsdSetPrinterAttr( - - attr->values[i].string.text = _cupsStrAlloc(start); - } -+ -+ free(value_dup); - } - } - diff --git a/cups.spec b/cups.spec index 76c778a..23b18b9 100644 --- a/cups.spec +++ b/cups.spec @@ -11,7 +11,7 @@ Summary: CUPS printing system Name: cups Epoch: 1 Version: 1.7.0 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2 Group: System Environment/Daemons Url: http://www.cups.org/ @@ -56,7 +56,7 @@ Patch25: cups-systemd-socket.patch Patch26: cups-lpd-manpage.patch Patch27: cups-avahi-address.patch Patch29: cups-enum-all.patch -Patch30: cups-stringpool-setprinterattr.patch +Patch30: cups-stringpool-rdar15382819.patch Patch31: cups-dymo-deviceid.patch Patch32: cups-freebind.patch Patch33: cups-no-gcry.patch @@ -242,7 +242,7 @@ Sends IPP requests to the specified URI and tests and/or displays the results. # Return from cupsEnumDests() once all records have been returned. %patch29 -p1 -b .enum-all # Prevent stringpool damage leading to memory leaks (bug #974048). -%patch30 -p1 -b .stringpool-setprinterattr +%patch30 -p1 -b .stringpool-rdar15382819 # Added IEEE 1284 Device ID for a Dymo device (bug #747866). %patch31 -p1 -b .dymo-deviceid # Use IP_FREEBIND socket option when binding listening sockets (bug #970809). @@ -652,6 +652,9 @@ rm -f %{cups_serverbin}/backend/smb %{_mandir}/man5/ipptoolfile.5.gz %changelog +* Thu Nov 7 2013 Tim Waugh - 1:1.7.0-5 +- Use upstream patch for stringpool corruption issue (bug #974048). + * Mon Nov 4 2013 Tim Waugh - 1:1.7.0-4 - Adjusted commented out default for SyncOnClose in cups-files.conf.