Hello, I was recently implementing the cups library in my code and I came across a unique situation. I came across a seg fault that occurs when calling _cupsConvertOptions. The root cause of this crash occurs through passing a null pointer as the media_col_sup parameter. Later, when this line of code is executed:
for (i = 0; i < media_col_sup->num_values; i ++)
a seg fault occurs. I attributed this to user error since _cupsConvertOptions is an internal function, but I traced through other call sites of this function to see how media_col_sup is structured. Long story short, there is a possibility for a null pointer to propagate to the _cupsConvertOptions function call beginning with the main method of backend/ipp.c.
In the main method of backend/ipp.c at line 886, the variable media_col_sup is set to NULL. It is then set to the return value of ippFindAttribute (line 1147), which still has the potential to be NULL. This value is then passed into the new_request function (lines 1480 and 1601), and finally into _cupsConvertOptions (line 2875).
I apologize if this is still user error or I have misunderstood an aspect of the API, but it seems like a check of the media_col_sup variable should be done before it's properties are accessed. Thanks.
Hello, I was recently implementing the cups library in my code and I came across a unique situation. I came across a seg fault that occurs when calling
_cupsConvertOptions. The root cause of this crash occurs through passing a null pointer as themedia_col_supparameter. Later, when this line of code is executed:for (i = 0; i < media_col_sup->num_values; i ++)a seg fault occurs. I attributed this to user error since _cupsConvertOptions is an internal function, but I traced through other call sites of this function to see how
media_col_supis structured. Long story short, there is a possibility for a null pointer to propagate to the_cupsConvertOptionsfunction call beginning with the main method ofbackend/ipp.c.In the main method of
backend/ipp.cat line886, the variablemedia_col_supis set toNULL. It is then set to the return value ofippFindAttribute(line1147), which still has the potential to beNULL. This value is then passed into thenew_requestfunction (lines1480and1601), and finally into_cupsConvertOptions(line2875).I apologize if this is still user error or I have misunderstood an aspect of the API, but it seems like a check of the
media_col_supvariable should be done before it's properties are accessed. Thanks.