Skip to content

Potentially missing a NULL value check in _cupsConvertOptions #1026

@gabe-sherman

Description

@gabe-sherman

Hello, I was recently implementing the cups library in my code and I came across a unique situation. I came across a seg fault that occurs when calling _cupsConvertOptions. The root cause of this crash occurs through passing a null pointer as the media_col_sup parameter. Later, when this line of code is executed:

for (i = 0; i < media_col_sup->num_values; i ++)

a seg fault occurs. I attributed this to user error since _cupsConvertOptions is an internal function, but I traced through other call sites of this function to see how media_col_sup is structured. Long story short, there is a possibility for a null pointer to propagate to the _cupsConvertOptions function call beginning with the main method of backend/ipp.c.

In the main method of backend/ipp.c at line 886, the variable media_col_sup is set to NULL. It is then set to the return value of ippFindAttribute (line 1147), which still has the potential to be NULL. This value is then passed into the new_request function (lines 1480 and 1601), and finally into _cupsConvertOptions (line 2875).

I apologize if this is still user error or I have misunderstood an aspect of the API, but it seems like a check of the media_col_sup variable should be done before it's properties are accessed. Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions