Fix potential deadlock (OpenPrinting #243)

[thirdparty/cups.git] / cups / http-support.c

diff --git a/cups/http-support.c b/cups/http-support.c
index 3834dbef8470bab2d04716fa7a2ef245c223f4a4..49557300eea7933835aee533429a563c16da4680 100644 (file)
--- a/cups/http-support.c
+++ b/cups/http-support.c
@@ -1,7 +1,7 @@
 /*
  * HTTP support routines for CUPS.
  *
- * Copyright 2007-2018 by Apple Inc.
+ * Copyright 2007-2019 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -13,15 +13,16 @@
  */
 
 #include "cups-private.h"
+#include "debug-internal.h"
 #ifdef HAVE_DNSSD
 #  include <dns_sd.h>
-#  ifdef WIN32
+#  ifdef _WIN32
 #    include <io.h>
 #  elif defined(HAVE_POLL)
 #    include <poll.h>
 #  else
 #    include <sys/select.h>
-#  endif /* WIN32 */
+#  endif /* _WIN32 */
 #elif defined(HAVE_AVAHI)
 #  include <avahi-client/client.h>
 #  include <avahi-client/lookup.h>
@@ -798,14 +799,12 @@ httpGetDateString2(time_t t,              /* I - Time in seconds */
                    char   *s,          /* I - String buffer */
                   int    slen)         /* I - Size of string buffer */
 {
-  struct tm    *tdate;                 /* UNIX date/time data */
+  struct tm    tdate;                  /* UNIX date/time data */
 
 
-  tdate = gmtime(&t);
-  if (tdate)
-    snprintf(s, (size_t)slen, "%s, %02d %s %d %02d:%02d:%02d GMT", http_days[tdate->tm_wday], tdate->tm_mday, http_months[tdate->tm_mon], tdate->tm_year + 1900, tdate->tm_hour, tdate->tm_min, tdate->tm_sec);
-  else
-    s[0] = '\0';
+  gmtime_r(&t, &tdate);
+
+  snprintf(s, (size_t)slen, "%s, %02d %s %d %02d:%02d:%02d GMT", http_days[tdate.tm_wday], tdate.tm_mday, http_months[tdate.tm_mon], tdate.tm_year + 1900, tdate.tm_hour, tdate.tm_min, tdate.tm_sec);
 
   return (s);
 }
@@ -841,6 +840,13 @@ httpGetDateTime(const char *s)             /* I - Date/time string */
   DEBUG_printf(("4httpGetDateTime: day=%d, mon=\"%s\", year=%d, hour=%d, "
                 "min=%d, sec=%d", day, mon, year, hour, min, sec));
 
+ /*
+  * Check for invalid year (RFC 7231 says it's 4DIGIT)
+  */
+
+  if (year > 9999)
+    return (0);
+
  /*
   * Convert the month name to a number from 0 to 11.
   */
@@ -1320,9 +1326,10 @@ _httpSetDigestAuthString(
                digest[1024];           /* Digest auth data */
   unsigned char        hash[32];               /* Hash buffer */
   size_t       hashsize;               /* Size of hash */
+  _cups_globals_t *cg = _cupsGlobals();        /* Per-thread globals */
 
 
-  DEBUG_printf(("2_httpSetDigestAuthString(http=%p, nonce=\"%s\", method=\"%s\", resource=\"%s\")", http, nonce, method, resource));
+  DEBUG_printf(("2_httpSetDigestAuthString(http=%p, nonce=\"%s\", method=\"%s\", resource=\"%s\")", (void *)http, nonce, method, resource));
 
   if (nonce && *nonce && strcmp(nonce, http->nonce))
   {
@@ -1362,6 +1369,12 @@ _httpSetDigestAuthString(
       * RFC 2617 Digest with MD5
       */
 
+      if (cg->digestoptions == _CUPS_DIGESTOPTIONS_DENYMD5)
+      {
+       DEBUG_puts("3_httpSetDigestAuthString: MD5 Digest is disabled.");
+       return (0);
+      }
+
       hashalg = "md5";
     }
     else if (!_cups_strcasecmp(http->algorithm, "SHA-256"))
@@ -1763,9 +1776,6 @@ _httpResolveURI(
     _http_uribuf_t     uribuf;         /* URI buffer */
     int                        offline = 0;    /* offline-report state set? */
 #  ifdef HAVE_DNSSD
-#    ifdef WIN32
-#      pragma comment(lib, "dnssd.lib")
-#    endif /* WIN32 */
     DNSServiceRef      ref,            /* DNS-SD master service reference */
                        domainref = NULL,/* DNS-SD service reference for domain */
                        ippref = NULL,  /* DNS-SD service reference for network IPP */
@@ -1894,11 +1904,11 @@ _httpResolveURI(
          FD_ZERO(&input_set);
          FD_SET(DNSServiceRefSockFD(ref), &input_set);
 
-#      ifdef WIN32
+#      ifdef _WIN32
          stimeout.tv_sec  = (long)timeout;
 #      else
          stimeout.tv_sec  = timeout;
-#      endif /* WIN32 */
+#      endif /* _WIN32 */
          stimeout.tv_usec = 0;
 
          fds = select(DNSServiceRefSockFD(ref)+1, &input_set, NULL, NULL,