lib:printer_driver: Added pointer validation

If no comma is found, strchr_m will return NULL. p will be set to NULL, and
if (p) will not be executed. The variable p will remain set to NULL and will
be passed to the spoolss_driver_version_to_qword function.

If strchr_m returns NULL, the function immediately terminates and returns the
status NT_STATUS_INVALID_PARAMETER. This prevents invalid data from being
passed to subsequent functions.

Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Shumikhina Ksenia <shumikhinaka@sgu.ru>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jun  4 12:05:45 UTC 2026 on atb-devel-224

diff --git a/lib/printer_driver/printer_driver.c b/lib/printer_driver/printer_driver.c
index 777ef2d2ee0293da3e8c85db1948b582e144a011..b6598e121aae86c55498d836ac238c51d0eda7fb 100644 (file)
--- a/lib/printer_driver/printer_driver.c
+++ b/lib/printer_driver/printer_driver.c
@@ -884,10 +884,11 @@ static NTSTATUS process_driver_driverver(struct gp_inifile_context *ctx,
        }
 
        p = discard_const_p(char, strchr_m(str, ','));
-       if (p) {
-               *p = '\0';
-               p++;
+       if (p == NULL) {
+               return NT_STATUS_INVALID_PARAMETER;
        }
+       *p = '\0';
+       p++;
 
        ok = spoolss_timestr_to_NTTIME(str, &r->driver_date);
        if (!ok) {