Fix potential crash in cups-driverd (rdar://46625579)

diff --git a/CHANGES.md b/CHANGES.md
index 382282079c0c4699b09917458c3e907308dd3deb..5151be62d97f0f330084acb5c53852e6c8a0237e 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,6 +1,13 @@
-CHANGES - 2.3b6 - 2018-12-14
+CHANGES - 2.3b8 - 2018-12-14
 ============================
 
+
+Changes in CUPS v2.3b8
+----------------------
+
+- Fixed a potential crash bug in cups-driverd (rdar://46625579)
+
+
 Changes in CUPS v2.3b7
 ----------------------
 

diff --git a/scheduler/cups-driverd.cxx b/scheduler/cups-driverd.cxx
index b518a93258178774b839d557560eba3ceabc79c6..3fd462bb834d4093c625f66333a2594fe0d42b91 100644 (file)
--- a/scheduler/cups-driverd.cxx
+++ b/scheduler/cups-driverd.cxx
@@ -27,7 +27,7 @@
  * Constants...
  */
 
-#define PPD_SYNC       0x50504439      /* Sync word for ppds.dat (PPD9) */
+#define PPD_SYNC       0x50504441      /* Sync word for ppds.dat (PPDA) */
 #define PPD_MAX_LANG   32              /* Maximum languages */
 #define PPD_MAX_PROD   32              /* Maximum products */
 #define PPD_MAX_VERS   32              /* Maximum versions */
@@ -36,12 +36,9 @@
 #define PPD_TYPE_PDF           1       /* PDF PPD */
 #define PPD_TYPE_RASTER                2       /* CUPS raster PPD */
 #define PPD_TYPE_FAX           3       /* Facsimile/MFD PPD */
-#define PPD_TYPE_OBJECT_ANY    4       /* 3D (AMF/STL/g-code) PPD */
-#define PPD_TYPE_OBJECT_DIRECT 5       /* 3D (AMF/STL/g-code) PPD over any connection */
-#define PPD_TYPE_OBJECT_STORAGE        6       /* 3D (AMF/STL/g-code) PPD for storage to SD card, etc. */
-#define PPD_TYPE_UNKNOWN       7       /* Other/hybrid PPD */
-#define PPD_TYPE_DRV           8       /* Driver info file */
-#define PPD_TYPE_ARCHIVE       9       /* Archive file */
+#define PPD_TYPE_UNKNOWN       4       /* Other/hybrid PPD */
+#define PPD_TYPE_DRV           5       /* Driver info file */
+#define PPD_TYPE_ARCHIVE       6       /* Archive file */
 
 #define TAR_BLOCK      512             /* Number of bytes in a block */
 #define TAR_BLOCKS     10              /* Blocking factor */
@@ -1523,8 +1520,20 @@ list_ppds(int        request_id, /* I - Request ID */
       }
 
       if (send_type)
-       cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type",
-                          PPDTypes[ppd->record.type]);
+      {
+        if (ppd->record.type < PPD_TYPE_POSTSCRIPT || ppd->record.type > PPD_TYPE_ARCHIVE)
+        {
+         /*
+          * This cache file is corrupted, remove it!
+          */
+
+          unlink(filename);
+
+         cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type", PPDTypes[PPD_TYPE_UNKNOWN]);
+        }
+        else
+         cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type", PPDTypes[ppd->record.type]);
+      }
 
       if (send_model_number)
        cupsdSendIPPInteger(IPP_TAG_INTEGER, "ppd-model-number",
@@ -2107,22 +2116,6 @@ load_ppd(const char  *filename,          /* I - Real filename */
        type = PPD_TYPE_RASTER;
       else if (strstr(line + 12, "application/vnd.cups-pdf"))
        type = PPD_TYPE_PDF;
-      else if (strstr(line + 12, "application/amf") ||
-               strstr(line + 12, "application/g-code") ||
-               strstr(line + 12, "application/sla"))
-       type = PPD_TYPE_OBJECT_ANY;
-    }
-    else if (!strncmp(line, "*cups3DWorkflows:", 17))
-    {
-      int is_direct = strstr(line + 17, "direct") != NULL;
-      int is_storage = strstr(line + 17, "storage") != NULL;
-
-      if (is_direct && !is_storage)
-        type = PPD_TYPE_OBJECT_DIRECT;
-      else if (!is_direct && is_storage)
-        type = PPD_TYPE_OBJECT_STORAGE;
-      else
-        type = PPD_TYPE_OBJECT_ANY;
     }
     else if (!strncmp(line, "*cupsModelNumber:", 17))
       sscanf(line, "*cupsModelNumber:%d", &model_number);