Fix potential crash in cups-driverd (rdar://46625579)

diff --git a/CHANGES.md b/CHANGES.md
index 0f89216d4a3d2ff3a3a63df2a4de5e33bc94f782..2ea55eff11cdfb103716c39fcf40cc2408c34e22 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,4 +1,4 @@
-CHANGES - 2.2.10 - 2018-12-10
+CHANGES - 2.2.11 - 2018-12-14
 =============================
 
 Changes in CUPS v2.2.11
@@ -6,6 +6,7 @@ Changes in CUPS v2.2.11
 
 - Running ppdmerge with the same input and output filenames did not work as
   advertised (Issue #5455)
+- Fixed a potential crash bug in cups-driverd (rdar://46625579)
 
 
 Changes in CUPS v2.2.10

diff --git a/scheduler/cups-driverd.cxx b/scheduler/cups-driverd.cxx
index e6684a13901368f289288f4c4640247a74becf29..c13fab48beaa92fafd97ed4cef11143459271c1a 100644 (file)
--- a/scheduler/cups-driverd.cxx
+++ b/scheduler/cups-driverd.cxx
@@ -31,7 +31,7 @@
  * Constants...
  */
 
-#define PPD_SYNC       0x50504439      /* Sync word for ppds.dat (PPD9) */
+#define PPD_SYNC       0x50504441      /* Sync word for ppds.dat (PPDA) */
 #define PPD_MAX_LANG   32              /* Maximum languages */
 #define PPD_MAX_PROD   32              /* Maximum products */
 #define PPD_MAX_VERS   32              /* Maximum versions */
@@ -40,12 +40,9 @@
 #define PPD_TYPE_PDF           1       /* PDF PPD */
 #define PPD_TYPE_RASTER                2       /* CUPS raster PPD */
 #define PPD_TYPE_FAX           3       /* Facsimile/MFD PPD */
-#define PPD_TYPE_OBJECT_ANY    4       /* 3D (AMF/STL/g-code) PPD */
-#define PPD_TYPE_OBJECT_DIRECT 5       /* 3D (AMF/STL/g-code) PPD over any connection */
-#define PPD_TYPE_OBJECT_STORAGE        6       /* 3D (AMF/STL/g-code) PPD for storage to SD card, etc. */
-#define PPD_TYPE_UNKNOWN       7       /* Other/hybrid PPD */
-#define PPD_TYPE_DRV           8       /* Driver info file */
-#define PPD_TYPE_ARCHIVE       9       /* Archive file */
+#define PPD_TYPE_UNKNOWN       4       /* Other/hybrid PPD */
+#define PPD_TYPE_DRV           5       /* Driver info file */
+#define PPD_TYPE_ARCHIVE       6       /* Archive file */
 
 #define TAR_BLOCK      512             /* Number of bytes in a block */
 #define TAR_BLOCKS     10              /* Blocking factor */
@@ -1527,8 +1524,20 @@ list_ppds(int        request_id, /* I - Request ID */
       }
 
       if (send_type)
-       cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type",
-                          PPDTypes[ppd->record.type]);
+      {
+        if (ppd->record.type < PPD_TYPE_POSTSCRIPT || ppd->record.type > PPD_TYPE_ARCHIVE)
+        {
+         /*
+          * This cache file is corrupted, remove it!
+          */
+
+          unlink(filename);
+
+         cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type", PPDTypes[PPD_TYPE_UNKNOWN]);
+        }
+        else
+         cupsdSendIPPString(IPP_TAG_KEYWORD, "ppd-type", PPDTypes[ppd->record.type]);
+      }
 
       if (send_model_number)
        cupsdSendIPPInteger(IPP_TAG_INTEGER, "ppd-model-number",
@@ -2111,22 +2120,6 @@ load_ppd(const char  *filename,          /* I - Real filename */
        type = PPD_TYPE_RASTER;
       else if (strstr(line + 12, "application/vnd.cups-pdf"))
        type = PPD_TYPE_PDF;
-      else if (strstr(line + 12, "application/amf") ||
-               strstr(line + 12, "application/g-code") ||
-               strstr(line + 12, "application/sla"))
-       type = PPD_TYPE_OBJECT_ANY;
-    }
-    else if (!strncmp(line, "*cups3DWorkflows:", 17))
-    {
-      int is_direct = strstr(line + 17, "direct") != NULL;
-      int is_storage = strstr(line + 17, "storage") != NULL;
-
-      if (is_direct && !is_storage)
-        type = PPD_TYPE_OBJECT_DIRECT;
-      else if (!is_direct && is_storage)
-        type = PPD_TYPE_OBJECT_STORAGE;
-      else
-        type = PPD_TYPE_OBJECT_ANY;
     }
     else if (!strncmp(line, "*cupsModelNumber:", 17))
       sscanf(line, "*cupsModelNumber:%d", &model_number);