Backport fix for crash in ppdEmitString()

diff --git a/CHANGES.md b/CHANGES.md
index 39be7d4ce5aa87328df965695dcceb50d51d8543..7ab6ca8952c9f71e81e784e04b5d56532576e226 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -16,6 +16,7 @@ Changes in CUPS v2.4.8 (TBA)
 - Fixed setting job state reasons for successful jobs (Issue #832)
 - Added additional check on socket if `revents` from `poll()` returns POLLHUP
   together with POLLIN or POLLOUT in `httpAddrConnect2()` (Issue #839)
+- Fixed crash in `ppdEmitString()` if `size` is NULL (Issue #850)
 - Fixed IPP backend to support the "print-scaling" option with IPP printers
   (Issue #862)
 

diff --git a/cups/ppd-emit.c b/cups/ppd-emit.c
index c7bff4d05eb690213e04345bbc1126d203a3b1ff..1b9b4559dd8fdcd4b3895c039c84412f2aa5b50f 100644 (file)
--- a/cups/ppd-emit.c
+++ b/cups/ppd-emit.c
@@ -893,7 +893,12 @@ ppdEmitString(ppd_file_t    *ppd,  /* I - PPD file record */
         strlcpy(bufptr, "%%BeginFeature: *CustomPageSize True\n", (size_t)(bufend - bufptr + 1));
         bufptr += 37;
 
-        size = ppdPageSize(ppd, "Custom");
+        if ((size = ppdPageSize(ppd, "Custom")) == NULL)
+        {
+          free(buffer);
+          free(choices);
+          return (NULL);
+        }
 
         memset(values, 0, sizeof(values));