Fix a gzip processing bug (STR #4602)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12577 a1ca3aef-8c08-0410-bb20-df032aa958be

diff --git a/CHANGES-2.0.txt b/CHANGES-2.0.txt
index 6f2fe0e388c8bd2cab903feb9477006444cc0d0c..3fe3d59e95d6f29b3a192ea05c7324d3c3155a22 100644 (file)
--- a/CHANGES-2.0.txt
+++ b/CHANGES-2.0.txt
@@ -7,6 +7,7 @@ CHANGES IN CUPS V2.0.3
        - Fixed logging of configuration errors to show up as errors (STR #4582)
        - Fixed potential buffer overflows in raster code and filters
          (STR #4598, STR #4599, STR #4600, STR #4601)
+       - Fixed a gzip processing bug (#4602)
        - Added Russian translation (STR #4577)
 
 

diff --git a/cups/file.c b/cups/file.c
index b55010fec45fcf0b151233fb5e7dedad705bc3c0..3672d4254b1b6c365ad031d870b79c52d7cd8168 100644 (file)
--- a/cups/file.c
+++ b/cups/file.c
@@ -8,7 +8,7 @@
  * our own file functions allows us to provide transparent support of
  * gzip'd print files, PPD files, etc.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -639,6 +639,8 @@ cupsFileGetChar(cups_file_t *fp)    /* I - CUPS file */
   * Range check input...
   */
 
+  DEBUG_printf(("4cupsFileGetChar(fp=%p)", fp));
+
   if (!fp || (fp->mode != 'r' && fp->mode != 's'))
   {
     DEBUG_puts("5cupsFileGetChar: Bad arguments!");
@@ -649,8 +651,10 @@ cupsFileGetChar(cups_file_t *fp)   /* I - CUPS file */
   * If the input buffer is empty, try to read more data...
   */
 
+  DEBUG_printf(("5cupsFileGetChar: fp->eof=%d, fp->ptr=%p, fp->end=%p", fp->eof, fp->ptr, fp->end));
+
   if (fp->ptr >= fp->end)
-    if (cups_fill(fp) < 0)
+    if (cups_fill(fp) <= 0)
     {
       DEBUG_puts("5cupsFileGetChar: Unable to fill buffer!");
       return (-1);
@@ -1284,7 +1288,7 @@ cupsFilePeekChar(cups_file_t *fp) /* I - CUPS file */
   */
 
   if (fp->ptr >= fp->end)
-    if (cups_fill(fp) < 0)
+    if (cups_fill(fp) <= 0)
       return (-1);
 
  /*
@@ -1779,7 +1783,7 @@ cupsFileSeek(cups_file_t *fp,             /* I - CUPS file */
     * Preload a buffer to determine whether the file is compressed...
     */
 
-    if (cups_fill(fp) < 0)
+    if (cups_fill(fp) <= 0)
       return (-1);
   }
 #endif /* HAVE_LIBZ */
@@ -2195,6 +2199,8 @@ cups_fill(cups_file_t *fp)                /* I - CUPS file */
         DEBUG_printf(("9cups_fill: cups_read() returned " CUPS_LLFMT,
                      CUPS_LLCAST bytes));
 
+        fp->eof = 1;
+
        return (-1);
       }
 
@@ -2234,6 +2240,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
          * Can't read from file!
          */
 
+         DEBUG_puts("9cups_fill: Extra gzip header data missing, returning -1.");
+
+          fp->eof = 1;
+         errno   = EIO;
+
          return (-1);
        }
 
@@ -2246,6 +2257,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
          * Can't read from file!
          */
 
+         DEBUG_puts("9cups_fill: Extra gzip header data does not fit in initial buffer, returning -1.");
+
+          fp->eof = 1;
+         errno   = EIO;
+
          return (-1);
        }
       }
@@ -2267,6 +2283,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
          * Can't read from file!
          */
 
+         DEBUG_puts("9cups_fill: Original filename in gzip header data does not fit in initial buffer, returning -1.");
+
+          fp->eof = 1;
+         errno   = EIO;
+
          return (-1);
        }
       }
@@ -2288,6 +2309,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
          * Can't read from file!
          */
 
+         DEBUG_puts("9cups_fill: Comment in gzip header data does not fit in initial buffer, returning -1.");
+
+          fp->eof = 1;
+         errno   = EIO;
+
          return (-1);
        }
       }
@@ -2306,6 +2332,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
          * Can't read from file!
          */
 
+         DEBUG_puts("9cups_fill: Header CRC in gzip header data does not fit in initial buffer, returning -1.");
+
+          fp->eof = 1;
+         errno   = EIO;
+
          return (-1);
        }
       }
@@ -2330,8 +2361,15 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
       fp->stream.avail_out = 0;
       fp->crc              = crc32(0L, Z_NULL, 0);
 
-      if (inflateInit2(&(fp->stream), -15) != Z_OK)
+      if ((status = inflateInit2(&(fp->stream), -15)) != Z_OK)
+      {
+       DEBUG_printf(("9cups_fill: inflateInit2 returned %d, returning -1.", status));
+
+        fp->eof = 1;
+        errno   = EIO;
+
        return (-1);
+      }
 
       fp->compressed = 1;
     }
@@ -2343,7 +2381,11 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
       */
 
       if (fp->eof)
-       return (-1);
+      {
+        DEBUG_puts("9cups_fill: EOF, returning 0.");
+
+       return (0);
+      }
 
      /*
       * Fill the decompression buffer as needed...
@@ -2352,7 +2394,13 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
       if (fp->stream.avail_in == 0)
       {
        if ((bytes = cups_read(fp, (char *)fp->cbuf, sizeof(fp->cbuf))) <= 0)
-          return (-1);
+       {
+         DEBUG_printf(("9cups_fill: cups_read error, returning %d.", (int)bytes));
+
+         fp->eof = 1;
+
+          return (bytes);
+       }
 
        fp->stream.next_in  = fp->cbuf;
        fp->stream.avail_in = (uInt)bytes;
@@ -2379,42 +2427,69 @@ cups_fill(cups_file_t *fp)              /* I - CUPS file */
 
        unsigned char   trailer[8];     /* Trailer bytes */
        uLong           tcrc;           /* Trailer CRC */
+       ssize_t         tbytes = 0;     /* Number of bytes */
 
-
-       if (read(fp->fd, trailer, sizeof(trailer)) < (ssize_t)sizeof(trailer))
+       if (fp->stream.avail_in > 0)
        {
-        /*
-          * Can't get it, so mark end-of-file...
-         */
+         if (fp->stream.avail_in > sizeof(trailer))
+           tbytes = (ssize_t)sizeof(trailer);
+         else
+           tbytes = (ssize_t)fp->stream.avail_in;
 
-          fp->eof = 1;
+         memcpy(trailer, fp->stream.next_in, tbytes);
+         fp->stream.next_in  += tbytes;
+         fp->stream.avail_in -= (size_t)tbytes;
        }
-       else
-       {
-         tcrc = ((((((uLong)trailer[3] << 8) | (uLong)trailer[2]) << 8) |
-                 (uLong)trailer[1]) << 8) | (uLong)trailer[0];
 
-         if (tcrc != fp->crc)
+        if (tbytes < (ssize_t)sizeof(trailer))
+       {
+         if (read(fp->fd, trailer + tbytes, sizeof(trailer) - (size_t)tbytes) < ((ssize_t)sizeof(trailer) - tbytes))
          {
           /*
-            * Bad CRC, mark end-of-file...
+           * Can't get it, so mark end-of-file...
            */
 
-            DEBUG_printf(("9cups_fill: tcrc=%08x != fp->crc=%08x",
-                         (unsigned int)tcrc, (unsigned int)fp->crc));
+           DEBUG_puts("9cups_fill: Unable to read gzip CRC trailer, returning -1.");
 
            fp->eof = 1;
+           errno   = EIO;
 
            return (-1);
          }
+       }
+
+       tcrc = ((((((uLong)trailer[3] << 8) | (uLong)trailer[2]) << 8) |
+               (uLong)trailer[1]) << 8) | (uLong)trailer[0];
 
+       if (tcrc != fp->crc)
+       {
         /*
-         * Otherwise, reset the compressed flag so that we re-read the
-         * file header...
+         * Bad CRC, mark end-of-file...
          */
 
-         fp->compressed = 0;
+         DEBUG_printf(("9cups_fill: tcrc=%08x != fp->crc=%08x, returning -1.", (unsigned int)tcrc, (unsigned int)fp->crc));
+
+         fp->eof = 1;
+         errno   = EIO;
+
+         return (-1);
        }
+
+       /*
+       * Otherwise, reset the compressed flag so that we re-read the
+       * file header...
+       */
+
+       fp->compressed = 0;
+      }
+      else if (status < Z_OK)
+      {
+       DEBUG_printf(("9cups_fill: inflate returned %d, returning -1.", status));
+
+        fp->eof = 1;
+        errno   = EIO;
+
+       return (-1);
       }
 
       bytes = (ssize_t)sizeof(fp->buf) - (ssize_t)fp->stream.avail_out;
@@ -2427,7 +2502,10 @@ cups_fill(cups_file_t *fp)               /* I - CUPS file */
       fp->end = fp->buf + bytes;
 
       if (bytes)
+      {
+        DEBUG_printf(("9cups_fill: Returning %d.", (int)bytes));
        return (bytes);
+      }
     }
   }
 #endif /* HAVE_LIBZ */
@@ -2445,17 +2523,19 @@ cups_fill(cups_file_t *fp)              /* I - CUPS file */
     fp->eof = 1;
     fp->ptr = fp->buf;
     fp->end = fp->buf;
-
-    return (-1);
   }
+  else
+  {
+   /*
+    * Return the bytes we read...
+    */
 
- /*
-  * Return the bytes we read...
-  */
+    fp->eof = 0;
+    fp->ptr = fp->buf;
+    fp->end = fp->buf + bytes;
+  }
 
-  fp->eof = 0;
-  fp->ptr = fp->buf;
-  fp->end = fp->buf + bytes;
+  DEBUG_printf(("9cups_fill: Not gzip, returning %d.", (int)bytes));
 
   return (bytes);
 }

diff --git a/cups/testfile.c b/cups/testfile.c
index 8555e079df1a1c42bd463200c50767fd1862cd35..9dbd8d549d357cc8953668c7dff2d6f40fc69f39 100644 (file)
--- a/cups/testfile.c
+++ b/cups/testfile.c
@@ -3,7 +3,7 @@
  *
  * File test program for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1997-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -205,14 +205,14 @@ main(int  argc,                           /* I - Number of command-line arguments */
     * Cat the filename on the command-line...
     */
 
-    char       line[1024];             /* Line from file */
+    char       line[8192];             /* Line from file */
 
     if ((fp = cupsFileOpen(argv[1], "r")) == NULL)
     {
       perror(argv[1]);
       status = 1;
     }
-    else
+    else if (argc == 2)
     {
       status = 0;
 
@@ -224,6 +224,21 @@ main(int  argc,                            /* I - Number of command-line arguments */
 
       cupsFileClose(fp);
     }
+    else
+    {
+      status = 0;
+      ssize_t bytes;
+
+      while ((bytes = cupsFileRead(fp, line, sizeof(line))) > 0)
+        printf("%s: %d bytes\n", argv[1], (int)bytes);
+
+      if (cupsFileEOF(fp))
+        printf("%s: EOF\n", argv[1]);
+      else
+        perror(argv[1]);
+
+      cupsFileClose(fp);
+    }
   }
 
   return (status);
@@ -798,7 +813,8 @@ read_write_tests(int compression)   /* I - Use compression? */
   * Remove the test file...
   */
 
-  unlink(compression ? "testfile.dat.gz" : "testfile.dat");
+  if (!status)
+    unlink(compression ? "testfile.dat.gz" : "testfile.dat");
 
  /*
   * Return the test status...

diff --git a/scheduler/type.c b/scheduler/type.c
index 60bc0ca5d70d3d11474ef743ae038081fe86ce4f..5300d7e7d6981316fbb84946e05b6698047c2ea6 100644 (file)
--- a/scheduler/type.c
+++ b/scheduler/type.c
@@ -3,7 +3,7 @@
  *
  * MIME typing routines for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  * These coded instructions, statements, and computer programs are the
@@ -613,8 +613,23 @@ mimeFileType(mime_t     *mime,             /* I - MIME database */
     return (NULL);
   }
 
-  fb.offset = -1;
-  fb.length = 0;
+ /*
+  * Then preload the first MIME_MAX_BUFFER bytes of the file into the file
+  * buffer, returning an error if we can't read anything...
+  */
+
+  fb.offset = 0;
+  fb.length = (int)cupsFileRead(fb.fp, (char *)fb.buffer, MIME_MAX_BUFFER);
+
+  if (fb.length <= 0)
+  {
+    DEBUG_printf(("1mimeFileType: Unable to read from \"%s\": %s", pathname, strerror(errno)));
+    DEBUG_puts("1mimeFileType: Returning NULL.");
+
+    cupsFileClose(fb.fp);
+
+    return (NULL);
+  }
 
  /*
   * Figure out the base filename (without directory portion)...
@@ -780,6 +795,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_ASCII fb->length=%d", fb->length));
          }
 
          /*
@@ -822,6 +839,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_PRINTABLE fb->length=%d", fb->length));
          }
 
          /*
@@ -870,6 +889,8 @@ mime_check_rules(
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
 
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_REGEX fb->length=%d", fb->length));
+
             DEBUG_printf(("5mime_check_rules: loaded %d byte fb->buffer at %d, starts "
                          "with \"%c%c%c%c\".",
                          fb->length, fb->offset, fb->buffer[0], fb->buffer[1],
@@ -914,6 +935,8 @@ mime_check_rules(
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
 
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_STRING fb->length=%d", fb->length));
+
             DEBUG_printf(("5mime_check_rules: loaded %d byte fb->buffer at %d, starts "
                          "with \"%c%c%c%c\".",
                          fb->length, fb->offset, fb->buffer[0], fb->buffer[1],
@@ -948,6 +971,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_ISTRING fb->length=%d", fb->length));
          }
 
          /*
@@ -976,6 +1001,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_CHAR fb->length=%d", fb->length));
          }
 
         /*
@@ -1006,6 +1033,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_SHORT fb->length=%d", fb->length));
          }
 
         /*
@@ -1039,6 +1068,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_INT fb->length=%d", fb->length));
          }
 
         /*
@@ -1080,6 +1111,8 @@ mime_check_rules(
            fb->length = cupsFileRead(fb->fp, (char *)fb->buffer,
                                      sizeof(fb->buffer));
            fb->offset = rules->offset;
+
+           DEBUG_printf(("4mime_check_rules: MIME_MAGIC_CONTAINS fb->length=%d", fb->length));
          }
 
          /*