From: Kirill Furman <kir.furman@gmail.com>
Date: Mon, 24 Feb 2025 19:31:45 +0000 (+0300)
Subject: Fix heap overflow in array.c
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46ff2867011d9d70dbedf70a6b0d51a9f83939a8;p=thirdparty%2Fcups.git

Fix heap overflow in array.c
When delim variable has \0 value,
strchr() func switch end var to the end of string,
set it to \0 and shift to next byte, which causes
heap overflow when new cycle runs
Fixes #1176
Signed-off by Kirill Furman <kir.furman@gmail.com>
---

diff --git a/cups/array.c b/cups/array.c
index f870cf6648..4d8df96c8e 100644
--- a/cups/array.c
+++ b/cups/array.c
@@ -109,7 +109,7 @@ cupsArrayAddStrings(cups_array_t *a,	// I - Array
 
   DEBUG_printf("_cupsArrayAddStrings(a=%p, s=\"%s\", delim='%c')", (void *)a, s, delim);
 
-  if (!a || !s || !*s)
+  if (!a || !s || !*s || delim == '\0')
   {
     DEBUG_puts("1_cupsArrayAddStrings: Returning 0");
     return (false);