From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Fri, 12 Jan 2024 10:05:17 +0000 (+0100)
Subject: Backport fix for crash in ppdEmitString()
X-Git-Tag: v2.4.8~31
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5de694bcd568af0470aa74d003a6eced5b30da14;p=thirdparty%2Fcups.git

Backport fix for crash in ppdEmitString()
---

diff --git a/CHANGES.md b/CHANGES.md
index 39be7d4ce5..7ab6ca8952 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -16,6 +16,7 @@ Changes in CUPS v2.4.8 (TBA)
 - Fixed setting job state reasons for successful jobs (Issue #832)
 - Added additional check on socket if `revents` from `poll()` returns POLLHUP
   together with POLLIN or POLLOUT in `httpAddrConnect2()` (Issue #839)
+- Fixed crash in `ppdEmitString()` if `size` is NULL (Issue #850)
 - Fixed IPP backend to support the "print-scaling" option with IPP printers
   (Issue #862)
 
diff --git a/cups/ppd-emit.c b/cups/ppd-emit.c
index c7bff4d05e..1b9b4559dd 100644
--- a/cups/ppd-emit.c
+++ b/cups/ppd-emit.c
@@ -893,7 +893,12 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
         strlcpy(bufptr, "%%BeginFeature: *CustomPageSize True\n", (size_t)(bufend - bufptr + 1));
         bufptr += 37;
 
-        size = ppdPageSize(ppd, "Custom");
+        if ((size = ppdPageSize(ppd, "Custom")) == NULL)
+        {
+          free(buffer);
+          free(choices);
+          return (NULL);
+        }
 
         memset(values, 0, sizeof(values));