From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 11 Nov 2025 21:28:46 +0000 (-0500)
Subject: Fix potential crash in cups-driverd due to duplicate PPDs (Issue #1355)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7457bdab980a9aa7ffbec443e81194a0064c25c0;p=thirdparty%2Fcups.git

Fix potential crash in cups-driverd due to duplicate PPDs (Issue #1355)
---

diff --git a/scheduler/cups-driverd.cxx b/scheduler/cups-driverd.cxx
index 28e37e089d..cf757ed472 100644
--- a/scheduler/cups-driverd.cxx
+++ b/scheduler/cups-driverd.cxx
@@ -1099,26 +1099,6 @@ list_ppds(int        request_id,	// I - Request ID
     load_ppds("/opt/share/ppd", "lsb/opt", 1);
 #endif // __APPLE__
 
- /*
-  * Cull PPD files that are no longer present...
-  */
-
-  for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName);
-       ppd;
-       ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
-    if (!ppd->found)
-    {
-     /*
-      * Remove this PPD file from the list...
-      */
-
-      cupsArrayRemove(PPDsByName, ppd);
-      cupsArrayRemove(PPDsByMakeModel, ppd);
-      free(ppd);
-
-      ChangedPPD = 1;
-    }
-
  /*
   * Write the new ppds.dat file...
   */
@@ -1137,10 +1117,11 @@ list_ppds(int        request_id,	// I - Request ID
 
       cupsFileWrite(fp, (char *)&ppdsync, sizeof(ppdsync));
 
-      for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName);
-	   ppd;
-	   ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
-	cupsFileWrite(fp, (char *)&(ppd->record), sizeof(ppd_rec_t));
+      for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName); ppd; ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
+      {
+        if (ppd->found)
+	  cupsFileWrite(fp, (char *)&(ppd->record), sizeof(ppd_rec_t));
+      }
 
       cupsFileClose(fp);
 
@@ -1309,7 +1290,8 @@ list_ppds(int        request_id,	// I - Request ID
       */
 
       if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-	  ppd->record.type >= PPD_TYPE_DRV)
+	  ppd->record.type >= PPD_TYPE_DRV ||
+	  !ppd->found)
 	continue;
 
       if (cupsArrayFind(exclude, ppd->record.scheme) ||
@@ -1422,7 +1404,8 @@ list_ppds(int        request_id,	// I - Request ID
       */
 
       if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-	  ppd->record.type >= PPD_TYPE_DRV)
+	  ppd->record.type >= PPD_TYPE_DRV ||
+	  !ppd->found)
 	continue;
 
       if (cupsArrayFind(exclude, ppd->record.scheme) ||
@@ -1444,7 +1427,8 @@ list_ppds(int        request_id,	// I - Request ID
     */
 
     if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-        ppd->record.type >= PPD_TYPE_DRV)
+        ppd->record.type >= PPD_TYPE_DRV ||
+        !ppd->found)
       continue;
 
    /*