From: Till Kamppeter <till.kamppeter@gmail.com>
Date: Sun, 24 Sep 2023 22:17:17 +0000 (+0200)
Subject: _ppdCacheAssignPresets(): Added NULL checks for option choice properties record
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=97e448580f5f26d1be9d4e0d03f76efb0cbc8d5d;p=thirdparty%2Fcups.git

_ppdCacheAssignPresets(): Added NULL checks for option choice properties record

Static analysis of code, GitHub code scanning, found missing NULL
checks for allocating memory for option choice properties records
(gives NULL when out of memory) and for grabbing the records from a
CUPS array (should now never happen as we now skip the option on the
first memory allocation failure).

Added appropriate NULL checks. Now in case of unsufficient memory the
current option gets skipped on the first failed calloc() call.
---

diff --git a/cups/ppd-cache.c b/cups/ppd-cache.c
index 8966dc2076..72a414ba22 100644
--- a/cups/ppd-cache.c
+++ b/cups/ppd-cache.c
@@ -2252,6 +2252,9 @@ _ppdCacheAssignPresets(ppd_file_t *ppd,
       {
 	properties =
 	  (choice_properties_t *)calloc(1, sizeof(choice_properties_t));
+	/* No memory for choice properties, skip option */
+	if (properties == NULL)
+	  break;
 
 	c = option->choices[k].choice;
 
@@ -2645,6 +2648,9 @@ _ppdCacheAssignPresets(ppd_file_t *ppd,
 	/* Add the properties of this choice */
 	cupsArrayAdd(choice_properties, properties);
       }
+      /* Memory allocation failure, skip option */
+      if (k < option->num_choices)
+	goto skip;
 
      /*
       * Find the best choice for each field of the color/quality preset
@@ -2656,6 +2662,9 @@ _ppdCacheAssignPresets(ppd_file_t *ppd,
 	for (k = 0; k < option->num_choices; k ++)
         {
 	  properties = cupsArrayIndex(choice_properties, k);
+	  /* Should never happen, to satisfy GitHub code scanning */
+	  if (properties == NULL)
+	    continue;
 
 	  /* presets[0][0]: Mono/Draft */
 	  if (best_mono_draft >= 0 &&
@@ -2765,6 +2774,10 @@ _ppdCacheAssignPresets(ppd_file_t *ppd,
       for (k = 0; k < option->num_choices; k ++)
       {
 	properties = cupsArrayIndex(choice_properties, k);
+	/* Should never happen, to satisfy GitHub code scanning */
+	if (properties == NULL)
+	  continue;
+
 	c = option->choices[k].choice;
 
 	/* Vendor-specific options */
@@ -3046,7 +3059,8 @@ _ppdCacheAssignPresets(ppd_file_t *ppd,
 
       }
 
-      for (k = 0; k < option->num_choices; k ++)
+    skip:
+      for (k = 0; k < cupsArrayGetCount(choice_properties); k ++)
 	free(cupsArrayIndex(choice_properties, k));
       cupsArrayDelete(choice_properties);
     }