Sometimes headers are not correctly copied into response to the client
(some are missing). It happens because `sent_header` is set prematurely
before the actual send happens. The present code in affected `cupsdWriteClient`
scope looks like code remains from CUPS 1.6.3.
With the change, testing via curl gives reliable results all time.
Benjamin Gordon [Mon, 25 Mar 2024 15:59:21 +0000 (09:59 -0600)]
Add additional parameter validation to _cupsRasterWritePixels
If len is 0, the function does a lot of calculations that ultimately
don't produce any output. This can be skipped with an early return.
If cupsBytesPerLine is 0, this triggers a divide by zero if the output
isn't compressed. This is an error on the caller's part, but it's
nicer to return an error than to crash.
zdohnal [Tue, 19 Mar 2024 09:41:19 +0000 (10:41 +0100)]
snmp.c: Validate input OID string for `_cupsSNMPStringToOID()`
We can accept OID string as input in few cases (mainly via side channel) and if the crafted OID string is sent, internal function asn1_size_oid() can end up with stack buffer overflow.
The issue happens when one OID node is too large, or OID is invalid (ending with dots) - we can fix it in _cupsSNMPStringToOID() by checking if the last source character is a dot (invalid OID), and by limiting integer for OID node to 0xffff.
Zdenek Dohnal [Mon, 18 Mar 2024 14:02:30 +0000 (15:02 +0100)]
snmp.c: Validate input OID string for `_cupsSNMPStringToOID()`
We can accept OID string as input in few cases (mainly via side channel)
and if the crafted OID string is sent, internal function
`asn1_size_oid()` can end up with stack buffer overflow.
The issue happens when one OID node is too large, or OID is invalid
(ending with dots) - we can fix it in `_cupsSNMPStringToOID()` by
checking if the last source character is a dot (invalid OID),
and by limiting integer for OID node to 0xffff.
zdohnal [Thu, 15 Feb 2024 12:45:34 +0000 (13:45 +0100)]
ppd-cache.c: Check for required attributes if URF or PWG Raster are found
Some devices have image/urf in document-format-supported, but is missing urf-supported if AirPrint support is turned off, which breaks PPD generation.
Check for attribute urf-supported when we are about to decide whether the printer uses AirPrint, so in case the device supports another driverless standard, we can use it for PPD generation.
Zdenek Dohnal [Tue, 13 Feb 2024 07:20:52 +0000 (08:20 +0100)]
ppd-cache.c: Check for `urf-supported` if `image/urf` is found
Some devices have `image/urf` in `document-format-supported`, but is
missing `urf-supported` if AirPrint support is turned off, which breaks
PPD generation.
Check for attribute `urf-supported` when we are about to decide whether
the printer uses AirPrint, so in case the device supports another
driverless standard, we can use it for PPD generation.
zdohnal [Wed, 14 Feb 2024 13:08:06 +0000 (14:08 +0100)]
Use PAM password-auth or system-auth if present
Enables possibility to use PAM modules password-auth or system-auth if they exist during compilation. password-auth module is for remote authentication and system-auth for local authentication.
Zdenek Dohnal [Wed, 14 Feb 2024 08:35:05 +0000 (09:35 +0100)]
Use PAM password-auth or system-auth if present
This PR is actually based on one really old patch we have in Fedora,
which enables possibility to use PAM modules password-auth or
system-auth if they exist during compilation.
Those PAM modules looks to be used for remote, respective local
authentication, in Linux. Would it be possible to add their support into
CUPS?
zdohnal [Tue, 16 Jan 2024 12:27:10 +0000 (13:27 +0100)]
backend/ipp.c: Fix printing jobs with long names on older IPP printers
On older printers (ones which don't support IPP operation Create-Job) we concatenate job number and title into one string, which we use as IPP attribute job-name. If the original title was almost 255 chars, the joining the strings will overflow maximal required length for this attribute, and Validate-Job fails.
We could check whether the string is longer than 255 and cut it, but I chose to shrink the buffer to 256, since we already use snprintf() which will cut the string and put null terminator for us.
Zdenek Dohnal [Tue, 16 Jan 2024 07:31:15 +0000 (08:31 +0100)]
backend/ipp.c: Fix printing jobs with long names on older IPP printers
On older printers (ones which don't support IPP operation Create-Job)
we concatenate job number and title into one string, which we use as
IPP attribute job-name. If the original title was almost 255 chars,
the joining the strings will overflow maximal required length
for this attribute, and Validate-Job fails.
We could check whether the string is longer than 255 and cut it,
but I chose to shrink the buffer to 256, since we already use snprintf()
which will cut the string and put null terminator for us.
zdohnal [Mon, 15 Jan 2024 15:00:56 +0000 (16:00 +0100)]
backend/ipp.c: Fix infinite loop with Kerberos
If IP address was used with Kerberos, IPP backend retried connection indefinitely. The fix is to abort when we find out hostname is an IP address and we require Kerberos.
Zdenek Dohnal [Mon, 15 Jan 2024 14:14:24 +0000 (15:14 +0100)]
backend/ipp.c: Fix infinite loop with Kerberos
If IP address was used with Kerberos, IPP backend retried connection
indefinitely. The fix is to abort when we find out hostname is an IP
address and we require Kerberos.
ValdikSS [Tue, 9 Jan 2024 01:21:52 +0000 (04:21 +0300)]
Report proper media-source-supported IPP field on numeric InputSlots. #859
Windows 11 version 22H2 build 22621.2861 silently fails to add Mopria
auto-discovered printer if it reports a number (a digit as a string)
in media-source-supported field.
If you try to add such a printer using modern control panel, it will
show endless "connecting…" message, and if you add it using old
control panel, it would be added "successfully", but under
"unrecognized" device type, and you won't be able to print on it.
Fix the issue by
* By comparing also by human-readable InputSlot name
* By mapping number to "tray-N" string
Zdenek Dohnal [Thu, 4 Jan 2024 12:58:42 +0000 (13:58 +0100)]
dnssd.c: Fix deadlock in `cups_enum_dests()`
Deadlock happens when we are about to destroy DNSSD struct by the end
of `cups_enum_dests()`. The main thread locks the mutex when the other
thread is in avahi poll callback at function `poll()` and unlocked the
mutex before - the other thread tries to lock the mutex once poll
timeout expires, but it cannot because it was locked by the main thread
and wait there. Meanwhile the main thread tries to cancel the other
thread, but the function where the other thread is not a cancellation
point, thus the cancel event is ignored and the main thread thread waits
indefinitely for the end of the other thread.
We can make the other thread asynchronous (which would cancel the thread
immediately) or release the mutex earlier in `cupsDNSSDDelete()`. The
commit does the latter.
zdohnal [Thu, 4 Jan 2024 09:53:05 +0000 (10:53 +0100)]
ppd-emit.c: Fix SEGV in 'ppdEmitString()'
When using testppd.c as a harness, a fuzzer found a way to call ppdPageSize() with NULL return value.
This caused a segmentation fault because the size structure, which is used by values[pos], was assigned a NULL value.
To avoid this, we need to add a NULL value check for the size structure, free allocated memory, and return NULL.
Kirill Furman [Wed, 27 Dec 2023 13:34:24 +0000 (16:34 +0300)]
ppd-emit.c: Fix SEGV in 'ppdEmitString()'
When using testppd.c as a harness, a fuzzer found a way to call
ppdPageSize() with NULL return value. This caused a segmentation fault
because the size structure, which is used by values[pos],
was assigned a NULL value. To avoid this, we need to add a
NULL value check for the size structure, free allocated memory,
and return NULL.
zdohnal [Thu, 14 Dec 2023 16:33:40 +0000 (17:33 +0100)]
httpAddrConnect2: Check for error if POLLHUP is in valid revents
Some Linux kernel versions put POLLOUT|POLLHUP into revents when client tries to connect with httpAddrConnect2(), which makes the connection fail.
Let's check the option SO_ERROR before scratching the attempt - if there is no error, remove POLLHUP from revents.
I've re-purposed previously Solaris-only code to be used everywhere if the conditions are met - this should prevent bigger delays than necessary.
Slightly different issue than #827, but with similar symptoms (kernel sending POLLOUT|POLLHUP).
Zdenek Dohnal [Thu, 14 Dec 2023 08:37:22 +0000 (09:37 +0100)]
httpAddrConnect2: Check for error if POLLHUP is in valid revents
Some Linux kernel versions put POLLOUT|POLLHUP into revents when client tries to connect with httpAddrConnect2(), which makes the connection fail.
Let's check the option SO_ERROR before scratching the attempt - if there is no error, remove POLLHUP from revents.
I've re-purposed previously Solaris-only code to be used everywhere if the conditions are met - this should prevent bigger delays than necessary.
Slightly different issue than #827, but with similar symptoms (kernel sending POLLOUT|POLLHUP).
zdohnal [Wed, 29 Nov 2023 14:07:18 +0000 (15:07 +0100)]
scheduler: Fix build failure on Linux with '-Werror -Wall'
The string which we add into array stays const after fixing #814 (because strdup(), which caused memory leak returned char *) and compiler fails because of it if it runs with '-Werror -Wall'.