From 8b68a94692f2c0d711eb5d455fd71afbfa93d77a Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Sat, 30 Aug 2025 09:34:54 -0400
Subject: [PATCH] Mirror coverity fixes for subscription locking code.

---
 scheduler/ipp.c           | 18 +++++++++++++-----
 scheduler/subscriptions.c | 31 ++++++++++++++++++++++---------
 2 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index 3bf015708d..2f104cc671 100644
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -3624,12 +3624,17 @@ static int				/* O - 1 if OK, 0 if not */
 check_rss_recipient(
     const char *recipient)		/* I - Recipient URI */
 {
+  int			i,		/* Looping var */
+			scount;		/* Number of subscriptions */
   cupsd_subscription_t	*sub;		/* Current subscription */
 
 
-  for (sub = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions);
-       sub;
-       sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+  _cupsRWLockRead(&SubscriptionsLock);
+
+  for (i = 0, scount = cupsArrayCount(Subscriptions); i < scount; i ++)
+  {
+    sub = (cupsd_subscription_t *)cupsArrayIndex(Subscriptions, i);
+
     if (sub->recipient)
     {
      /*
@@ -3645,6 +3650,9 @@ check_rss_recipient(
       if (*r1 == *r2)
         return (0);
     }
+  }
+
+  _cupsRWUnlock(&SubscriptionsLock);
 
   return (1);
 }
@@ -9509,14 +9517,14 @@ renew_subscription(
 
   sub->expire = sub->lease ? time(NULL) + sub->lease : 0;
 
-  _cupsRWUnlock(&sub->lock);
-
   cupsdMarkDirty(CUPSD_DIRTY_SUBSCRIPTIONS);
 
   con->response->request.status.status_code = IPP_STATUS_OK;
 
   ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
                 "notify-lease-duration", sub->lease);
+
+  _cupsRWUnlock(&sub->lock);
 }
 
 
diff --git a/scheduler/subscriptions.c b/scheduler/subscriptions.c
index abd3ce0cfa..32294e5604 100644
--- a/scheduler/subscriptions.c
+++ b/scheduler/subscriptions.c
@@ -418,19 +418,23 @@ cupsdDeleteAllSubscriptions(void)
   cupsd_subscription_t	*sub;		/* Subscription */
 
 
-  if (!Subscriptions)
-    return;
-
   _cupsRWLockWrite(&SubscriptionsLock);
 
+  if (!Subscriptions)
+    goto done;
+
   for (sub = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions);
        sub;
        sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+  {
     cupsdDeleteSubscription(sub, -1);
+  }
 
   cupsArrayDelete(Subscriptions);
   Subscriptions = NULL;
 
+  done:
+
   _cupsRWUnlock(&SubscriptionsLock);
 }
 
@@ -641,20 +645,19 @@ cupsdExpireSubscriptions(
     cupsd_job_t	    *job)		/* I - Job, if any */
 {
   cupsd_subscription_t	*sub;		/* Current subscription */
-  int			update;		/* Update subscriptions.conf? */
+  int			update = 0;	/* Update subscriptions.conf? */
   time_t		curtime;	/* Current time */
 
 
+  _cupsRWLockWrite(&SubscriptionsLock);
+
   if (cupsArrayCount(Subscriptions) == 0)
-    return;
+    goto done;
 
   curtime = time(NULL);
-  update  = 0;
 
   cupsdLogMessage(CUPSD_LOG_DEBUG, "Expiring subscriptions...");
 
-  _cupsRWLockWrite(&SubscriptionsLock);
-
   for (sub = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions);
        sub;
        sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
@@ -672,6 +675,8 @@ cupsdExpireSubscriptions(
     }
   }
 
+  done:
+
   _cupsRWUnlock(&SubscriptionsLock);
 
   if (update)
@@ -1206,9 +1211,12 @@ cupsdStopAllNotifiers(void)
   * Yes, kill any processes that are left...
   */
 
+  _cupsRWLockWrite(&SubscriptionsLock);
+
   for (sub = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions);
        sub;
        sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+  {
     if (sub->pid)
     {
       cupsdEndProcess(sub->pid, 0);
@@ -1216,6 +1224,9 @@ cupsdStopAllNotifiers(void)
       close(sub->pipe);
       sub->pipe = -1;
     }
+  }
+
+  _cupsRWUnlock(&SubscriptionsLock);
 
  /*
   * Close the status pipes...
@@ -1386,7 +1397,7 @@ cupsd_send_notification(
       cupsdLogMessage(CUPSD_LOG_CRIT,
 		      "Unable to allocate memory for subscription #%d!",
 		      sub->id);
-      return;
+      goto done;
     }
   }
 
@@ -1474,6 +1485,8 @@ cupsd_send_notification(
 
   sub->next_event_id ++;
 
+  done:
+
   _cupsRWUnlock(&sub->lock);
 }
 
-- 
2.47.3