From 46ff2867011d9d70dbedf70a6b0d51a9f83939a8 Mon Sep 17 00:00:00 2001 From: Kirill Furman Date: Mon, 24 Feb 2025 22:31:45 +0300 Subject: [PATCH] Fix heap overflow in array.c When delim variable has \0 value, strchr() func switch end var to the end of string, set it to \0 and shift to next byte, which causes heap overflow when new cycle runs Fixes #1176 Signed-off by Kirill Furman --- cups/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cups/array.c b/cups/array.c index f870cf6648..4d8df96c8e 100644 --- a/cups/array.c +++ b/cups/array.c @@ -109,7 +109,7 @@ cupsArrayAddStrings(cups_array_t *a, // I - Array DEBUG_printf("_cupsArrayAddStrings(a=%p, s=\"%s\", delim='%c')", (void *)a, s, delim); - if (!a || !s || !*s) + if (!a || !s || !*s || delim == '\0') { DEBUG_puts("1_cupsArrayAddStrings: Returning 0"); return (false); -- 2.47.2