bound the nul terminator in cups_collection_string

The serialiser advances bufptr past bufend to report the length needed, so the final *bufptr = '\0' could terminate out of bounds once a collection overflows the buffer. Clamp it the way ippAttributeString already does, and keep the bufsize==0 sub-collection call safe.

diff --git a/cups/dest-options.c b/cups/dest-options.c
index 892b5957810bed52f3554d0374c9ae36c05c0036..cc17dce7ed2dfd6a6978158e76a1180fe064ece6 100644 (file)
--- a/cups/dest-options.c
+++ b/cups/dest-options.c
@@ -2161,7 +2161,11 @@ cups_collection_string(
       bufptr ++;
   }
 
-  *bufptr = '\0';
+  if (bufptr < bufend)
+    *bufptr = '\0';
+  else if (bufsize > 0)
+    *bufend = '\0';
+
   return ((size_t)(bufptr - buffer + 1));
 }