From: Aizal Khan <aizumusheer2@gmail.com>
Date: Thu, 25 Jun 2026 17:15:13 +0000 (+0530)
Subject: bound the nul terminator in cups_collection_string
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dca3df73fbbbf67c8858a1f0eb7287595c20ada7;p=thirdparty%2Fcups.git

bound the nul terminator in cups_collection_string

The serialiser advances bufptr past bufend to report the length needed, so the final *bufptr = '\0' could terminate out of bounds once a collection overflows the buffer. Clamp it the way ippAttributeString already does, and keep the bufsize==0 sub-collection call safe.
---

diff --git a/cups/dest-options.c b/cups/dest-options.c
index 892b595781..cc17dce7ed 100644
--- a/cups/dest-options.c
+++ b/cups/dest-options.c
@@ -2161,7 +2161,11 @@ cups_collection_string(
       bufptr ++;
   }
 
-  *bufptr = '\0';
+  if (bufptr < bufend)
+    *bufptr = '\0';
+  else if (bufsize > 0)
+    *bufend = '\0';
+
   return ((size_t)(bufptr - buffer + 1));
 }