From: Aayush Kumar <166936037+AayushKumar26@users.noreply.github.com>
Date: Tue, 21 Jul 2026 21:15:22 +0000 (+0530)
Subject: foomatic-rip: use bounds-safe string writes (#697) (#707)
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;p=thirdparty%2Fcups-filters.git

foomatic-rip: use bounds-safe string writes (#697) (#707)

Replace the strcpy/sprintf calls CodeQL flagged as unbounded writes with
bounded equivalents: strlcpy for opt->varname, snprintf for the command
fragment, and memcpy(srclen+1) in dstrcpy(). Behaviour is unchanged - the
destinations were already sized correctly - but the bounds are now
explicit.

Addresses #697
---

diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
index b8c258694..ca80e94bc 100644
--- a/filter/foomatic-rip/options.c
+++ b/filter/foomatic-rip/options.c
@@ -423,7 +423,7 @@ assure_option(const char *name)
     strlcpy(opt->name, name, 128);
 
   // set varname
-  strcpy(opt->varname, opt->name);
+  strlcpy(opt->varname, opt->name, sizeof(opt->varname));
   strrepl(opt->varname, "-/.", '_');
 
   // Default execution style is 'G' (PostScript) since all arguments for
@@ -2463,8 +2463,9 @@ build_commandline(int optset,
     {
       if (isempty(userval))
 	continue;
-      s = malloc(strlen(opt->name) + strlen(userval) + 20);
-      sprintf(s, "%s=%s %%Y", opt->name, userval);
+      size_t s_size = strlen(opt->name) + strlen(userval) + 20;
+      s = malloc(s_size);
+      snprintf(s, s_size, "%s=%s %%Y", opt->name, userval);
       dstrreplace(cmdline, "%Y", s, 0);
       free(s);
     }
diff --git a/filter/foomatic-rip/util.c b/filter/foomatic-rip/util.c
index dfa1205e0..75cafca17 100644
--- a/filter/foomatic-rip/util.c
+++ b/filter/foomatic-rip/util.c
@@ -850,7 +850,7 @@ dstrcpy(dstr_t *ds,
     ds->data = realloc(ds->data, ds->alloc);
   }
 
-  strcpy(ds->data, src);
+  memcpy(ds->data, src, srclen + 1);
   ds->len = srclen;
 }