cups-lpd: access beyond end of string

[michaelrsweet]

Version: 2.0-current
CUPS.org User: pdewacht

Consider what happens if somebody sends a single newline ("\n") to a cups-lpd server.

213 if (smart_gets(line, sizeof(line), stdin) == NULL)

smart_gets will store a zero-length string in line. It will not return NULL, so execution will proceed.

233 command = line[0];
234 dest = line + 1;

command is set to 0, and dest will point past the terminating nul byte.

240 for (list = dest; _list && !isspace(_list & 255); list ++);
241
242 while (isspace(*list & 255))
243 *list++ = '\0';

And now cups-lpd is scribbling beyond the end of the string. Not exploitable, but still ugly.

[michaelrsweet]

CUPS.org User: mike

Fixed in Subversion repository.

[michaelrsweet]

"str4603.patch":

Index: scheduler/cups-lpd.c

--- scheduler/cups-lpd.c (revision 12597)
+++ scheduler/cups-lpd.c (working copy)
@@ -230,8 +230,10 @@

• resource list, and/or user name.
  */
• command = line[0];
• dest = line + 1;
• if ((command = line[0]) == '\0')
• dest = line;
• else
• dest = line + 1;

if (command == 0x02)
list = NULL;