Skip to content
This repository was archived by the owner on Mar 10, 2026. It is now read-only.

Correct problem with memory access violation for incorrect PPD file#5623

Closed
ppawliczek wants to merge 1 commit into
apple:masterfrom
ppawliczek:ppd
Closed

Correct problem with memory access violation for incorrect PPD file#5623
ppawliczek wants to merge 1 commit into
apple:masterfrom
ppawliczek:ppd

Conversation

@ppawliczek

Copy link
Copy Markdown

The problem occurres when an input PPD file contains a pair of the same
ParamCustom* keywords with the same name and different type. In this case
the PPD parser may cause memory leak or memory violation when one of
the type is PPD_CUSTOM_PASSCODE, PPD_CUSTOM_PASSWORD or PPD_CUSTOM_STRING.
A parameter with expected parameter type is added to ppd_get_cparam(...).

ParamCustom* keywords with the same name and different type. In this case
the PPD parser may cause memory leak or memory violation when one of
the type is PPD_CUSTOM_PASSCODE, PPD_CUSTOM_PASSWORD or PPD_CUSTOM_STRING.
@michaelrsweet

Copy link
Copy Markdown
Contributor

@ppawliczek Please attach the problematic PPD file.

@michaelrsweet michaelrsweet self-assigned this Jul 30, 2019
@michaelrsweet michaelrsweet added the investigating Investigating the issue label Jul 30, 2019
@ppawliczek

Copy link
Copy Markdown
Author

The PPS file is incorrect, however it should not cause incorrect memory reads.
As I can recall, incorrect read occurs when the PPD file is being closed (when some memory is freed).

clusterfuzz-testcase-minimized-cups_ppdopen_fuzzer-6243187697647616.zip

@michaelrsweet

Copy link
Copy Markdown
Contributor

[master dc00a7c] Fix some PPD parser issues discovered via fuzzing (Issue #5623, Issue #5624)
[master 8e048e4] Fix some PPD parser issues discovered via fuzzing (Issue #5623, Issue #5624)

[branch-2.2 d11af54] Fix some PPD parser issues discovered via fuzzing (Issue #5623, Issue #5624)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants