Skip to content

fix: prevent infinite loop in cfIEEE1284NormalizeMakeModel on empty MFG/MDL (fixes #214) - #223

Open
KHARSHAVARDHAN-eng wants to merge 1 commit into
OpenPrinting:masterfrom
KHARSHAVARDHAN-eng:fix/empty-ieee1284-make-model
Open

fix: prevent infinite loop in cfIEEE1284NormalizeMakeModel on empty MFG/MDL (fixes #214)#223
KHARSHAVARDHAN-eng wants to merge 1 commit into
OpenPrinting:masterfrom
KHARSHAVARDHAN-eng:fix/empty-ieee1284-make-model

Conversation

@KHARSHAVARDHAN-eng

Copy link
Copy Markdown

Summary

Fixes an infinite loop in cfIEEE1284NormalizeMakeModel() when given IEEE-1284 device IDs containing empty MFG and MDL fields (such as MFG:;MDL:; and MFG:;MDL:;CMD:PostScript;).

Root Cause

  1. Empty MFG Parsing: When MFG:; was encountered, makeptr and bufptr remained at buffer. The unpatched code checked while (isspace(*(bufptr - 1))) bufptr--;, reading before the buffer array start.
  2. Invalid Space Insertion: if (bufptr < buffer + bufsize - 1) evaluated to true for empty MFG, inserting a space ' ' and advancing makeptr to buffer + 1.
  3. Out-of-Bounds modelptr: When MDL:; was processed, bufptr was decremented back to buffer and NUL-terminated (""). However, if (!nomakemodel && makeptr != bufptr) assigned modelptr = makeptr (buffer + 1), causing modelptr to point past the string terminator.
  4. Infinite Loop: Manufacturer deduplication calculated compare_len = modelptr - buffer (1) and repeatedly matched strncasecmp("", garbage, 1) == 0, looping infinitely in move_right_part().

Fix Description

  1. Pointer Bounds Check: Added bufptr > buffer bounds checks before dereferencing *(bufptr - 1) in trailing whitespace removal loops (lines 807 & 825).
  2. Empty MFG Space Check: Added bufptr > buffer condition at line 808 to prevent inserting a space separator when no manufacturer text was written.
  3. modelptr Pointer Safety: Added a defensive bounds check at line 1164 (if (!modelptr || modelptr > buffer + strlen(buffer)) modelptr = buffer + strlen(buffer);) to guarantee modelptr never points past the string NUL-terminator.
  4. Automated Unit Test: Created cupsfilters/test-ieee1284-normalize.c verifying that empty MFG and MDL inputs return safely without hanging or crashing, while preserving valid MDL:; and MFG:HP;MDL:DeskJet; inputs. Registered the test in Makefile.am under check_PROGRAMS and TESTS.

Fixes #214.

@zdohnal zdohnal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer returning if there is no manufacturer or model values - while the current MR might be shorter solution at the moment, but IMO it is better to end early if we don't have proper required input rather than trying to recover.

I have my proposal at zdohnal@60d2b49 , but without test. We can combine them, if preferred.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Infinite Loop in cfIEEE1284NormalizeMakeModel used with device_id on empty MFG and MDL

2 participants