Blame SOURCES/cups-filters-covscan.patch

706f84
diff --git a/backend/beh.c b/backend/beh.c
706f84
index 9ba6613..7514e33 100644
706f84
--- a/backend/beh.c
706f84
+++ b/backend/beh.c
706f84
@@ -223,6 +223,8 @@ call_backend(char *uri,                 /* I - URI of final destination */
706f84
   */
706f84
 
706f84
   strncpy(scheme, uri, sizeof(scheme));
706f84
+  if (strlen(uri) > 1023)
706f84
+    scheme[1023] = '\0';
706f84
   if ((ptr = strchr(scheme, ':')) != NULL)
706f84
     *ptr = '\0';
706f84
 
706f84
diff --git a/backend/implicitclass.c b/backend/implicitclass.c
706f84
index 3ce4d10..1593191 100644
706f84
--- a/backend/implicitclass.c
706f84
+++ b/backend/implicitclass.c
706f84
@@ -104,6 +104,8 @@ main(int  argc,				/* I - Number of command-line args */
706f84
     }
706f84
     ptr1 ++;
706f84
     strncpy(queue_name, ptr1, sizeof(queue_name));
706f84
+    if (strlen(ptr1) > 1023)
706f84
+      queue_name[1023] = '\0';
706f84
     httpAssembleURIf(HTTP_URI_CODING_ALL, uri, sizeof(uri), "ipp", NULL,
706f84
 		     "localhost", ippPort(), "/printers/%s", queue_name);
706f84
     job_id = argv[1];
706f84
@@ -162,6 +164,8 @@ main(int  argc,				/* I - Number of command-line args */
706f84
       /* Read destination host name (or message) and check whether it is
706f84
 	 complete (second double quote) */
706f84
       strncpy(dest_host, ptr1, sizeof(dest_host));
706f84
+      if (strlen(ptr1) > 1023)
706f84
+        dest_host[1023] = '\0';
706f84
       ptr1 = dest_host;
706f84
       if ((ptr2 = strchr(ptr1, '"')) != NULL) {
706f84
 	*ptr2 = '\0';
706f84
diff --git a/cupsfilters/colormanager.c b/cupsfilters/colormanager.c
706f84
index 70074a3..a4a929d 100644
706f84
--- a/cupsfilters/colormanager.c
706f84
+++ b/cupsfilters/colormanager.c
706f84
@@ -272,6 +272,9 @@ _get_colord_profile(const char   *printer_name,     /* Dest name */
706f84
       free(qualifier);
706f84
     }
706f84
 
706f84
+    if (icc_profile != NULL)
706f84
+      free(icc_profile);
706f84
+
706f84
     return is_profile_set;
706f84
 
706f84
 }
706f84
@@ -325,8 +328,11 @@ _get_ppd_icc_fallback (ppd_file_t *ppd, char **qualifier)
706f84
     if (attr->value[0] != '/')
706f84
       snprintf(full_path, sizeof(full_path),
706f84
                "%s/profiles/%s", CUPSDATA, attr->value);
706f84
-    else
706f84
+    else {
706f84
       strncpy(full_path, attr->value, sizeof(full_path));
706f84
+      if (strlen(attr->value) > 1023)
706f84
+        full_path[1023] = '\0';
706f84
+    }
706f84
 
706f84
     /* check the file exists */
706f84
     if (access(full_path, 0)) {
706f84
diff --git a/cupsfilters/image-sgilib.c b/cupsfilters/image-sgilib.c
706f84
index 0b70c13..bf2dd80 100644
706f84
--- a/cupsfilters/image-sgilib.c
706f84
+++ b/cupsfilters/image-sgilib.c
706f84
@@ -282,7 +282,7 @@ sgiOpenFile(FILE *file,			/* I - File to open */
706f84
         sgip->mode = SGI_WRITE;
706f84
 
706f84
         putshort(SGI_MAGIC, sgip->file);
706f84
-        putc((sgip->comp = comp) != 0, sgip->file);
706f84
+        putc(((sgip->comp = comp) != 0) ? '1': '0', sgip->file);
706f84
         putc(sgip->bpp = bpp, sgip->file);
706f84
         putshort(3, sgip->file);		/* Dimensions */
706f84
         putshort(sgip->xsize = xsize, sgip->file);
706f84
diff --git a/cupsfilters/image-sun.c b/cupsfilters/image-sun.c
706f84
index 609b194..989d039 100644
706f84
--- a/cupsfilters/image-sun.c
706f84
+++ b/cupsfilters/image-sun.c
706f84
@@ -114,6 +114,7 @@ _cupsImageReadSunRaster(
706f84
       ras_depth == 0 || ras_depth > 32)
706f84
   {
706f84
     fputs("DEBUG: Raster image cannot be loaded!\n", stderr);
706f84
+    fclose(fp);
706f84
     return (1);
706f84
   }
706f84
 
706f84
diff --git a/cupsfilters/ppdgenerator.c b/cupsfilters/ppdgenerator.c
706f84
index 052e3c5..3bc4d8a 100644
706f84
--- a/cupsfilters/ppdgenerator.c
706f84
+++ b/cupsfilters/ppdgenerator.c
706f84
@@ -937,6 +937,10 @@ load_opt_strings_catalog(const char *location, cups_array_t *options)
706f84
     }
706f84
   }
706f84
   cupsFileClose(fp);
706f84
+  if (choice_name != NULL)
706f84
+    free(choice_name);
706f84
+  if (opt_name != NULL)
706f84
+    free(opt_name);
706f84
   if (filename == tmpfile)
706f84
     unlink(filename);
706f84
 }
706f84
diff --git a/cupsfilters/raster.c b/cupsfilters/raster.c
706f84
index 8203690..67d6b9b 100644
706f84
--- a/cupsfilters/raster.c
706f84
+++ b/cupsfilters/raster.c
706f84
@@ -151,11 +151,14 @@ cupsRasterParseIPPOptions(cups_page_header2_t *h, /* I - Raster header */
706f84
 		strcasestr(s, "right") ||
706f84
 		strcasestr(s, "side") ||
706f84
 		strcasestr(s, "main"))
706f84
-	      media_source = strdup(s);
706f84
+            {
706f84
+              if (media_source == NULL)
706f84
+	        media_source = strdup(s);
706f84
+            }
706f84
 	    else
706f84
 	      media_type = strdup(s);
706f84
 	  }
706f84
-      if (size_found)
706f84
+      if (page_size == NULL && size_found)
706f84
 	page_size = strdup(size_found->pwg);
706f84
     }
706f84
   }
706f84
@@ -1079,6 +1082,13 @@ cupsRasterParseIPPOptions(cups_page_header2_t *h, /* I - Raster header */
706f84
     h->cupsRenderingIntent[0] = '\0';
706f84
 #endif /* HAVE_CUPS_1_7 */
706f84
 
706f84
+  if (media_source != NULL)
706f84
+    free(media_source);
706f84
+  if (media_type != NULL)
706f84
+    free(media_type);
706f84
+  if (page_size != NULL)
706f84
+    free(page_size);
706f84
+
706f84
   return (0);
706f84
 }
706f84
 
706f84
diff --git a/filter/bannertopdf.c b/filter/bannertopdf.c
706f84
index b78ea37..2b9bd76 100644
706f84
--- a/filter/bannertopdf.c
706f84
+++ b/filter/bannertopdf.c
706f84
@@ -513,6 +513,15 @@ static int generate_banner_pdf(banner_t *banner,
706f84
         pdf_duplicate_page(doc, 1, copies);
706f84
 
706f84
     pdf_write(doc, stdout);
706f84
+
706f84
+    opt_t * opt_current = known_opts;
706f84
+    opt_t * opt_next = NULL;
706f84
+    while (opt_current != NULL)
706f84
+    {
706f84
+      opt_next = opt_current->next;
706f84
+      free(opt_current);
706f84
+      opt_current = opt_next;
706f84
+    }
706f84
     free(buf);
706f84
     pdf_free(doc);
706f84
     return 0;
706f84
diff --git a/filter/foomatic-rip/foomaticrip.c b/filter/foomatic-rip/foomaticrip.c
706f84
index 2a642ed..13d2035 100644
706f84
--- a/filter/foomatic-rip/foomaticrip.c
706f84
+++ b/filter/foomatic-rip/foomaticrip.c
706f84
@@ -666,6 +666,11 @@ int print_file(const char *filename, int convert)
706f84
                 ret = print_file("<STDIN>", 0);
706f84
 
706f84
                 wait_for_process(renderer_pid);
706f84
+                if (in != NULL)
706f84
+                  fclose(in);
706f84
+                if (out != NULL)
706f84
+                  fclose(out);
706f84
+
706f84
                 return ret;
706f84
             }
706f84
 
706f84
@@ -683,6 +688,8 @@ int print_file(const char *filename, int convert)
706f84
 
706f84
         case UNKNOWN_FILE:
706f84
 	    _log("Cannot process \"%s\": Unknown filetype.\n", filename);
706f84
+	    if (file != NULL)
706f84
+	      fclose(file);
706f84
 	    return 0;
706f84
     }
706f84
 
706f84
@@ -811,10 +818,14 @@ int main(int argc, char** argv)
706f84
 
706f84
     if (getenv("PPD")) {
706f84
         strncpy(job->ppdfile, getenv("PPD"), 2048);
706f84
+        if (strlen(getenv("PPD")) > 2047)
706f84
+          job->ppdfile[2047] = '\0';
706f84
         spooler = SPOOLER_CUPS;
706f84
-	if (getenv("CUPS_SERVERBIN"))
706f84
-	    strncpy(cupsfilterpath, getenv("CUPS_SERVERBIN"),
706f84
-		    sizeof(cupsfilterpath));
706f84
+    if (getenv("CUPS_SERVERBIN")) {
706f84
+        strncpy(cupsfilterpath, getenv("CUPS_SERVERBIN"), sizeof(cupsfilterpath));
706f84
+        if (strlen(getenv("CUPS_SERVERBIN")) > PATH_MAX-1)
706f84
+          cupsfilterpath[PATH_MAX-1] = '\0';
706f84
+        }
706f84
     }
706f84
 
706f84
     /* Check status of printer color management from the color manager */
706f84
@@ -834,10 +845,14 @@ int main(int argc, char** argv)
706f84
            allow duplicates, and use the last specified one */
706f84
             while ((str = arglist_get_value(arglist, "-p"))) {
706f84
                 strncpy(job->ppdfile, str, 2048);
706f84
+                if (strlen(str) > 2047)
706f84
+                  job->ppdfile[2047] = '\0';
706f84
                 arglist_remove(arglist, "-p");
706f84
             }
706f84
 	    while ((str = arglist_get_value(arglist, "--ppd"))) {
706f84
 	        strncpy(job->ppdfile, str, 2048);
706f84
+	        if (strlen(str) > 2047)
706f84
+	          job->ppdfile[2047] = '\0';
706f84
 	        arglist_remove(arglist, "--ppd");
706f84
 	    }
706f84
 
706f84
@@ -1020,6 +1035,7 @@ int main(int argc, char** argv)
706f84
                   cmd[0] = '\0';
706f84
 
706f84
                 snprintf(gstoraster, sizeof(gstoraster), "gs -dQUIET -dDEBUG -dPARANOIDSAFER -dNOPAUSE -dBATCH -dNOINTERPOLATE -dNOMEDIAATTRS -sDEVICE=cups -dShowAcroForm %s -sOutputFile=- -", cmd);
706f84
+                free(icc_profile);
706f84
             }
706f84
 
706f84
             /* build Ghostscript/CUPS driver command line */
706f84
diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
706f84
index 325a0a6..798ddf9 100644
706f84
--- a/filter/foomatic-rip/options.c
706f84
+++ b/filter/foomatic-rip/options.c
706f84
@@ -1031,12 +1031,10 @@ int option_set_value(option_t *opt, int optionset, const char *value)
706f84
         /* TODO only set the changed option, not all of them */
706f84
         choice = option_find_choice(fromopt, 
706f84
                                     option_get_value(fromopt, optionset));
706f84
-
706f84
         composite_set_values(fromopt, optionset, choice->command);
706f84
-    }
706f84
-    else {
706f84
+	free(newvalue);
706f84
+    } else
706f84
         val->value = newvalue;
706f84
-    }
706f84
 
706f84
     if (option_is_composite(opt)) {
706f84
         /* set dependent values */
706f84
@@ -1914,6 +1912,8 @@ int ppd_supports_pdf()
706f84
     if (startswith(cmd, "gs"))
706f84
     {
706f84
         strncpy(cmd_pdf, cmd, 4096);
706f84
+        if (strlen(cmd) > 4095)
706f84
+          cmd_pdf[4095] = '\0';
706f84
         return 1;
706f84
     }
706f84
 
706f84
diff --git a/filter/foomatic-rip/spooler.c b/filter/foomatic-rip/spooler.c
706f84
index 236551f..4f27563 100644
706f84
--- a/filter/foomatic-rip/spooler.c
706f84
+++ b/filter/foomatic-rip/spooler.c
706f84
@@ -94,6 +94,8 @@ void init_cups(list_t *arglist, dstr_t *filelist, jobparams_t *job)
706f84
        CUPS puts the print queue name into the PRINTER environment variable
706f84
        when calling filters. */
706f84
     strncpy(job->printer, getenv("PRINTER"), 256);
706f84
+    if (strlen(getenv("PRINTER")) > 255)
706f84
+      job->printer[255] = '\0';
706f84
 
706f84
     free(cups_options);
706f84
 }
706f84
diff --git a/filter/pdftops.c b/filter/pdftops.c
706f84
index 55d2ec1..a648444 100644
706f84
--- a/filter/pdftops.c
706f84
+++ b/filter/pdftops.c
706f84
@@ -427,6 +427,8 @@ main(int  argc,				/* I - Number of command-line args */
706f84
   if ((val = cupsGetOption("make-and-model", num_options, options)) != NULL)
706f84
   {
706f84
     strncpy(make_model, val, sizeof(make_model));
706f84
+    if (strlen(val) > 127)
706f84
+      make_model[127] = '\0';
706f84
     for (ptr = make_model; *ptr; ptr ++)
706f84
       if (*ptr == '-') *ptr = ' ';
706f84
   }
706f84
diff --git a/filter/pdftoraster.cxx b/filter/pdftoraster.cxx
706f84
index 4cd656a..0c63ab8 100644
706f84
--- a/filter/pdftoraster.cxx
706f84
+++ b/filter/pdftoraster.cxx
706f84
@@ -558,8 +558,10 @@ static void parseOpts(int argc, char **argv)
706f84
     if (!cm_disabled) 
706f84
       cmGetPrinterIccProfile(getenv("PRINTER"), &profile, ppd);
706f84
 
706f84
-    if (profile != NULL)
706f84
-      colorProfile = cmsOpenProfileFromFile(profile,"r");    
706f84
+    if (profile != NULL) {
706f84
+      colorProfile = cmsOpenProfileFromFile(profile,"r");
706f84
+      free(profile);
706f84
+    }
706f84
 
706f84
 #ifdef HAVE_CUPS_1_7
706f84
     if ((attr = ppdFindAttr(ppd,"PWGRaster",0)) != 0 &&
706f84
diff --git a/filter/rastertoescpx.c b/filter/rastertoescpx.c
706f84
index 5a3e5df..a0ec416 100644
706f84
--- a/filter/rastertoescpx.c
706f84
+++ b/filter/rastertoescpx.c
706f84
@@ -1141,7 +1141,10 @@ EndPage(ppd_file_t         *ppd,	/* I - PPD file */
706f84
     }
706f84
   }
706f84
   else
706f84
+  {
706f84
     free(DotBuffers[0]);
706f84
+    DotBuffers[0] = NULL;
706f84
+  }
706f84
 
706f84
  /*
706f84
   * Output a page eject sequence...
706f84
@@ -1440,7 +1443,7 @@ CompressData(ppd_file_t          *ppd,	/* I - PPD file information */
706f84
 
706f84
     printf("\033i");
706f84
     putchar(ctable[PrinterPlanes - 1][plane]);
706f84
-    putchar(type != 0);
706f84
+    putchar((type != 0) ? '1': '0');
706f84
     putchar(BitPlanes);
706f84
     putchar(bytes & 255);
706f84
     putchar(bytes >> 8);
706f84
@@ -1470,7 +1473,7 @@ CompressData(ppd_file_t          *ppd,	/* I - PPD file information */
706f84
     bytes *= 8;
706f84
 
706f84
     printf("\033.");
706f84
-    putchar(type != 0);
706f84
+    putchar((type != 0) ? '1': '0');
706f84
     putchar(ystep);
706f84
     putchar(xstep);
706f84
     putchar(rows);
706f84
@@ -1907,6 +1910,10 @@ main(int  argc,				/* I - Number of command-line arguments */
706f84
   if (fd != 0)
706f84
     close(fd);
706f84
 
706f84
+  for (int i = 0; i < 7; i++)
706f84
+    if (DotBuffers[i] != NULL)
706f84
+      free(DotBuffers[i]);
706f84
+
706f84
   return (page == 0);
706f84
 }
706f84
 
706f84
diff --git a/filter/rastertops.c b/filter/rastertops.c
706f84
index d5d955b..531eb70 100644
706f84
--- a/filter/rastertops.c
706f84
+++ b/filter/rastertops.c
706f84
@@ -282,6 +282,8 @@ write_flate(cups_raster_t *ras,	        /* I - Image data */
706f84
       if (fwrite(out, 1, have, stdout) != have)
706f84
       {
706f84
 	(void)deflateEnd(&strm;;
706f84
+	if (convertedpix != NULL)
706f84
+	  free(convertedpix);
706f84
 	return Z_ERRNO;
706f84
       }
706f84
     } while (strm.avail_out == 0);
706f84
diff --git a/filter/sys5ippprinter.c b/filter/sys5ippprinter.c
706f84
index ad75551..9a92c8e 100644
706f84
--- a/filter/sys5ippprinter.c
706f84
+++ b/filter/sys5ippprinter.c
706f84
@@ -570,6 +570,8 @@ exec_filter(const char *filter,		/* I - Filter to execute */
706f84
 	dup2(fd, 2);
706f84
 	close(fd);
706f84
       }
706f84
+      else
706f84
+        close(fd);
706f84
       fcntl(2, F_SETFL, O_NDELAY);
706f84
     }
706f84
 
706f84
@@ -578,6 +580,8 @@ exec_filter(const char *filter,		/* I - Filter to execute */
706f84
       dup2(fd, 3);
706f84
       close(fd);
706f84
     }
706f84
+    else
706f84
+      close(fd);
706f84
     fcntl(3, F_SETFL, O_NDELAY);
706f84
 
706f84
     if ((fd = open("/dev/null", O_RDWR)) > 4)
706f84
@@ -585,6 +589,8 @@ exec_filter(const char *filter,		/* I - Filter to execute */
706f84
       dup2(fd, 4);
706f84
       close(fd);
706f84
     }
706f84
+    else
706f84
+      close(fd);
706f84
     fcntl(4, F_SETFL, O_NDELAY);
706f84
 
706f84
    /*
706f84
@@ -654,8 +660,11 @@ exec_filters(cups_array_t  *filters,	/* I - Array of filters to run */
706f84
   {
706f84
     next = (char *)cupsArrayNext(filters);
706f84
 
706f84
-    if (filter[0] == '/')
706f84
+    if (filter[0] == '/') {
706f84
       strncpy(program, filter, sizeof(program));
706f84
+      if (strlen(filter) > 1023)
706f84
+        program[1023] = '\0';
706f84
+    }
706f84
     else
706f84
     {
706f84
       if ((cups_serverbin = getenv("CUPS_SERVERBIN")) == NULL)
706f84
diff --git a/utils/cups-browsed.c b/utils/cups-browsed.c
706f84
index a2a4a08..19a2ac8 100644
706f84
--- a/utils/cups-browsed.c
706f84
+++ b/utils/cups-browsed.c
706f84
@@ -2245,7 +2245,10 @@ is_disabled(const char *printer, const char *reason) {
706f84
 	  pstate = (ipp_pstate_t)ippGetInteger(attr, 0);
706f84
 	else if (!strcmp(ippGetName(attr), "printer-state-message") &&
706f84
 		 ippGetValueTag(attr) == IPP_TAG_TEXT) {
706f84
-	  free(pstatemsg);
706f84
+	  if (pstatemsg != NULL) {
706f84
+	    free(pstatemsg);
706f84
+	    pstatemsg = NULL;
706f84
+	  }
706f84
 	  p = ippGetString(attr, 0, NULL);
706f84
 	  if (p != NULL) pstatemsg = strdup(p);
706f84
 	}
706f84
@@ -2262,16 +2265,22 @@ is_disabled(const char *printer, const char *reason) {
706f84
 	case IPP_PRINTER_IDLE:
706f84
 	case IPP_PRINTER_PROCESSING:
706f84
 	  ippDelete(response);
706f84
-	  free(pstatemsg);
706f84
+	  if (pstatemsg != NULL) {
706f84
+	    free(pstatemsg);
706f84
+	    pstatemsg = NULL;
706f84
+	  }
706f84
 	  return NULL;
706f84
 	case IPP_PRINTER_STOPPED:
706f84
 	  ippDelete(response);
706f84
 	  if (reason == NULL)
706f84
 	    return pstatemsg;
706f84
-	  else if (strcasestr(pstatemsg, reason) != NULL)
706f84
+	  else if (pstatemsg != NULL && (strcasestr(pstatemsg, reason) != NULL))
706f84
 	    return pstatemsg;
706f84
 	  else {
706f84
-	    free(pstatemsg);
706f84
+            if (pstatemsg != NULL) {
706f84
+                free(pstatemsg);
706f84
+                pstatemsg = NULL;
706f84
+            }
706f84
 	    return NULL;
706f84
 	  }
706f84
 	}
706f84
@@ -2280,12 +2289,18 @@ is_disabled(const char *printer, const char *reason) {
706f84
     debug_printf("No information regarding enabled/disabled found about the requested printer '%s'\n",
706f84
 		 printer);
706f84
     ippDelete(response);
706f84
-    free(pstatemsg);
706f84
+    if (pstatemsg != NULL) {
706f84
+      free(pstatemsg);
706f84
+      pstatemsg = NULL;
706f84
+    }
706f84
     return NULL;
706f84
   }
706f84
   debug_printf("ERROR: Request for printer info failed: %s\n",
706f84
 	       cupsLastErrorString());
706f84
-  free(pstatemsg);
706f84
+  if (pstatemsg != NULL) {
706f84
+    free(pstatemsg);
706f84
+    pstatemsg = NULL;
706f84
+  }
706f84
   return NULL;
706f84
 }
706f84
 
706f84
@@ -3040,6 +3055,8 @@ on_printer_state_changed (CupsNotifier *object,
706f84
 		      dest_host = p->ip ? p->ip : p->host;
706f84
 		      dest_port = p->port;
706f84
 		      strncpy(dest_name, remote_cups_queue, sizeof(dest_name));
706f84
+		      if (strlen(remote_cups_queue) > 1023)
706f84
+		        dest_name[1023] = '\0';
706f84
 		      dest_index = i;
706f84
 		      debug_printf("Printer %s on host %s, port %d is idle, take this as destination and stop searching.\n",
706f84
 				   remote_cups_queue, p->host, p->port);
706f84
@@ -3056,8 +3073,9 @@ on_printer_state_changed (CupsNotifier *object,
706f84
 			  min_jobs = num_jobs;
706f84
 			  dest_host = p->ip ? p->ip : p->host;
706f84
 			  dest_port = p->port;
706f84
-			  strncpy(dest_name, remote_cups_queue,
706f84
-				  sizeof(dest_name));
706f84
+			  strncpy(dest_name, remote_cups_queue, sizeof(dest_name));
706f84
+			  if (strlen(remote_cups_queue) > 1023)
706f84
+			    dest_name[1023] = '\0';
706f84
 			  dest_index = i;
706f84
 			}
706f84
 			debug_printf("Printer %s on host %s, port %d is printing and it has %d jobs.\n",
706f84
@@ -3566,8 +3584,9 @@ create_remote_printer_entry (const char *queue_name,
706f84
 				   IPP_TAG_KEYWORD)) != NULL) {
706f84
 	debug_printf("  Attr: %s\n", ippGetName(attr));
706f84
 	for (i = 0; i < ippGetCount(attr); i ++) {
706f84
-	  strncpy(valuebuffer, ippGetString(attr, i, NULL),
706f84
-		  sizeof(valuebuffer));
706f84
+	  strncpy(valuebuffer, ippGetString(attr, i, NULL), sizeof(valuebuffer));
706f84
+	  if (strlen(ippGetString(attr, i, NULL)) > 65535)
706f84
+	    valuebuffer[65535] = '\0';
706f84
 	  debug_printf("  Keyword: %s\n", valuebuffer);
706f84
 	  if (valuebuffer[0] > '1')
706f84
 	    break;
706f84
@@ -3598,8 +3617,9 @@ create_remote_printer_entry (const char *queue_name,
706f84
 	debug_printf("  Value: %s\n", valuebuffer);
706f84
 	if (valuebuffer[0] == '\0') {
706f84
 	  for (i = 0; i < ippGetCount(attr); i ++) {
706f84
-	    strncpy(valuebuffer, ippGetString(attr, i, NULL),
706f84
-		    sizeof(valuebuffer));
706f84
+	    strncpy(valuebuffer, ippGetString(attr, i, NULL), sizeof(valuebuffer));
706f84
+	    if (strlen(ippGetString(attr, i, NULL)) > 65535)
706f84
+	      valuebuffer[65535] = '\0';
706f84
 	    debug_printf("  Keyword: %s\n", valuebuffer);
706f84
 	    if (valuebuffer[0] != '\0')
706f84
 	      break;
706f84
@@ -3629,8 +3649,9 @@ create_remote_printer_entry (const char *queue_name,
706f84
 	debug_printf("  Value: %s\n", valuebuffer);
706f84
 	if (valuebuffer[0] == '\0') {
706f84
 	  for (i = 0; i < ippGetCount(attr); i ++) {
706f84
-	    strncpy(valuebuffer, ippGetString(attr, i, NULL),
706f84
-		    sizeof(valuebuffer));
706f84
+	    strncpy(valuebuffer, ippGetString(attr, i, NULL), sizeof(valuebuffer));
706f84
+	    if (strlen(ippGetString(attr, i, NULL)) > 65535)
706f84
+	      valuebuffer[65535] = '\0';
706f84
 	    debug_printf("  Keyword: %s\n", valuebuffer);
706f84
 	    if (valuebuffer[0] != '\0')
706f84
 	      break;
706f84
@@ -3663,8 +3684,9 @@ create_remote_printer_entry (const char *queue_name,
706f84
 	debug_printf("  Value: %s\n", p->queue_name, valuebuffer);
706f84
 	if (valuebuffer[0] == '\0') {
706f84
 	  for (i = 0; i < ippGetCount(attr); i ++) {
706f84
-	    strncpy(valuebuffer, ippGetString(attr, i, NULL),
706f84
-		    sizeof(valuebuffer));
706f84
+	    strncpy(valuebuffer, ippGetString(attr, i, NULL), sizeof(valuebuffer));
706f84
+	    if (strlen(ippGetString(attr, i, NULL)) > 65535)
706f84
+	      valuebuffer[65535] = '\0';
706f84
 	    debug_printf("  Keyword: %s\n", valuebuffer);
706f84
 	    if (valuebuffer[0] != '\0')
706f84
 	      break;
706f84
@@ -4498,6 +4520,8 @@ gboolean update_cups_queues(gpointer unused) {
706f84
       } else {
706f84
 	/* Device URI: ipp(s)://<remote host>:631/printers/<remote queue> */
706f84
 	strncpy(device_uri, p->uri, sizeof(device_uri));
706f84
+	if (strlen(p->uri) > HTTP_MAX_URI-1)
706f84
+	  device_uri[HTTP_MAX_URI-1] = '\0';
706f84
 	debug_printf("Print queue %s is for an IPP network printer, or we do not get notifications from CUPS, using direct device URI %s\n",
706f84
 		     p->queue_name, device_uri);
706f84
       }
706f84
@@ -4606,6 +4630,8 @@ gboolean update_cups_queues(gpointer unused) {
706f84
 	  } else if (!strncmp(line, "*Default", 8)) {
706f84
 	    cont_line_read = 0;
706f84
 	    strncpy(keyword, line + 8, sizeof(keyword));
706f84
+	    if ((strlen(line) + 8) > 1023)
706f84
+	      keyword[1023] = '\0';
706f84
 	    for (keyptr = keyword; *keyptr; keyptr ++)
706f84
 	      if (*keyptr == ':' || isspace(*keyptr & 255))
706f84
 		break;
706f84
@@ -7144,7 +7170,7 @@ read_configuration (const char *filename)
706f84
      in the configuration file is used. */
706f84
   while ((i < cupsArrayCount(command_line_config) &&
706f84
 	  (value = cupsArrayIndex(command_line_config, i++)) &&
706f84
-	  strncpy(line, value, sizeof(line))) ||
706f84
+	  strncpy(line, value, sizeof(line)) && ((strlen(value) > HTTP_MAX_BUFFER-1)? line[HTTP_MAX_BUFFER-1] = '\0':  1)) ||
706f84
 	 cupsFileGetConf(fp, line, sizeof(line), &value, &linenum)) {
706f84
     if (linenum < 0) {
706f84
       /* We are still reading options from the command line ("-o ..."),
706f84
@@ -7371,6 +7397,7 @@ read_configuration (const char *filename)
706f84
 	if (filter->cregexp)
706f84
 	  regfree(filter->cregexp);
706f84
 	free(filter);
706f84
+	filter = NULL;
706f84
       }
706f84
     } else if ((!strcasecmp(line, "BrowseInterval") || !strcasecmp(line, "BrowseTimeout")) && value) {
706f84
       int t = atoi(value);
706f84
@@ -7386,8 +7413,11 @@ read_configuration (const char *filename)
706f84
 	debug_printf("Invalid %s value: %d\n",
706f84
 		     line, t);
706f84
     } else if (!strcasecmp(line, "DomainSocket") && value) {
706f84
-      if (value[0] != '\0')
706f84
+      if (value[0] != '\0') {
706f84
+	if (DomainSocket != NULL)
706f84
+	  free(DomainSocket);
706f84
 	DomainSocket = strdup(value);
706f84
+      }
706f84
     } else if ((!strcasecmp(line, "HttpLocalTimeout") || !strcasecmp(line, "HttpRemoteTimeout")) && value) {
706f84
       int t = atoi(value);
706f84
       if (t >= 0) {
706f84
@@ -7555,6 +7585,10 @@ read_configuration (const char *filename)
706f84
 	}
706f84
       }
706f84
       cupsArrayAdd (clusters, cluster);
706f84
+      if (start != NULL) {
706f84
+        free(start);
706f84
+        start = NULL;
706f84
+      }
706f84
       continue;
706f84
     cluster_fail:
706f84
       if (cluster) {
706f84
@@ -7568,6 +7602,11 @@ read_configuration (const char *filename)
706f84
 	  cupsArrayDelete (cluster->members);
706f84
 	}
706f84
 	free(cluster);
706f84
+        cluster = NULL;
706f84
+      }
706f84
+      if (start != NULL) {
706f84
+        free(start);
706f84
+        start = NULL;
706f84
       }
706f84
     } else if (!strcasecmp(line, "LoadBalancing") && value) {
706f84
       if (!strncasecmp(value, "QueueOnClient", 13))
706f84
@@ -7575,7 +7614,7 @@ read_configuration (const char *filename)
706f84
       else if (!strncasecmp(value, "QueueOnServers", 14))
706f84
 	LoadBalancingType = QUEUE_ON_SERVERS;
706f84
     } else if (!strcasecmp(line, "DefaultOptions") && value) {
706f84
-      if (strlen(value) > 0)
706f84
+      if (DefaultOptions == NULL && strlen(value) > 0)
706f84
 	DefaultOptions = strdup(value);
706f84
     } else if (!strcasecmp(line, "AutoShutdown") && value) {
706f84
       char *p, *saveptr;
706f84
@@ -7949,10 +7988,12 @@ int main(int argc, char*argv[]) {
706f84
      daemon, not with remote ones. */
706f84
   if (getenv("CUPS_SERVER") != NULL) {
706f84
     strncpy(local_server_str, getenv("CUPS_SERVER"), sizeof(local_server_str));
706f84
+    if (strlen(getenv("CUPS_SERVER")) > 1023)
706f84
+      local_server_str[1023] = '\0';
706f84
   } else {
706f84
 #ifdef CUPS_DEFAULT_DOMAINSOCKET
706f84
     if (DomainSocket == NULL)
706f84
-      DomainSocket = CUPS_DEFAULT_DOMAINSOCKET;
706f84
+      DomainSocket = strdup(CUPS_DEFAULT_DOMAINSOCKET);
706f84
 #endif
706f84
     if (DomainSocket != NULL) {
706f84
       struct stat sockinfo;               /* Domain socket information */
706f84
@@ -8293,6 +8334,11 @@ fail:
706f84
   if (debug_logfile == 1)
706f84
     stop_debug_logging();
706f84
 
706f84
+  if (DefaultOptions != NULL)
706f84
+    free(DefaultOptions);
706f84
+  if (DomainSocket != NULL)
706f84
+    free(DomainSocket);
706f84
+
706f84
   return ret;
706f84
 
706f84
  help:
706f84
diff --git a/utils/driverless.c b/utils/driverless.c
706f84
index 7fc6dae..fe61e58 100644
706f84
--- a/utils/driverless.c
706f84
+++ b/utils/driverless.c
706f84
@@ -227,12 +227,16 @@ list_printers (int mode)
706f84
 	
706f84
 	if (txt_usb_mfg[0] != '\0') {
706f84
 	  strncpy(make, txt_usb_mfg, sizeof(make));
706f84
+	  if (strlen(txt_usb_mfg) > 511)
706f84
+	    make[511] = '\0';
706f84
 	  ptr = device_id + strlen(device_id);
706f84
 	  snprintf(ptr, sizeof(device_id) - (size_t)(ptr - device_id),
706f84
 		   "MFG:%s;", txt_usb_mfg);
706f84
 	}
706f84
 	if (txt_usb_mdl[0] != '\0') {
706f84
 	  strncpy(model, txt_usb_mdl, sizeof(model));
706f84
+	  if (strlen(txt_usb_mdl) > 255)
706f84
+	    model[255] = '\0';
706f84
 	  ptr = device_id + strlen(device_id);
706f84
 	  snprintf(ptr, sizeof(device_id) - (size_t)(ptr - device_id),
706f84
 		   "MDL:%s;", txt_usb_mdl);
706f84
@@ -243,15 +247,22 @@ list_printers (int mode)
706f84
 		*ptr == ')')
706f84
 	      *ptr = '\0';
706f84
 	    strncpy(model, txt_product + 1, sizeof(model));
706f84
+	    if ((strlen(txt_product) + 1) > 255)
706f84
+	      model[255] = '\0';
706f84
 	  } else
706f84
 	    strncpy(model, txt_product, sizeof(model));
706f84
 	} else if (txt_ty[0] != '\0') {
706f84
 	  strncpy(model, txt_ty, sizeof(model));
706f84
+	  if (strlen(txt_ty) > 255)
706f84
+	    model[255] = '\0';
706f84
 	  if ((ptr = strchr(model, ',')) != NULL)
706f84
 	    *ptr = '\0';
706f84
 	}
706f84
-	if (txt_pdl[0] != '\0')
706f84
+	if (txt_pdl[0] != '\0') {
706f84
 	  strncpy(pdl, txt_pdl, sizeof(pdl));
706f84
+	  if (strlen(txt_pdl) > 255)
706f84
+	    pdl[255] = '\0';
706f84
+	}
706f84
 
706f84
 	if (!device_id[0] && strcasecmp(model, "Unknown")) {
706f84
 	  if (make[0])