diff --git a/SOURCES/0001-cups-browsed-Removing-CUPS-array-element-from-within.patch b/SOURCES/0001-cups-browsed-Removing-CUPS-array-element-from-within.patch new file mode 100644 index 0000000..c3de275 --- /dev/null +++ b/SOURCES/0001-cups-browsed-Removing-CUPS-array-element-from-within.patch @@ -0,0 +1,46 @@ +From 5785e2202cec7818154f2ed1ed4ac02e8c21f26d Mon Sep 17 00:00:00 2001 +From: Till Kamppeter +Date: Thu, 22 Jun 2017 18:39:38 -0300 +Subject: [PATCH] cups-browsed: Removing CUPS array element from within a loop + going to this array is save, so do not break out of the loop in + handle_cups_queues(). + +--- + NEWS | 6 ------ + utils/cups-browsed.c | 13 +++++++------ + 2 files changed, 7 insertions(+), 12 deletions(-) + +diff --git a/utils/cups-browsed.c b/utils/cups-browsed.c +index dd1aec97..8b83becc 100644 +--- a/utils/cups-browsed.c ++++ b/utils/cups-browsed.c +@@ -3647,6 +3647,13 @@ gboolean handle_cups_queues(gpointer unused) { + } + + /* CUPS queue removed, remove the list entry */ ++ /* Note that we do not need to break out of the loop passing through ++ all elements of a CUPS array when we remove an element via the ++ cupsArrayRemove() function, as the function decreases the array- ++ internal index by one and so the cupsArrayNext() call gives us ++ the element right after the deleted element. So no skipping ++ of an element and especially no reading beyond the end of the ++ array. */ + cupsArrayRemove(remote_printers, p); + if (p->name) free (p->name); + if (p->uri) free (p->uri); +@@ -4127,12 +4134,6 @@ gboolean handle_cups_queues(gpointer unused) { + break; + + } +- /* If we have removed a queue, break the loop. to avoid reading +- non-existing array elements or past the end of the array. +- If we are not yet done with our tasks the recheck_timer() call +- will immediately call us again to do the rest. */ +- if (p == NULL) +- break; + } + + if (in_shutdown == 0) +-- +2.25.1 + diff --git a/SOURCES/cups-browsed-memory-leaks.patch b/SOURCES/cups-browsed-memory-leaks.patch new file mode 100644 index 0000000..76b1ad9 --- /dev/null +++ b/SOURCES/cups-browsed-memory-leaks.patch @@ -0,0 +1,36 @@ +diff --git a/utils/cups-browsed.c b/utils/cups-browsed.c +index 2cc64dd..e3f5cca 100644 +--- a/utils/cups-browsed.c ++++ b/utils/cups-browsed.c +@@ -2471,7 +2471,8 @@ on_printer_state_changed (CupsNotifier *object, + char *ptr, buf[1024]; + remote_printer_t *p, *q; + http_t *http = NULL; +- ipp_t *request, *response; ++ ipp_t *request = NULL; ++ ipp_t *response = NULL; + ipp_attribute_t *attr; + const char *pname = NULL; + ipp_pstate_t pstate = IPP_PRINTER_IDLE; +@@ -2733,6 +2734,10 @@ on_printer_state_changed (CupsNotifier *object, + break; + } + } ++ if (response) { ++ ippDelete(response); ++ response = NULL; ++ } + if (pstate == IPP_PRINTER_IDLE && paccept) { + q->last_printer = i; + break; +@@ -3640,8 +3645,8 @@ gboolean handle_cups_queues(gpointer unused) { + /* Default option settings from printer entry */ + for (i = 0; i < p->num_options; i ++) + if (strcasecmp(p->options[i].name, "printer-is-shared")) +- num_options = cupsAddOption(strdup(p->options[i].name), +- strdup(p->options[i].value), ++ num_options = cupsAddOption(p->options[i].name, ++ p->options[i].value, + num_options, &options); + /* Encode option list into IPP attributes */ + cupsEncodeOptions2(request, num_options, options, IPP_TAG_PRINTER); diff --git a/SOURCES/cups-filters-deleted-master.patch b/SOURCES/cups-filters-deleted-master.patch new file mode 100644 index 0000000..22551fc --- /dev/null +++ b/SOURCES/cups-filters-deleted-master.patch @@ -0,0 +1,61 @@ +diff -up cups-filters-1.0.35/utils/cups-browsed.c.deleted-master cups-filters-1.0.35/utils/cups-browsed.c +--- cups-filters-1.0.35/utils/cups-browsed.c.deleted-master 2020-03-24 12:39:38.535487257 +0100 ++++ cups-filters-1.0.35/utils/cups-browsed.c 2020-03-24 12:39:38.538487233 +0100 +@@ -358,6 +358,7 @@ static unsigned int CreateRemoteCUPSPrin + static int NewIPPPrinterQueuesShared = 0; + static load_balancing_type_t LoadBalancingType = QUEUE_ON_CLIENT; + static const char *DefaultOptions = NULL; ++static remote_printer_t *deleted_master = NULL; + static int terminating = 0; /* received SIGTERM, ignore callbacks, + break loops */ + static int in_shutdown = 0; +@@ -3179,6 +3180,30 @@ gboolean handle_cups_queues(gpointer unu + const char *customval; + const char *val = NULL; + ++ /* Create dummy entry to point slaves at when their master is about to ++ get removed now (if we point them to NULL, we would try to remove ++ the already removed CUPS queue again when it comes to the removal ++ of the slave. */ ++ if (deleted_master == NULL) { ++ if ((deleted_master = ++ (remote_printer_t *)calloc(1, sizeof(remote_printer_t))) == NULL) { ++ debug_printf("ERROR: Unable to allocate memory.\n"); ++ if (in_shutdown == 0) ++ recheck_timer (); ++ return FALSE; ++ } ++ memset(deleted_master, 0, sizeof(remote_printer_t)); ++ deleted_master->uri = ""; ++ } ++ ++ /* Now redirect the slave_of pointers of the masters which get deleted now ++ to this dummy entry */ ++ for (p = (remote_printer_t *)cupsArrayFirst(remote_printers); ++ p; p = (remote_printer_t *)cupsArrayNext(remote_printers)) ++ if (p->status == STATUS_DISAPPEARED && ++ (q = p->duplicate_of) != NULL && q->status == STATUS_DISAPPEARED ) ++ p->duplicate_of = deleted_master; ++ + debug_printf("Processing printer list ...\n"); + for (p = (remote_printer_t *)cupsArrayFirst(remote_printers); + p; p = (remote_printer_t *)cupsArrayNext(remote_printers)) { +@@ -3303,7 +3328,8 @@ gboolean handle_cups_queues(gpointer unu + } else { + /* "master printer" of this duplicate */ + q = p->duplicate_of; +- if (q->status != STATUS_DISAPPEARED) { ++ /* Don't update the deleted master */ ++ if (q != deleted_master && q->status != STATUS_DISAPPEARED) { + debug_printf("Removed duplicate printer %s on %s:%d, scheduling its master printer %s on host %s, port %d for update.\n", + p->name, p->host, p->port, q->name, q->host, q->port); + /* Schedule for update */ +@@ -6915,6 +6941,8 @@ fail: + if (debug_logfile == 1) + stop_debug_logging(); + ++ if (deleted_master != NULL) ++ free(deleted_master); + if (DefaultOptions != NULL) + free(DefaultOptions); + if (DomainSocket != NULL) diff --git a/SPECS/cups-filters.spec b/SPECS/cups-filters.spec index 819af53..5722551 100644 --- a/SPECS/cups-filters.spec +++ b/SPECS/cups-filters.spec @@ -4,7 +4,7 @@ Summary: OpenPrinting CUPS filters and backends Name: cups-filters Version: 1.0.35 -Release: 26%{?dist}.1 +Release: 28%{?dist} # For a breakdown of the licensing, see COPYING file # GPLv2: filters: commandto*, imagetoraster, pdftops, rasterto*, @@ -44,8 +44,14 @@ Patch10: 0001-Fixing-covscan-issues.patch Patch11: 0001-cups-browsed-Fixed-freeing-of-literal-string-caused-.patch # bad paths in manpages (bug #1508018) Patch12: cups-filters-manpages.patch -# 1776400 - Updated cups-browsed in RHEL 7.7 leaks sockets +# 1775776 - Updated cups-browsed in RHEL 7.7 leaks sockets Patch13: cups-browsed-socket-leak.patch +# 1816109 - Queues are not cleaned up after stopping cups-browsed +Patch14: 0001-cups-browsed-Removing-CUPS-array-element-from-within.patch +# 1811190 - cups-browsed leaks memory +Patch15: cups-browsed-memory-leaks.patch +# 1812635 - RHEL 7.7. cups-browsed segfaults on shutdown +Patch16: cups-filters-deleted-master.patch Requires: cups-filters-libs%{?_isa} = %{version}-%{release} @@ -176,9 +182,18 @@ cp %{SOURCE5} . # 1508018 - man pages: wrong links in man cups-browsed %patch12 -p1 -b .manpages -# 1776400 - Updated cups-browsed in RHEL 7.7 leaks sockets +# 1775776 - Updated cups-browsed in RHEL 7.7 leaks sockets %patch13 -p1 -b .cups-browsed-socket-leak +# 1816109 - Queues are not cleaned up after stopping cups-browsed +%patch14 -p1 -b .clean-up-queues + +# 1811190 - cups-browsed leaks memory +%patch15 -p1 -b .memory-leaks + +# 1812635 - RHEL 7.7. cups-browsed segfaults on shutdown +%patch16 -p1 -b .deleted-master + %build # work-around Rpath ./autogen.sh @@ -286,8 +301,15 @@ fi %{_libdir}/libfontembed.so %changelog -* Tue Nov 26 2019 Zdenek Dohnal - 1.0.35-26.1 -- 1776400 - Updated cups-browsed in RHEL 7.7 leaks sockets +* Tue Mar 24 2020 Zdenek Dohnal - 1.0.35-28 +- 1812635 - RHEL 7.7. cups-browsed segfaults on shutdown + +* Mon Mar 23 2020 Zdenek Dohnal - 1.0.35-28 +- 1816109 - Queues are not cleaned up after stopping cups-browsed +- 1811190 - cups-browsed leaks memory + +* Mon Nov 25 2019 Zdenek Dohnal - 1.0.35-27 +- 1775776 - Updated cups-browsed in RHEL 7.7 leaks sockets * Tue May 21 2019 Zdenek Dohnal - 1.0.35-26 - 1508018 - man pages: wrong links in man cups-browsed