diff -up cups-1.6.2/scheduler/printers.c.stringpool-setprinterattr cups-1.6.2/scheduler/printers.c
--- cups-1.6.2/scheduler/printers.c.stringpool-setprinterattr 2013-06-13 12:16:07.525680621 +0100
+++ cups-1.6.2/scheduler/printers.c 2013-06-13 12:16:07.567680782 +0100
@@ -1925,6 +1925,7 @@ cupsdSetPrinterAttr(
ipp_attribute_t *attr; /* Attribute */
int i, /* Looping var */
count; /* Number of values */
+ char *value_dup; /* Copy of attribute value string */
char *ptr, /* Pointer into value */
*start, /* Start of value */
quote; /* Quote character */
@@ -1993,16 +1994,24 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0; i < count; i ++)
+ if ((value_dup = strdup(value)) == NULL)
{
- if ((ptr = strchr(value, ',')) != NULL)
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
+ return;
+ }
+
+ for (i = 0, start = value_dup; i < count; i ++)
+ {
+ if ((ptr = strchr(start, ',')) != NULL)
*ptr++ = '\0';
- attr->values[i].integer = strtol(value, NULL, 10);
+ attr->values[i].integer = strtol(start, NULL, 10);
if (ptr)
- value = ptr;
+ start = ptr;
}
+
+ free(value_dup);
}
else
{
@@ -2043,7 +2052,13 @@ cupsdSetPrinterAttr(
return;
}
- for (i = 0, quote = '\0', ptr = value; i < count; i ++)
+ if ((value_dup = strdup(value)) == NULL)
+ {
+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
+ return;
+ }
+
+ for (i = 0, quote = '\0', ptr = value_dup; i < count; i ++)
{
for (start = ptr; *ptr; ptr ++)
{
@@ -2071,6 +2086,8 @@ cupsdSetPrinterAttr(
attr->values[i].string.text = _cupsStrAlloc(start);
}
+
+ free(value_dup);
}
}