Repository navigation
Reject custom page size parameters of the wrong type - #94
tillkamppeter merged 1 commit into
Conversation
ppdPageSize() stores a custom page size in the Width and Height parameters of the PageSize custom option as points, but the PPD parser accepted any type for them. A PPD declaring Width or Height as a string, passcode or password parameter therefore got a float written into the parameter's value, and ppdClose() later freed it as a string pointer (issue OpenPrinting#83). Port CUPS commit 46c5a984: reject Width, Height, WidthOffset and HeightOffset parameters that are not points, and an Orientation that is not an int, with PPD_BAD_CUSTOM_PARAM. Compare the option and parameter names case-insensitively, as ppdFindCustomOption() and ppdFindCustomParam() look them up: with an exact compare, a parameter named "height" passes the check and is still found and overwritten by ppdPageSize(). Also only update the Width and Height values in ppdPageSize() when they are points parameters. Add tests for both to test_ppd_custom. Fixes OpenPrinting#83
|
Thanks for approving the CI run. The 12 Build & Test failures are all in For whoever picks up the master failure: in each of those checks the make-and-model ends up a single word. It's "Acme" once |
Could you fix that in a separate PR? Thanks. |
|
Thanks for merging! Sure, I'll open a separate PR that fixes those test_ppd_generator inputs. |
Fixes #83.
ppdPageSize()stores a custom page size in theWidthandHeightparameters of the PageSize custom option as points (current.custom_points), but_ppdOpen()accepted any type for them. With a PPD declaring, for example,selecting a custom size writes a float into the parameter's value, and
ppdClose()then freescurrent.custom_string, that is the float's bits, as a pointer.This ports OpenPrinting/cups@46c5a984 ("Reject invalid custom page parameter types"):
Width,Height,WidthOffsetandHeightOffsetmust bepointsandOrientationmust beint, otherwiseppdOpen()fails withPPD_BAD_CUSTOM_PARAM.Two differences from the CUPS commit:
ppdFindCustomOption()andppdFindCustomParam()match names case-insensitively, so with an exactstrcmp()a parameter declared asheight(or under*ParamCustompagesize) passes the check and is still found and overwritten byppdPageSize().ppdPageSize()only updates theWidthandHeightvalues ofpointsparameters, as a defensive check for code that changes a PPD's custom parameters after opening it.Tests: a new group in
test_ppd_custom(T25-T33) checks the custom size update, that valid parameter sets still open (including a non-PageSize option'sWidthof another type), and that each wrong type, also with lower-case names, fails withPPD_BAD_CUSTOM_PARAM. Without the fix the six rejection cases fail; with it all 33 pass, and the rest ofmake checkpasses as before.Compatibility: I checked the PPDs of the foomatic-db, OpenPrinting, HP PostScript and HPLIP PPD archives (about 12,400 files). All of the roughly 9,000 with a custom page size declare exactly these types, so none of them is rejected.