Potential out-of-bounds read in cupsdFindBest() with HTTP_STATE_ERROR
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start in scheduler/auth.c by reading cupsdFindBest() and its caller cupsdAuthorize(), focusing on how httpGetState() supplies the state value. Verify the HTTP_STATE_ERROR path and the limits array bounds. Done means invalid states cannot cause an out-of-bounds access and the normal authorization lookup remains unchanged.
Written by the indexing model from the issue text.
Description
Potential problem
In scheduler/auth.c, the state parameter is used as an array index in cupsdFindBest():
limit = limits[state];
state is obtained from httpGetState(con->http) and passed to cupsdFindBest() by cupsdAuthorize():
con->best = cupsdFindBest(con->uri, httpGetState(con->http));
httpGetState() can return HTTP_STATE_ERROR, which is defined as -1. However, cupsdFindBest() does not validate state before using it as an array index.
If HTTP_STATE_ERROR reaches cupsdFindBest(), the code accesses limits[-1]. This reads memory before the beginning of the array and results in undefined behavior.
Possible solution
Validate state before accessing limits[state], for example:
if (state < 0 ||
(size_t)state >= sizeof(limits) / sizeof(limits))
return NULL;
This ensures that an invalid HTTP state cannot be used as an array index.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author V. Ostretsov
- Dominant language
- C
- Stars
- 1.8k
- Forks
- 349
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 12
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenPrinting/cups
-
Potential integer overflow when using atoi() In cgi-bin/var.cPossibly taken @lynayur claimed this 7 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
OpenPrinting/cups#1748 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenPrinting/cups#1721 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
OpenPrinting/cups#1763 ·
Maintainers usually reply within 1 day
-
investigating platform issue printer specific issue
Difficulty 3/5 1-2 days Newbie friendliness 65/100
OpenPrinting/cups#1727 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
OpenPrinting/cups#1726 ·
Maintainers usually reply within 1 day
All issues in OpenPrinting/cups
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
FujiNetWIFI/fujinet-lib#186 ·
Maintainers usually reply within 1 day
-
VIEW_TYPE set for computer playersPossibly taken @Loobinex claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 2 days
-
bug
Difficulty 2/5 Under an hour Newbie friendliness 78/100
brunodev85/winlator-app#90 ·