Backport fix for crash in ppdEmitString()

OpenPrinting · Jan 12, 2024 · 5de694b · 5de694b
1 parent 4466263
commit 5de694b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/CHANGES.md b/CHANGES.md
@@ -16,6 +16,7 @@ Changes in CUPS v2.4.8 (TBA)
 - Fixed setting job state reasons for successful jobs (Issue #832)
 - Added additional check on socket if `revents` from `poll()` returns POLLHUP
   together with POLLIN or POLLOUT in `httpAddrConnect2()` (Issue #839)
+- Fixed crash in `ppdEmitString()` if `size` is NULL (Issue #850)
 - Fixed IPP backend to support the "print-scaling" option with IPP printers
   (Issue #862)
 

diff --git a/cups/ppd-emit.c b/cups/ppd-emit.c
@@ -893,7 +893,12 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
         strlcpy(bufptr, "%%BeginFeature: *CustomPageSize True\n", (size_t)(bufend - bufptr + 1));
         bufptr += 37;
 
-        size = ppdPageSize(ppd, "Custom");
+        if ((size = ppdPageSize(ppd, "Custom")) == NULL)
+        {
+          free(buffer);
+          free(choices);
+          return (NULL);
+        }
 
         memset(values, 0, sizeof(values));