Bug #30930 for Net-CUPS: segfault in net-cups (double free)

Fri Nov 23 05:58:16 2007 tomas_vanderka [...] tempest.sk - Ticket created

Subject:	segfault in net-cups (double free)
Date:	Fri, 23 Nov 2007 11:57:19 +0100
To:	bug-Net-CUPS [...] rt.cpan.org
From:	Tomas Vanderka <tomas_vanderka [...] tempest.sk>

Hi, there's a segv caused by requestData. The problem is that functions cups*Request() free the request (kind of stupid, but it's how cups api does it). Sample code to reproduce: #!/usr/bin/perl use Net::CUPS; use Net::CUPS::IPP; my $cups = Net::CUPS->new(); my $request = Net::CUPS::IPP->new(CUPS_GET_PRINTERS); my $response = $cups->requestData($request, "/"); # the pointer in $request is now freed, causes segv in IPP->DESTROY->freeIPP->ippDelete

Fri Nov 23 23:58:55 2007 dhageman [...] dracken.com - Correspondence added

On Fri Nov 23 05:58:16 2007, tomas_vanderka@tempest.sk wrote: Show quoted text

> Hi, there's a segv caused by requestData. The problem is that functions > cups*Request() free the request (kind of stupid, but it's how cups api > does it). > Sample code to reproduce: > > #!/usr/bin/perl > > use Net::CUPS; > use Net::CUPS::IPP; > > my $cups = Net::CUPS->new(); > my $request = Net::CUPS::IPP->new(CUPS_GET_PRINTERS); > my $response = $cups->requestData($request, "/"); > # the pointer in $request is now freed, causes segv in > IPP->DESTROY->freeIPP->ippDelete >

This is something that I an not correct very easily. The problem is not with Net::CUPS, but rather with the CUPS API. If you don't form your IPP requests correctly ... then it will segfault. Please refer to the CUPS documentation to determine how to correctly build IPP requests.

Fri Nov 23 23:58:57 2007 The RT System itself - Status changed from 'new' to 'open'

Fri Nov 23 23:58:58 2007 dhageman [...] dracken.com - Status changed from 'open' to 'resolved'

Mon Nov 26 11:28:13 2007 tomas_vanderka [...] tempest.sk - Correspondence added

Subject:	Re: [rt.cpan.org #30930] Resolved: segfault in net-cups (double free)
Date:	Mon, 26 Nov 2007 17:27:23 +0100
To:	bug-Net-CUPS [...] rt.cpan.org
From:	Tomas Vanderka <tomas_vanderka [...] tempest.sk>

The ipp request is fine, it can be used/destroyed with no segv unless i call Net::CUPS::requestData. The problem is that request is freed from memory by ippDelete in cupsDoRequest (but perl doesn't know about it and does segv when destroying it again). I got rid of the segv by commenting out ippDelete from NETCUPS_freeIPP, requests are freed anyway and i hate memleaks less than segv. I tried to fix it by somehow destroying the request inside Net::CUPS::requestData without actually calling ippDelete but i didn't find a way. CUPS API documentation says that request is freed from memory after returning a valid response from cupsDoRequest, but after i looked into cups sources it looks like it's destroyed every time. D. Hageman via RT wrote: Show quoted text

> <URL: http://rt.cpan.org/Ticket/Display.html?id=30930 > > > According to our records, your request has been resolved. If you have any > further questions or concerns, please respond to this message. >

Mon Nov 26 11:28:18 2007 The RT System itself - Status changed from 'resolved' to 'open'

Sat Dec 08 15:16:47 2007 dhageman [...] dracken.com - Correspondence added

I see what you are saying now. I totally missed this. How annoying! Okay, I have an idea on a way to work around it ... hopefully I will have a fix soon. On Mon Nov 26 11:28:13 2007, tomas_vanderka@tempest.sk wrote: Show quoted text

> The ipp request is fine, it can be used/destroyed with no segv unless i > call Net::CUPS::requestData. The problem is that request is freed from > memory by ippDelete in cupsDoRequest (but perl doesn't know about it and > does segv when destroying it again). I got rid of the segv by commenting > out ippDelete from NETCUPS_freeIPP, requests are freed anyway and i hate > memleaks less than segv. I tried to fix it by somehow destroying the > request inside Net::CUPS::requestData without actually calling ippDelete > but i didn't find a way. > CUPS API documentation says that request is freed from memory after > returning a valid response from cupsDoRequest, but after i looked into > cups sources it looks like it's destroyed every time. > > D. Hageman via RT wrote:

> > <URL: http://rt.cpan.org/Ticket/Display.html?id=30930 > > > > > According to our records, your request has been resolved. If you

have any Show quoted text

> > further questions or concerns, please respond to this message. > >

Thu Aug 14 11:01:32 2008 dhageman [...] dracken.com - Status changed from 'open' to 'resolved'