Bug 2270 - Potential mem leak in Samba print_cups code
Summary: Potential mem leak in Samba print_cups code
Alias: None
Product: Samba 3.0
Classification: Unclassified
Component: Printing (show other bugs)
Version: 3.0.10
Hardware: All Linux
: P3 enhancement
Target Milestone: none
Assignee: Gerald (Jerry) Carter (dead mail address)
QA Contact: Samba QA Contact
Depends on:
Reported: 2005-01-20 08:06 UTC by Lars Müller
Modified: 2005-08-24 10:26 UTC (History)
0 users

See Also:

Use ippDelete() and cupsLangFree() before return. (4.67 KB, patch)
2005-01-20 08:07 UTC, Lars Müller
no flags Details
Proposed patch. (23.14 KB, patch)
2005-01-20 14:26 UTC, Jeremy Allison
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Lars Müller 2005-01-20 08:06:07 UTC
source/printing/print_cups.c doesn't free allocated memory with ippDelete() and
cupsLangFree().  This might lead to a memory leak as the functions from
print_cups.c are called regular at least by check_reload().
Comment 1 Lars Müller 2005-01-20 08:07:37 UTC
Created attachment 904 [details]
Use ippDelete() and cupsLangFree() before return.
Comment 2 Lars Müller 2005-01-20 08:10:12 UTC
In the patch I've also removed some superfluous ippNew() and cupsLangDefault()
Comment 3 Lars Müller 2005-01-20 14:00:58 UTC
Patch needs more testing. ;)
Comment 4 Jeremy Allison 2005-01-20 14:26:35 UTC
Created attachment 905 [details]
Proposed patch.

Try this one instead :-).
Comment 5 Gerald (Jerry) Carter (dead mail address) 2005-01-21 11:17:32 UTC
Gahhh!!!!  cupDoRequest() calls ippDelete(request) so
the segv was caused by calling ippDelete() on the same
pointer in our code.

That's just *insane*!  Unless its a documented feature
of cups I guess.

jra's patched has been tested and cleaned up where necessary.
Comment 6 Lars Müller 2005-01-21 11:59:47 UTC
Not documented in the CUPS book or the CUPS Software Programmers Manual.

Found the same problem while testing Jeremy's patch.

I suggest to leave a comment about this feature of cupsDoFileRequest() in
Comment 7 Gerald (Jerry) Carter (dead mail address) 2005-02-07 07:34:52 UTC
originally reported against 3.0.11pre1.  Moving back to version to 3.0.10 
to remove preX and rcX versions.
Comment 8 Gerald (Jerry) Carter (dead mail address) 2005-08-24 10:26:24 UTC
sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.