rpms/cups/F-7 cups-str2656.patch,NONE,1.1 cups.spec,1.349,1.350

[Tim Waugh (twaugh)]

Author: twaugh

Update of /cvs/pkgs/rpms/cups/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8450

Modified Files:
	cups.spec 
Added Files:
	cups-str2656.patch 
Log Message:
* Fri Feb 22 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-9
- Prevent double-free when a browsed class has the same name as a printer
  or vice versa (CVE-2008-0882, bug #433758, STR #2656).


cups-str2656.patch:

--- NEW FILE cups-str2656.patch ---
diff -up cups-1.2.12/scheduler/dirsvc.c.str2656 cups-1.2.12/scheduler/dirsvc.c
--- cups-1.2.12/scheduler/dirsvc.c.str2656	2008-02-22 13:29:34.000000000 +0000
+++ cups-1.2.12/scheduler/dirsvc.c	2008-02-22 13:30:07.000000000 +0000
@@ -1954,9 +1954,9 @@ process_browse_data(
     if (hptr && !*hptr)
       *hptr = '.';			/* Resource FQDN */
 
-    if ((p = cupsdFindClass(name)) == NULL && BrowseShortNames)
+    if ((p = cupsdFindDest(name)) == NULL && BrowseShortNames)
     {
-      if ((p = cupsdFindClass(resource + 9)) != NULL)
+      if ((p = cupsdFindDest(resource + 9)) != NULL)
       {
         if (p->hostname && strcasecmp(p->hostname, host))
 	{
@@ -2060,9 +2060,9 @@ process_browse_data(
     if (hptr && !*hptr)
       *hptr = '.';			/* Resource FQDN */
 
-    if ((p = cupsdFindPrinter(name)) == NULL && BrowseShortNames)
+    if ((p = cupsdFindDest(name)) == NULL && BrowseShortNames)
     {
-      if ((p = cupsdFindPrinter(resource + 10)) != NULL)
+      if ((p = cupsdFindDest(resource + 10)) != NULL)
       {
         if (p->hostname && strcasecmp(p->hostname, host))
 	{


Index: cups.spec
===================================================================
RCS file: /cvs/pkgs/rpms/cups/F-7/cups.spec,v
retrieving revision 1.349
retrieving revision 1.350
diff -u -r1.349 -r1.350
--- cups.spec	12 Nov 2007 18:52:34 -0000	1.349
+++ cups.spec	22 Feb 2008 13:32:22 -0000	1.350
@@ -6,7 +6,7 @@
 Summary: Common Unix Printing System
 Name: cups
 Version: 1.2.12
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: GPL
 Group: System Environment/Daemons
 Source: ftp://ftp.easysw.com/pub/cups/%{version}/cups-%{version}-source.tar.bz2
@@ -51,6 +51,7 @@
 Patch27: cups-CVE-2007-4351.patch
 Patch28: cups-CVE-2007-4352,5392,5393.patch
 Patch29: cups-CVE-2007-4045.patch
+Patch30: cups-str2656.patch
 Patch100: cups-lspp.patch
 Epoch: 1
 Url: http://www.cups.org/
@@ -164,6 +165,7 @@
 %patch27 -p1 -b .CVE-2007-4351
 %patch28 -p1 -b .CVE-2007-4352,5392,5393
 %patch29 -p1 -b .CVE-2007-4045
+%patch30 -p1 -b .str2656
 
 %if %lspp
 %patch100 -p1 -b .lspp
@@ -451,6 +453,10 @@
 %{cups_serverbin}/daemon/cups-lpd
 
 %changelog
+* Fri Feb 22 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-9
+- Prevent double-free when a browsed class has the same name as a printer
+  or vice versa (CVE-2008-0882, bug #433758, STR #2656).
+
 * Mon Nov 12 2007 Tim Waugh <twaugh at redhat.com> 1:1.2.12-8
 - Fixed CVE-2007-4045 patch; has no effect with shipped packages since they
   are linked with gnutls.