[cups.bugs] [HIGH] STR #2599: CUPS 1.3.4 segfaults on Fedora 8 Samba 3.0.26a job submit

[Chris Cheyney]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

CUPS 1.3.4 dies suddenly on Fedora 8 with the following dmesg
segfaults when Samba 3.0.26a tries to submit a job:

  cupsd[12755]: segfault at 00000004 eip 0048e153 esp bfeea854 error 4
  cupsd[13127]: segfault at 00000004 eip 0048e153 esp bfc14d44 error 4
  cupsd[13186]: segfault at 00000004 eip 0048e153 esp bff15084 error 4
  cupsd[13198]: segfault at 00000004 eip 0048e153 esp bf8f4224 error 4
  cupsd[13562]: segfault at 00000004 eip 0048e153 esp bf9312a4 error 4
  cupsd[13594]: segfault at 00000004 eip 0048e153 esp bfcbcdf4 error 4
  cupsd[13724]: segfault at 00000004 eip 0048e153 esp bfd7cee4 error 4

CUPS segfaults right after create_job according to the error log:

  d [15/Nov/2007:05:12:37 +0000] cupsdReadClient: 9, used=0, file=-1
state=0
  D [15/Nov/2007:05:12:37 +0000] cupsdReadClient: 9 POST
/printers/HL1440RAW HTTP/1.1
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: uri =
"/printers/HL1440RAW"...
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: Location
CUPS_INTERNAL_BROWSE_ACL Limit 0
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: Location /admin/conf Limit
7f
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: Location /admin Limit 7f
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: Location / Limit 7f
  d [15/Nov/2007:05:12:37 +0000] cupsdFindBest: best = /
  d [15/Nov/2007:05:12:37 +0000] cupsdAuthorize:
con->uri="/printers/HL1440RAW", con->best=0xb9d113f8(/)
  d [15/Nov/2007:05:12:37 +0000] cupsdAuthorize: Authorization=""
  D [15/Nov/2007:05:12:37 +0000] cupsdAuthorize: No authentication data
provided.
  d [15/Nov/2007:05:12:37 +0000] cupsdIsAuthorized:
con->uri="/printers/HL1440RAW", con->best=0xb9d113f8(/)
  d [15/Nov/2007:05:12:37 +0000] cupsdIsAuthorized: level=AUTH_ANON,
type=None, satisfy=AUTH_SATISFY_ALL, num_names=0
  d [15/Nov/2007:05:12:37 +0000] cupsdIsAuthorized: auth=AUTH_ALLOW...
  d [15/Nov/2007:05:12:37 +0000] POST /printers/HL1440RAW
  d [15/Nov/2007:05:12:37 +0000] CONTENT_TYPE = application/ipp
  d [15/Nov/2007:05:12:37 +0000] cupsdReadClient: 9
con->data_encoding=HTTP_ENCODE_LENGTH, con->data_remaining=266,
con->file=-1
  d [15/Nov/2007:05:12:37 +0000] cupsdReadClient: 9, used=258, file=-1
state=6
  d [15/Nov/2007:05:12:37 +0000] cupsdReadClient: 9
con->data_encoding=HTTP_ENCODE_LENGTH, con->data_remaining=258,
con->file=-1
  d [15/Nov/2007:05:12:37 +0000] cupsdProcessIPPRequest(0xb9d2ec78[9]):
operation_id = 0005
  D [15/Nov/2007:05:12:37 +0000] Create-Job
ipp://localhost/printers/HL1440RAW
  d [15/Nov/2007:05:12:37 +0000] create_job(0xb9d2ec78[9],
ipp://localhost/printers/HL1440RAW)

The printer in question is a raw printer (hence its name -- it's a
Brother HL-1440 printer being used in raw mode by Samba), but the
same behavior happens with the foomatic HL-1440 driver as well as
a Xerox 6120N using a stock PPD.

This configuration worked under the latest version of Fedora Core 6
but has ceased to work with the upgrade to Fedora 8.  I changed it
to a variant of the stock configuration with CUPS 1.3.4 and
reinstalled all the PPDs and queues but it didn't improve anything.
The variations are:

  LogLevel debug2
  SystemGroup lp sys root
  Listen *:631

  Browsing On
  BrowseProtocols cups
  BrowseAllow from @LOCAL
  BrowseOrder Deny,Allow

  ServerName server
  ServerAdmin root at server
  MaxLogSize 2000000
  Printcap /etc/printcap

  DefaultAuthType Basic

  <Location /admin>
  AuthType Basic
  #Encryption Required
  AuthClass System
  Require user @SYSTEM
  Order Deny,Allow
  Deny From All
  Allow From 127.0.0.1
  Allow From 192.168.0.0/24
  </Location>

  <Location /admin/conf>
  AuthType Default
  AuthClass System
  Require user @SYSTEM
  Order allow,deny
  Allow From 127.0.0.1
  Allow From 192.168.0.0/24
  </Location>

  <Location />
  AuthType None
  Order Deny,Allow
  Deny From All
  Allow From 127.0.0.1
  Allow From 192.168.0.0/24
  </Location>

  # standard policy default section goes here

Of course, client.conf contains ServerName 127.0.0.1:631.

The Samba side is straight out of the Samba FAQ:

  load printers = yes
  printing = cups
  printcap name = cups

  ###
  ### printers
  ###
  [printers]
  comment = CUPS printers
  path = /var/spool/samba-ronly
  browseable = yes
  public = yes
  guest ok = yes
  writeable = no
  printable = yes
  ### printer admin = root
  ...

The Samba logs themselves aren't very useful or interesting:

  [2007/11/15 05:12:25, 0] printing/print_cups.c:cups_cache_reload(85)
    Unable to connect to CUPS server 127.0.0.1 - Connection refused
  [2007/11/15 05:12:25, 0] printing/print_cups.c:cups_cache_reload(85)
    Unable to connect to CUPS server 127.0.0.1 - Connection refused

I'm guessing these happen after CUPS has segfaulted.

I can print to all three print queues (both HL-1440's and the
Xerox 6120N) from the server directly from CUPS's test page
print function, but CUPS dies when I try to print a test page
through Samba.

Do you have any suggestions for trying something to see if
there's a workaround?

Thanks,

chris

Link: http://www.cups.org/str.php?L2599
Version: 1.3.4