[cups.bugs] [HIGH] STR #3324: cupsd frees memory without cleaning up existing references

[Maciej Bliziński]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

This issue is also present in cups-1.4.0.

If I understand correctly, the problem is that the some mime types
(mime_type_t) can be referenced from more than one printer. When one
printer is deleted, the type pointers are freed; another printer might try
to access them later.

In my case, the printer that cupsd likes to segfault on, is called
'hpduke'. Here's what I get when I search for 'hpduke' in the web
interface. There are 4 instances of the printer:

hpduke	hpduke		Remote Printer	Idle
hpduke	hpduke		Remote Printer	Idle
hpduke at x.x.x.118	HP Color Laserjet 3600	US-MTV-202/1250 Charleston/105	HP
Color LaserJet 3600 Foomatic/hpijs (recommended) - HPLIP 0.9.7 on
x.x.x.118	Idle
hpduke at x.x.x.x.119	HP Color Laserjet 3600	1250 Charleston	HP Color
LaserJet 3600 Foomatic/hpijs (recommended) - HPLIP 0.9.7 on x.x.x.119	Idle

Maciej

Link: http://www.cups.org/str.php?L3324
Version: 1.3.11