[cups-devel] [MOD] STR #4386: Race condition in cupsDoIORequest()

[Tim Waugh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR Resolved]

This still isn't fixed I'm afraid.

To see it happen, configure cupsd.conf with:

DefaultAuthType Basic
[...]
<Location />
  Order allow,deny
  AuthType Default
  Require valid-user
</Location>

and run 'gdb --args lpstat -p'.

Set a breakpoint in cupsSendRequest() after the httpPost() call but before
the ippWrite() call. Let execution run to that breakpoint, then continue.

You'll see that ippWrite() returns IPP_STATE_ERROR, so the ippWrite loop is
exited immediately, and the function returns HTTP_STATUS_ERROR. The error
is propagated back up to lpstat, which tells the user a "Broken pipe" was
the cause (because ippWrite() couldn't write to the half-closed socket).

I've attached a patch which checks for HTTP response data before checking
for IPP_STATE_ERROR. If there is an HTTP error in the response data, it
uses that as normal.

Link: https://www.cups.org/str.php?L4386
Version: 1.7.1
Fix Version: 2.0-current (r11680)
Attachment: https://www.cups.org/strfiles.php/3311/cups-str4386.patch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJTToJHAAoJENujp6sI12Ij+m0QAKwheF7xtkrDs3DMvPYGoben
tCc495f8m5gm928j8q65ahjZs8qjMH5Viz+4tf3erZ0yy50JFRqHUzITWhVJDfZW
JCLSPfox/SX+F4UtsnGUL3oZwdtij+HI7E/SaxUJug1D5DhSLdqP/ljfqO+UUFEv
G/mofMCZhsFlYfUM3EgQmR8OOt6Kn4pblNog8ARlFhViqEApNkWZtGruAvCseb7/
wP7kxptaFXguCWMqI1IxHtEr1IVZXLyql/ItEI354tp5EJiOVSKTYwWehgFP8pCX
zBKHpyzS+WutQ4zgnTNdMe7RNvednLGKUDi/TBV/RHzFhq0pkLJIjUlDK2xlmXLj
s8W/0btmL8lSz9hlDpVwSjBT364k+BijPJ1T5Z1PRjlUfApoal4R17koQxIRbpj1
hJlwUxWS5/GGcJqMo4fT0/Am9/JXivP96TlnKLBzLcNgpJwhQ+4gurSUrnesmbeM
9drpCYnveO/AJVZ1HKBlnOHxLOGF0WWmC/S5+36PEDbgptSq/4+ILuhWrRWlR4nI
BTuLunOOUt2UoX1qCfLnhuJRWT1agBcDczaovnNZ7boNKoCv4ROOmvysp2S2AA15
/XO9GqXa5cQmdYfjdTjxOPcYtVUovk9gacKwJSoPJEpSXdDbwPgMCMlgET/6EqYR
uKnBXmgO6XETEigoAjRx
=hh3B
-----END PGP SIGNATURE-----