[cups.bugs] [HIGH] STR #3155: texttops produces incorrect postscript on some locales when 'prettyprint' is specified

[drakamakafon at mail.ru]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

Environment:
- Fedora Core 4 (32 bits), cups-1.1.23 (resulted postscript is not parsed
by 'gs')
- openSuSE 10.2 (64 bits), cups-1.2.7 (parsed by 'gs', but date on the top
of page is incorrect)

Steps to reproduce:

# Check environment
> cat /etc/issue
Fedora Core release 4 (Stentz)
Kernel \r on an \m

> uname -a
Linux localhost.localdomain 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT
2005 i686 i686 i386 GNU/Linux

> rpm -qa | grep cups
cups-libs-1.1.23-15
libgnomecups-0.2.0-2
hal-cups-utils-0.5.3-3
cups-1.1.23-15

> locale
LANG=ko_KR.UTF-8
LC_CTYPE="ko_KR.UTF-8"
LC_NUMERIC="ko_KR.UTF-8"
LC_TIME="ko_KR.UTF-8"
LC_COLLATE="ko_KR.UTF-8"
LC_MONETARY="ko_KR.UTF-8"
LC_MESSAGES="ko_KR.UTF-8"
LC_PAPER="ko_KR.UTF-8"
LC_NAME="ko_KR.UTF-8"
LC_ADDRESS="ko_KR.UTF-8"
LC_TELEPHONE="ko_KR.UTF-8"
LC_MEASUREMENT="ko_KR.UTF-8"
LC_IDENTIFICATION="ko_KR.UTF-8"
LC_ALL=

# Add postscript printer
> lpadmin -p testprinter -v file:/tmp/testprinter -P
/usr/share/cups/model/postscript.ppd.gz -E

# Print text job
> echo test | lpr -P testprinter -o prettyprint

# Resulted postscript is invalid
> gs /tmp/testprinter
GNU Ghostscript 7.07 (2003-05-17)
Copyright (C) 2003 artofcode LLC, Benicia, CA.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Error: /undefined in cupsB
Operand stack:
   FDepVector   --nostringval--   --dict:12/13(ro)(L)--  
--dict:12/13(ro)(L)--
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--  
--nostringval--   2   %stopped_push   --nostringval--   --nostringval--  
--nostringval--   false   1   %stopped_push   1   3   %oparray_pop   1   3
  %oparray_pop   1   3   %oparray_pop   1   3   %oparray_pop   .runexec2  
--nostringval--   --nostringval--   --nostringval--   2   %stopped_push  
--nostringval--   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1057/1123(ro)(G)--   --dict:0/20(G)--   --dict:112/200(L)--  
--dict:4/8(L)--
Current allocation mode is local
Current file position is 372736
GNU Ghostscript 7.07: Unrecoverable error, exit code 1

I've found that 'texttops' filter crashes (segmentation fault) due to
following (description and code below is for cups-1.1.23 but it seems that
the problem also exists in 1.2.x and 1.3.x branches):
1) Encoding that is a part of initial LANG value (ko_KR.UTF-8) is moved by
CUPS(cupsPrintFile) to CHARSET variable
2) Encoding of 'strftime' output (line 204) depends on LANG environment
variable (at this time LANG=ko_KR, i.e. w/o encoding) and may differ from
UTF-8 ('strftime' knows nothing about CHARSET variable, in this case
encoding will be EUC-KR)
3) 'write_text' treats 'curdate' string according to CHARSET variable i.e.
it tries to decode 'curdate' as UTF-8 string and may have access violation
in line 1275 when it decodes character as 'Three byte character'

// texttops.c (from cups-1.1.23-source.tar.bz2)
....
125:	void
126:	WriteProlog(const char *title,		/* I - Title of job */
127:		    const char *user,		/* I - Username */
128:	            const char *classification,	/* I - Classification */
129:		    const char *label,		/* I - Page label */
130:	            ppd_file_t *ppd)		/* I - PPD file info */
131:	{
....
143:	  time_t	curtime;	/* Current time */
144:	  struct tm	*curtm;		/* Current date */
145:	  char		curdate[255];	/* Current date (text format) */
....
202:	  curtime = time(NULL);
203:	  curtm   = localtime(&curtime);
204:	  strftime(curdate, sizeof(curdate), CUPS_STRFTIME_FORMAT, curtm);
....
881:	  if (PrettyPrint)
882:	  {
....
926:	    printf("/D");
927:	    write_text(curdate);
928:	    puts("def");
....
989:	  }
....
996:	}
....

1235:	static void
1236:	write_text(const char *s)	/* I - String to write */
1237:	{
1238:	  int			ch;	/* Actual character value (UTF8) */
1239:	  const unsigned char	*utf8;	/* UTF8 text */
....
1250:	    utf8 = (const unsigned char *)s;
1251:	
1252:	    while (*utf8)
1253:	    {
1254:	      if (*utf8 < 0xc0 || !UTF8)
1255:	        ch = *utf8 ++;
1256:	      else if ((*utf8 & 0xe0) == 0xc0)
1257:	      {
1258:	       /*
1259:	        * Two byte character...
1260:		*/
1261:	
1262:	        ch = ((utf8[0] & 0x1f) << 6) | (utf8[1] & 0x3f);
1263:		utf8 += 2;
1264:	      }
1265:	      else
1266:	      {
1267:	       /*
1268:	        * Three byte character...
1269:		*/
1270:	
1271:	        ch = ((((utf8[0] & 0x1f) << 6) | (utf8[1] & 0x3f)) << 6) |
1272:		     (utf8[2] & 0x3f);
1273:		utf8 += 3;
1274:	      }
1275:	
1276:	      printf("%04x", Chars[ch]);
1277:	    }
....
1306:	}

Link: http://www.cups.org/str.php?L3155
Version: 1.1.23