Index: backend/usb-libusb.c =================================================================== --- backend/usb-libusb.c (revision 10756) +++ backend/usb-libusb.c (working copy) @@ -672,10 +672,10 @@ * If it didn't exit abort the pending read and wait an additional * second... */ - + if (!g.read_thread_done) { - fputs("DEBUG: Read thread still active, aborting the pending read...\n", + fputs("DEBUG: Read thread still active, aborting the pending read...\n", stderr); g.wait_eof = 0; @@ -683,7 +683,7 @@ gettimeofday(&tv, NULL); cond_timeout.tv_sec = tv.tv_sec + 1; cond_timeout.tv_nsec = tv.tv_usec * 1000; - + while (!g.read_thread_done) { if (pthread_cond_timedwait(&g.read_thread_cond, &g.read_thread_mutex, @@ -696,9 +696,6 @@ pthread_mutex_unlock(&g.read_thread_mutex); } - if (print_fd) - close(print_fd); - /* * Close the connection and input file and general clean up... */ @@ -758,7 +755,7 @@ */ if (printer->origconf > 0 && printer->origconf != number2) { - fprintf(stderr, "DEBUG: Restoring USB device configuration: %d -> %d\n", + fprintf(stderr, "DEBUG: Restoring USB device configuration: %d -> %d\n", number2, printer->origconf); if ((errcode = libusb_set_configuration(printer->handle, printer->origconf)) < 0) @@ -919,7 +916,7 @@ */ if (((altptr->bInterfaceClass != LIBUSB_CLASS_PRINTER || - altptr->bInterfaceSubClass != 1) && + altptr->bInterfaceSubClass != 1) && ((printer.quirks & USBLP_QUIRK_BAD_CLASS) == 0)) || (altptr->bInterfaceProtocol != 1 && /* Unidirectional */ altptr->bInterfaceProtocol != 2) || /* Bidirectional */ @@ -997,7 +994,7 @@ bEndpointAddress; } else - fprintf(stderr, "DEBUG: Uni-directional USB communication " + fprintf(stderr, "DEBUG: Uni-directional USB communication " "only!\n"); printer.write_endp = confptr->interface[printer.iface]. altsetting[printer.altset]. @@ -1376,7 +1373,7 @@ printer->origconf = current; - if ((errcode = + if ((errcode = libusb_get_config_descriptor (printer->device, printer->conf, &confptr)) < 0) { @@ -1388,7 +1385,7 @@ if (number1 != current) { - fprintf(stderr, "DEBUG: Switching USB device configuration: %d -> %d\n", + fprintf(stderr, "DEBUG: Switching USB device configuration: %d -> %d\n", current, number1); if ((errcode = libusb_set_configuration(printer->handle, number1)) < 0) { Index: cups/ipp.c =================================================================== --- cups/ipp.c (revision 10756) +++ cups/ipp.c (working copy) @@ -3239,6 +3239,13 @@ ipp->prev = ipp->current; attr = ipp->current = ipp_add_attr(ipp, NULL, ipp->curtag, IPP_TAG_ZERO, 1); + if (!attr) + { + _cupsSetHTTPError(HTTP_ERROR); + DEBUG_puts("1ippReadIO: unable to allocate attribute."); + _cupsBufferRelease((char *)buffer); + return (IPP_ERROR); + } DEBUG_printf(("2ippReadIO: membername, ipp->current=%p, ipp->prev=%p", ipp->current, ipp->prev)); @@ -6364,6 +6371,7 @@ _cupsStrFree(attr->values[0].string.language); attr->values[0].string.language = NULL; } + /* Fall through to other string values */ case IPP_TAG_TEXT : case IPP_TAG_NAME : Index: cups/dest-options.c =================================================================== --- cups/dest-options.c (revision 10756) +++ cups/dest-options.c (working copy) @@ -485,7 +485,7 @@ active = NULL; } - if (tries >= 0) + if (tries >= 100) { DEBUG_puts("1cupsCopyDestConflicts: Unable to resolve after 100 tries."); have_conflicts = -1; Index: cups/http-support.c =================================================================== --- cups/http-support.c (revision 10756) +++ cups/http-support.c (working copy) @@ -2064,6 +2064,8 @@ error)); #endif /* DEBUG */ } + + httpAddrFreeList(addrlist); } } @@ -2279,6 +2281,8 @@ error)); #endif /* DEBUG */ } + + httpAddrFreeList(addrlist); } } Index: cups/ipp-support.c =================================================================== --- cups/ipp-support.c (revision 10756) +++ cups/ipp-support.c (working copy) @@ -777,8 +777,8 @@ if (!strcmp(attrname, "document-state") && enumvalue >= 3 && - enumvalue <= (3 + (int)(sizeof(ipp_document_states) / - sizeof(ipp_document_states[0])))) + enumvalue < (3 + (int)(sizeof(ipp_document_states) / + sizeof(ipp_document_states[0])))) return (ipp_document_states[enumvalue - 3]); else if (!strcmp(attrname, "finishings") || !strcmp(attrname, "finishings-actual") || @@ -787,8 +787,8 @@ !strcmp(attrname, "finishings-supported")) { if (enumvalue >= 3 && - enumvalue <= (3 + (int)(sizeof(ipp_finishings) / - sizeof(ipp_finishings[0])))) + enumvalue < (3 + (int)(sizeof(ipp_finishings) / + sizeof(ipp_finishings[0])))) return (ipp_finishings[enumvalue - 3]); else if (enumvalue >= 0x40000000 && enumvalue <= (0x40000000 + (int)(sizeof(ipp_finishings_vendor) / @@ -798,8 +798,8 @@ else if ((!strcmp(attrname, "job-collation-type") || !strcmp(attrname, "job-collation-type-actual")) && enumvalue >= 3 && - enumvalue <= (3 + (int)(sizeof(ipp_job_collation_types) / - sizeof(ipp_job_collation_types[0])))) + enumvalue < (3 + (int)(sizeof(ipp_job_collation_types) / + sizeof(ipp_job_collation_types[0])))) return (ipp_job_collation_types[enumvalue - 3]); else if (!strcmp(attrname, "job-state") && enumvalue >= IPP_JOB_PENDING && enumvalue <= IPP_JOB_COMPLETED) @@ -811,16 +811,16 @@ !strcmp(attrname, "orientation-requested-default") || !strcmp(attrname, "orientation-requested-supported")) && enumvalue >= 3 && - enumvalue <= (3 + (int)(sizeof(ipp_orientation_requesteds) / - sizeof(ipp_orientation_requesteds[0])))) + enumvalue < (3 + (int)(sizeof(ipp_orientation_requesteds) / + sizeof(ipp_orientation_requesteds[0])))) return (ipp_orientation_requesteds[enumvalue - 3]); else if ((!strcmp(attrname, "print-quality") || !strcmp(attrname, "print-quality-actual") || !strcmp(attrname, "print-quality-default") || !strcmp(attrname, "print-quality-supported")) && enumvalue >= 3 && - enumvalue <= (3 + (int)(sizeof(ipp_print_qualities) / - sizeof(ipp_print_qualities[0])))) + enumvalue < (3 + (int)(sizeof(ipp_print_qualities) / + sizeof(ipp_print_qualities[0])))) return (ipp_print_qualities[enumvalue - 3]); else if (!strcmp(attrname, "printer-state") && enumvalue >= IPP_PRINTER_IDLE && enumvalue <= IPP_PRINTER_STOPPED) Index: scheduler/job.c =================================================================== --- scheduler/job.c (revision 10757) +++ scheduler/job.c (working copy) @@ -4294,6 +4294,8 @@ else unload_job(job); } + else + free(job); } cupsDirClose(dir); @@ -4385,7 +4387,7 @@ if (!strcmp(name, "time-at-completed")) { - if (JobHistory < INT_MAX) + if (JobHistory < INT_MAX && attr) job->history_time = attr->values[0].integer + JobHistory; else job->history_time = INT_MAX; @@ -4393,7 +4395,7 @@ if (job->history_time < JobHistoryUpdate || !JobHistoryUpdate) JobHistoryUpdate = job->history_time; - if (JobFiles < INT_MAX) + if (JobFiles < INT_MAX && attr) job->file_time = attr->values[0].integer + JobFiles; else job->file_time = INT_MAX; Index: scheduler/cupsfilter.c =================================================================== --- scheduler/cupsfilter.c (revision 10756) +++ scheduler/cupsfilter.c (working copy) @@ -409,6 +409,7 @@ if (srctype) { + /* sscanf return value already checked above */ sscanf(srctype, "%15[^/]/%255s", super, type); if ((src = mimeType(mime, super, type)) == NULL) { @@ -426,6 +427,7 @@ return (1); } + /* sscanf return value already checked above */ sscanf(dsttype, "%15[^/]/%255s", super, type); if (!_cups_strcasecmp(super, "printer")) dst = printer_type;