Bug #11306: Segmentation fault

• Status: Third Party's Issue
• Assignee: -
• Target version: -
• ruby -v: ruby 2.2.1p85 (2015-02-26 revision 49769) [x86_64-linux]
• Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN

[dsaronin (David Anderson)]

bug is detected during CUPS call in cups gem (https://github.com/m0wfo/cups) v0.1.10. The complete core dump is attached as file 'dump.txt'.

the following works okay:

2.2.1 :001 > list = Cups.show_destinations
 => ["laserjet_1102w", "lp_null"] 
2.2.1 :002 > Cups.device_uri_for( list.first )
 => "hp:/net/HP_LaserJet_Professional_P_1102w?ip=192.168.0.65" 
2.2.1 :003 > Cups.device_uri_for( list.last )
 => "file:///dev/null" 

the following fails (the order is not important; the second call always fails with abort):

2.2.1 :001 > list = Cups.show_destinations
 => ["laserjet_1102w", "lp_null"] 
2.2.1 :002 > CupsDevice.testit( list.first )
 => "hp:/net/HP_LaserJet_Professional_P_1102w?ip=192.168.0.65" 
2.2.1 :003 > CupsDevice.testit( list.last )
/home/daudi/projectspace/swalapala/app/models/cups_device.rb:101: [BUG] Segmentation fault at 0x0000000a491862
ruby 2.2.1p85 (2015-02-26 revision 49769) [x86_64-linux]

where:

class CupsDevice < ActiveRecord::Base
  def self.testit( cups_name )
       Cups.device_uri_for( cups_name )
  end
end # class CupsDevice

and in the cups gem:

  rb_define_singleton_method(rubyCups, "device_uri_for", cups_get_device_uri, 1);


static VALUE cups_get_device_uri(VALUE self, VALUE printer)
{
   if (!printer_exists(printer))
   {
     rb_raise(rb_eRuntimeError, "The printer or destination doesn't exist!");
   }

   VALUE options_list;
   http_t *http;
   ipp_t *request;
   ipp_t *response;
   ipp_attribute_t *attr;
   char uri[1024];
   char *location;
   char *name = RSTRING_PTR(printer);

   request = ippNewRequest(IPP_GET_PRINTER_ATTRIBUTES);
   httpAssembleURIf(HTTP_URI_CODING_ALL, uri, sizeof(uri), "ipp", NULL, "localhost", 0, "/printers/%s", name);
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);

   if ((response = cupsDoRequest(http, request, "/")) != NULL)
   {
     if((attr = ippFindAttribute(response, "device-uri", IPP_TAG_URI)) != NULL)
     {
       return rb_str_new2(attr->values[0].string.text);
     }
     ippDelete(response);
   }
   return Qtrue;
}

[normalperson (Eric Wong)]

[e-mail] wrote:

static VALUE cups_get_device_uri(VALUE self, VALUE printer)
{
   if (!printer_exists(printer))
   {
     rb_raise(rb_eRuntimeError, "The printer or destination doesn't exist!");
   }

   VALUE options_list;
   http_t *http;
   ipp_t *request;
   ipp_t *response;
   ipp_attribute_t *attr;
   char uri[1024];
   char *location;
   char *name = RSTRING_PTR(printer);

You want to use StringValueCStr or StringValuePtr when you see
untrusted user-input instead of RSTRING_PTR. RSTRING_PTR will segfault
if the user calls a function with a non-String.

   request = ippNewRequest(IPP_GET_PRINTER_ATTRIBUTES);
   httpAssembleURIf(HTTP_URI_CODING_ALL, uri, sizeof(uri), "ipp", NULL, "localhost", 0, "/printers/%s", name);

You also need to add a GC guard for VALUE where you got ‘name’ from
after the last use of ‘name’ in your function:

RB_GC_GUARD(printer);

Nowadays with better optimizing compilers, the volatile type qualifier
for args in the StringValue* family functions is insufficient to protect
VALUEs from inadvertant GC. RB_GC_GUARD must be used.

See doc/extension.rdoc in the latest Ruby trunk or README.EXT in the
2.2 source tarball for more info on these APIs

And feel free to ask for clarification here on the ruby-core ML.

cups.c (14.2 KB)

Lots of similar problems in cups.c too. The same pattern
described above needs to happen with
RSTRING_PTR => StringValueCStr/StringValuePtr and the addition of
RB_GC_GUARD calls after the last access to the underlying pointer.

There may be other problems in the code, too, but these are the ones
that jumped out to my tired, sleepy eyes...

[nobu (Nobuyoshi Nakada)]

• Description updated (diff)
• Status changed from Open to Third Party's Issue

A bug of that gem.

[dsaronin (David Anderson)]

Thank you. This has now been reported as a gem error: https://github.com/m0wfo/cups/issues/21
and I added Eric Wong's response as a comment to that issue.