libsane-hpaio: duplex option descriptor uninitialized
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
HPLIP |
New
|
Undecided
|
Unassigned | ||
hplip (Debian) |
Fix Released
|
Unknown
|
Bug Description
http://
From: Matej Vela <email address hidden>
To: Андрей Парамонов
<email address hidden>, <email address hidden>
Cc: Julien BLACHE <email address hidden>
Subject: Re: Bug#583273: flegita: Crashes on startup
Date: Thu, 17 May 2012 10:54:44 +0100
[Message part 1 (text/plain, inline)]
On Fri, May 28, 2010 at 10:42:44PM +0200, Julien BLACHE wrote:
> Андрей Парамонов <email address hidden> wrote:
>
>> I've managed to get the following backtrace with hplip debug symbols:
>>
>> 0xb090304c in sane_hpaio_
>> action=
>> pInfo=0xb34b21ac) at scan/sane/
>> 2485 *pIntValue = hpaio->
>
> I think we have a winner :-) Now you'll just have to figure out why
> gnome-scan passes NULL here :/
Andrey, can you try rebuilding libsane-hpaio with the patch below? Or I can
put together an (unofficial) package -- just let me know which dist/arch.
This is what seems to be happening:
(1) hplip-3.
descriptor array with zeros. Most descriptors are later given actual
values (hpaioSetupOpti
only if duplex is active; if not, its .size is left as 0.
(2) gnome-scan-
fetches the duplex option descriptor, and passes its .size without
checking to g_malloc0. For a size of 0, g_malloc0 is defined to return
NULL. This is again passed without checking to sane_control_
which segfaults as soon as it tries to store the return value there.
It's a given that gnome-scan would be better off with more sanity checks,
but I think the right thing to do is for libsane-hpaio to initialize the
OPTION_DUPLEX descriptor unconditionally, to ensure that the return value
from sane_get_
(I haven't worked with SANE before, and don't have a scanner to test with,
so take all this with a large grain of salt. :-)
Cheers,
Matej
--- hplip-3.
+++ hplip-3.
@@ -1342,9 +1342,8 @@
hpaio-
hpaio-
- // Duplex scanning is supported
- if (hpaio-
- {
+ // hpaioUpdateDesc
+ // on whether duplex is supported
@@ -1355,7 +1354,7 @@
- }
+
hpaio-
hpaio-
hpaio-
Changed in hplip (Debian): | |
status: | Unknown → Confirmed |
Changed in hplip (Debian): | |
status: | Confirmed → Fix Released |