Merge pull request #1454 from zdohnal/osh-fixes-post-cve

zdohnal · web-flow · commit bb093870b4e6 · 2025-12-12T07:20:53.000+01:00
scheduler: Fix possible use_after_free in `cupsdReadClient()`
diff --git a/scheduler/client.c b/scheduler/client.c
@@ -2761,10 +2761,7 @@ check_start_tls(cupsd_client_t *con)	/* I - Client connection */
     httpSetField(con->http, HTTP_FIELD_CONTENT_LENGTH, "0");
 
     if (!cupsdSendHeader(con, HTTP_STATUS_OK, NULL, CUPSD_AUTH_NONE))
-    {
-      cupsdCloseClient(con);
       return (-1);
-    }
   }
 
   return (1);

Original file line number	Diff line number	Diff line change
`@@ -2761,10 +2761,7 @@ check_start_tls(cupsd_client_t con) / I - Client connection */`
`2761`	`2761`	`httpSetField(con->http, HTTP_FIELD_CONTENT_LENGTH, "0");`
`2762`	`2762`
`2763`	`2763`	`if (!cupsdSendHeader(con, HTTP_STATUS_OK, NULL, CUPSD_AUTH_NONE))`
`2764`		`- {`
`2765`		`- cupsdCloseClient(con);`
`2766`	`2764`	`return (-1);`
`2767`		`- }`
`2768`	`2765`	`}`
`2769`	`2766`
`2770`	`2767`	`return (1);`