Fix potential crash in cups-driverd due to duplicate PPDs (Issue #1355)

Author: michaelrsweet

CHANGES.md

@@ -5,6 +5,8 @@ CHANGES - OpenPrinting CUPS
 Changes in CUPS v2.4.15 (YYYY-MM-DD)
 ------------------------------------
 
+- Fixed potential crash in `cups-driverd` when there are duplicate PPDs
+  (Issue #1355)
 - Fixed error recovery when scanning for PPDs in `cups-driverd` (Issue #1416)
 
 

scheduler/cups-driverd.cxx

@@ -1106,26 +1106,6 @@ list_ppds(int        request_id,	/* I - Request ID */
     load_ppds("/opt/share/ppd", "lsb/opt", 1);
 #endif /* __APPLE__ */
 
- /*
-  * Cull PPD files that are no longer present...
-  */
-
-  for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName);
-       ppd;
-       ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
-    if (!ppd->found)
-    {
-     /*
-      * Remove this PPD file from the list...
-      */
-
-      cupsArrayRemove(PPDsByName, ppd);
-      cupsArrayRemove(PPDsByMakeModel, ppd);
-      free(ppd);
-
-      ChangedPPD = 1;
-    }
-
  /*
   * Write the new ppds.dat file...
   */
@@ -1144,10 +1124,11 @@ list_ppds(int        request_id,	/* I - Request ID */
 
       cupsFileWrite(fp, (char *)&ppdsync, sizeof(ppdsync));
 
-      for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName);
-	   ppd;
-	   ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
-	cupsFileWrite(fp, (char *)&(ppd->record), sizeof(ppd_rec_t));
+      for (ppd = (ppd_info_t *)cupsArrayFirst(PPDsByName); ppd; ppd = (ppd_info_t *)cupsArrayNext(PPDsByName))
+      {
+        if (ppd->found)
+	  cupsFileWrite(fp, (char *)&(ppd->record), sizeof(ppd_rec_t));
+      }
 
       cupsFileClose(fp);
 
@@ -1316,7 +1297,8 @@ list_ppds(int        request_id,	/* I - Request ID */
       */
 
       if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-	  ppd->record.type >= PPD_TYPE_DRV)
+	  ppd->record.type >= PPD_TYPE_DRV ||
+	  !ppd->found)
 	continue;
 
       if (cupsArrayFind(exclude, ppd->record.scheme) ||
@@ -1429,7 +1411,8 @@ list_ppds(int        request_id,	/* I - Request ID */
       */
 
       if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-	  ppd->record.type >= PPD_TYPE_DRV)
+	  ppd->record.type >= PPD_TYPE_DRV ||
+	  !ppd->found)
 	continue;
 
       if (cupsArrayFind(exclude, ppd->record.scheme) ||
@@ -1451,7 +1434,8 @@ list_ppds(int        request_id,	/* I - Request ID */
     */
 
     if (ppd->record.type < PPD_TYPE_POSTSCRIPT ||
-        ppd->record.type >= PPD_TYPE_DRV)
+        ppd->record.type >= PPD_TYPE_DRV ||
+        !ppd->found)
       continue;
 
    /*