OCU-01-011 WP3: Heap Out-of-Bounds Write in add_enum_attributes (Medium)

[AayushKumar26]

Filing this from the 7ASecurity audit of OpenPrinting (finding OCU-01-011, WP3, Medium). Working on a fix now.

The problem

add_enum_attributes() in daemon/cups-browsed.c allocates a 10-byte heap buffer and formats remote enum values into it with sprintf:

str = malloc(sizeof(char) * 10);
...
value = ippGetInteger(attr, i);
sprintf(str, "%d", value);

10 bytes isn't enough for the full signed-int range : -2147483648 is 11 chars plus the NUL, so a large value from a remote printer writes past the allocation and corrupts the heap in the long-running cups-browsed daemon during cluster capability merging.

The same pattern is in add_margin_attributes() just below (same malloc(sizeof(char)*10) + sprintf(str,"%d",value), reading integer values), so it has the identical overflow.

Fix

Grow both buffers to 16 bytes (enough for any 32-bit signed int plus NUL) and use snprintf so the write is bounded. PR shortly.