[Carmel0]

cupsLangFind() copies the requested language into a 16-byte stack buffer and then checks langname[2] for '-'. cupsCopyString() only initializes the copied bytes and the terminating null. For a one-character name such as the POSIX "C" locale, langname[2] is therefore still uninitialized.

This is also reached through cupsLangDefault() whenever the process locale is "C".

Reproducer

Build the existing testlang program and run a lookup for the "C" locale under Valgrind:

./configure --enable-debug
make -C cups testlang

valgrind --tool=memcheck \
  --undef-value-errors=yes \
  --track-origins=yes \
  --error-exitcode=86 \
  cups/testlang -l C no-such-message

Memcheck reports:

Conditional jump or move depends on uninitialised value(s)
   at cupsLangFind (cups/language.c:120)

Uninitialised value was created by a stack allocation
   at cupsLangFind (cups/language.c:107)

Check the copied string length before inspecting index 2. The same command is Memcheck-clean after the change, and testlang passes.