From 0932be69792419caac264189b6a1de20e9270f04 Mon Sep 17 00:00:00 2001 From: Carmelo Date: Mon, 26 Oct 2026 18:13:37 +0800 Subject: [PATCH] Fix uninitialized read in cupsLangFind cupsCopyString does not initialize bytes after the terminating null. For a one-character language name such as the C locale, checking langname[2] therefore branches on an uninitialized stack byte. Check the string length before normalizing the separator. --- cups/language.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cups/language.c b/cups/language.c index 897a1fc04..91666ae2f 100644 --- a/cups/language.c +++ b/cups/language.c @@ -117,7 +117,7 @@ cupsLangFind(const char *language) // I - Language or locale name, `NULL` for th cupsMutexLock(&lang_mutex); cupsCopyString(langname, language, sizeof(langname)); - if (langname[2] == '-') + if (strlen(langname) > 2 && langname[2] == '-') langname[2] = '_'; for (lang = lang_cache; lang; lang = lang->next)