[tanjiroK-coder]

cups_create_media_db builds a media key for each media-col-database (or media-col-ready) entry that has no media-key. When the entry also lacks media-size-name it asks _pwgMediaNearSize for a name, passing a keyword buffer that is declared inside the enclosing if block, and then points mdb.size_name at that buffer. For a standard size _pwgMediaNearSize returns the static table entry without writing keyword, so size_name points at uninitialized stack, and in every case the pointer outlives the block, so cupsArrayAdd copies the entry at the end of the loop from an out-of-scope buffer. I hit this with a printer whose media-col-database carried media-size and media-source but no media-key or media-size-name, which is legal IPP: AddressSanitizer reports stack-use-after-scope at dest-options.c:1885, and without the sanitizer the garbage becomes the media name handed out by cupsGetDestMedia* and sent back to the printer as the media attribute. The attributes come from the printer, so any client calling cupsGetDestMediaByIndex, cupsGetDestMediaByName, cupsGetDestMediaBySize, cupsGetDestMediaDefault, cupsGetDestMediaCount, cupsLocalizeDestMedia or cupsAddDestMediaOptions is exposed. The fix moves temppwg, keyword and ppdname to function scope and takes the size name from the pwg_media_t that _pwgMediaNearSize returns, which is either the table string or keyword, the same way cupsGetDestMediaByName already does. Media names for entries that carry media-key or media-size-name are unchanged.

Proposed changelog entry:

• Fixed use of an out-of-scope buffer as the media size name in cups_create_media_db when a printer omits "media-key" and "media-size-name".