From d74530cbf3b0be249e5e6a4330c2cd2a34b7ce1b Mon Sep 17 00:00:00 2001 From: tanjiro Kamado Date: Tue, 27 Oct 2026 13:57:23 +0530 Subject: [PATCH] Fix out-of-scope size name pointer in cups_create_media_db --- cups/dest-options.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/cups/dest-options.c b/cups/dest-options.c index e992cca1f..efe8299fe 100644 --- a/cups/dest-options.c +++ b/cups/dest-options.c @@ -1719,6 +1719,9 @@ cups_create_media_db( cups_array_t *db; // New media database array _cups_media_db_t mdb; // Media entry char media_key[256]; // Synthesized media-key value + pwg_media_t temppwg; // Temporary PWG media info + char keyword[128], // PWG size keyword + ppdname[41]; // PPD size name db = cupsArrayNew((cups_array_cb_t)cups_compare_media_db, NULL, NULL, 0, (cups_acopy_cb_t)cups_copy_media_db, (cups_afree_cb_t)cups_free_media_db); @@ -1839,12 +1842,8 @@ cups_create_media_db( if (!mdb.key) { - pwg_media_t temppwg; // PWG media info - char keyword[128], // PWG size keyword - ppdname[41]; // PPD size name - - if (!mdb.size_name && _pwgMediaNearSize(&temppwg, keyword, sizeof(keyword), ppdname, sizeof(ppdname), mdb.width, mdb.length, _PWG_EPSILON)) - mdb.size_name = keyword; + if (!mdb.size_name && (pwg = _pwgMediaNearSize(&temppwg, keyword, sizeof(keyword), ppdname, sizeof(ppdname), mdb.width, mdb.length, _PWG_EPSILON)) != NULL) + mdb.size_name = (char *)pwg->pwg; if (!mdb.size_name) {