Package: lpr Severity: normal Tags: patch The setty() function in lpd/printjob.c leaks memory while parsing the "ms" printcap option.
setty() duplicates the complete "ms" string and every parsed token, then advances the argv pointer while processing the options. As a result, the original argv pointer, the duplicated "ms" buffer, and the per-token strings are lost before the function returns. A missing argument for an option handled by ksearch() may also leave the parsing loop positioned on the terminating NULL entry. The proposed fix keeps the original "ms" buffer so it can be freed after parsing, stores token pointers directly into that buffer, and walks the option vector through a separate cursor. It also frees the temporary storage on the relevant exit paths and stops processing if ksearch() consumes a missing argument. I have submitted the fix as a Salsa merge request: https://salsa.debian.org/debian/lpr/-/merge_requests/1 The issue was found by Linux Verification Center (linuxtesting.org) using SVACE.
