Fix hang and crash in cupsGetDests (Issue #74)

CHANGES.md

@@ -16,6 +16,7 @@ libcups v3.0rc1 (TBD)
 - The `ipptransform` program now supports uncollated copies.
 - Fixed PCL output from `ipptransform` (Issue #72)
 - Fixed JSON output from `ipptool`.
+- Fixed hang/crash in `cupsEnumDests`/`cupsGetDests` (Issue #74)
 
 
 libcups v3.0b2 (October 5, 2023)

cups/dest.c

@@ -1,7 +1,7 @@
 //
 // User-defined destination (and option) support for CUPS.
 //
-// Copyright © 2021-2023 by OpenPrinting.
+// Copyright © 2021-2024 by OpenPrinting.
 // Copyright © 2007-2019 by Apple Inc.
 // Copyright © 1997-2007 by Easy Software Products.
 //
@@ -2786,8 +2786,6 @@ cups_enum_dests(
     goto enum_finished;
 
   // Get DNS-SD printers...
-  gettimeofday(&curtime, NULL);
-
   if ((dnssd = cupsDNSSDNew(dnssd_error_cb, NULL)) == NULL)
   {
     DEBUG_puts("1cups_enum_dests: Unable to create service browser, returning 0.");
@@ -2825,15 +2823,13 @@ cups_enum_dests(
   else
     remaining = msec;
 
+  gettimeofday(&curtime, NULL);
+
   while (remaining > 0 && (!cancel || !*cancel))
   {
     // Check for input...
     DEBUG_printf("1cups_enum_dests: remaining=%d", remaining);
 
-    cups_elapsed(&curtime);
-
-    remaining -= cups_elapsed(&curtime);
-
     cupsRWLockRead(&data.rwlock);
 
     for (i = 0, num_devices = cupsArrayGetCount(data.devices), count = 0, completed = 0; i < num_devices; i ++)
@@ -2926,6 +2922,8 @@ cups_enum_dests(
       break;
 
     usleep(100000);
+
+    remaining -= cups_elapsed(&curtime);
   }
 
   // Return...
@@ -3243,7 +3241,7 @@ cups_make_string(
 
 
   // Return quickly if we have a single string value...
-  if (attr->num_values == 1 && attr->value_tag != IPP_TAG_INTEGER && attr->value_tag != IPP_TAG_ENUM && attr->value_tag != IPP_TAG_BOOLEAN && attr->value_tag != IPP_TAG_RANGE)
+  if (attr->num_values == 1 && attr->value_tag != IPP_TAG_INTEGER && attr->value_tag != IPP_TAG_ENUM && attr->value_tag != IPP_TAG_BOOLEAN && attr->value_tag != IPP_TAG_DATE && attr->value_tag != IPP_TAG_RANGE)
     return (attr->values[0].string.text);
 
   // Copy the values to the string, separating with commas and escaping strings

cups/dnssd.c

@@ -1,7 +1,7 @@
 //
 // DNS-SD API functions for CUPS.
 //
-// Copyright © 2022-2023 by OpenPrinting.
+// Copyright © 2022-2024 by OpenPrinting.
 //
 // Licensed under Apache License v2.0.  See the file "LICENSE" for more
 // information.
@@ -433,6 +433,8 @@ cupsDNSSDDelete(cups_dnssd_t *dnssd)	// I - DNS-SD context
   cupsArrayDelete(dnssd->resolves);
   cupsArrayDelete(dnssd->services);
 
+  cupsMutexUnlock(&dnssd->mutex);
+
 #ifdef HAVE_MDNSRESPONDER
   cupsThreadCancel(dnssd->monitor);
   cupsThreadWait(dnssd->monitor);
@@ -446,7 +448,6 @@ cupsDNSSDDelete(cups_dnssd_t *dnssd)	// I - DNS-SD context
   avahi_simple_poll_free(dnssd->poll);
 #endif // HAVE_MDNSRESPONDER
 
-  cupsMutexUnlock(&dnssd->mutex);
   cupsMutexDestroy(&dnssd->mutex);
   free(dnssd);
 }