* [danny] Consolidated Pull Request
@ 2013-01-07 11:09 Ross Burton
2013-01-07 11:09 ` [PATCH 1/7] bootimg: Use FAT 32 for images larger than 512MB Ross Burton
` (7 more replies)
0 siblings, 8 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:09 UTC (permalink / raw)
To: openembedded-core
Hi,
This short series is mainly to fix a udev booting regression on hddimg and
brings in a number of CVE fixes, with two other good fixing coming along.
d88bdd6 librsvg: CVE-2011-3146
c30e7e5 cups CVE-2011-3170
b91e5f6 cups - CVE-2011-2896
6f966f8 cups: CVE-2012-5519
d25e356 libnss-mdns: fix mDNS resolving speed
002ef4a Revert "initrdscripts: fix udevd in the live boot init scripts"
774b05e bootimg: Use FAT 32 for images larger than 512MB
Ross
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 1/7] bootimg: Use FAT 32 for images larger than 512MB
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
@ 2013-01-07 11:09 ` Ross Burton
2013-01-07 11:09 ` [PATCH 2/7] Revert "initrdscripts: fix udevd in the live boot init scripts" Ross Burton
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:09 UTC (permalink / raw)
To: openembedded-core
Cc: Przemek Czesnowicz, Darren Hart, Joshua Immanuel, Steve Sakoman
From: Darren Hart <dvhart@linux.intel.com>
Fixes [YOCTO #2138]
Commit 217584211625b1c496fe5b78aa4765ccf605d2b9 dropped the forced use
of FAT32 for the hddimg generation as it broke with very small images
(< 32MB). Unfortunately, left to its own devices, mkdosfs appears to select
FAT16 even for very large images, resulting in 2.2GB images being
generated as FAT16:
$ ls -lah core-image-lsb-sdk-atom-pc-20121010233936.hddimg
-rw-rw-r-- 1 dvhart dvhart 2.2G 2012-10-17 08:00 core-image-lsb-sdk-atom-pc-20121010233936.hddimg
$ file !$
file core-image-lsb-sdk-atom-pc-20121010233936.hddimg
core-image-lsb-sdk-atom-pc-20121010233936.hddimg: x86 boot sector, code offset 0x58, OEM-ID "SYSLINUX", sectors/cluster 128, root entries 512, Media descriptor 0xf8, sectors/FAT 138, heads 64, sectors 4502496 (volumes > 32 MB) , serial number 0x50761926, label: "boot ", FAT (16 bit)
The result was a runtime boot error from SYSLINUX and a failure to boot
live images greater than 1GB in size.
While strictly speaking it is the cluster count that determines which
FAT size is used, that calculation requires more information than we
have readily available (such as sectors per cluster). If we let mkdosfs
determine sectors per cluster and just set a sane threshold above which
FAT32 is used, we get correct bootable images. With this patch the 2.2GB
core-image-lsb-sdk uses FAT32 and the 21 MB core-image-minimal uses
FAT16, and both boot in qemu successfully:
$ ls -lah tmp/deploy/images/core-image-lsb-sdk-atom-pc-20121212220835.hddimg
-rw-r--r-- 1 dvhart dvhart 2.2G 2012-12-12 14:18 tmp/deploy/images/core-image-lsb-sdk-atom-pc-20121212220835.hddimg
$ file !$
file tmp/deploy/images/core-image-lsb-sdk-atom-pc-20121212220835.hddimg
tmp/deploy/images/core-image-lsb-sdk-atom-pc-20121212220835.hddimg: x86 boot sector, code offset 0x58, OEM-ID "SYSLINUX", sectors/cluster 8, Media descriptor 0xf8, heads 64, sectors 4470304 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 4357, reserved3 0x800000, serial number 0x50c902b7, label: "boot "
$ ls -lah tmp/deploy/images/core-image-minimal-atom-pc-20121212220600.hddimg
-rw-r--r-- 1 dvhart dvhart 21M 2012-12-12 14:06 tmp/deploy/images/core-image-minimal-atom-pc-20121212220600.hddimg
$ file !$
file tmp/deploy/images/core-image-minimal-atom-pc-20121212220600.hddimg
tmp/deploy/images/core-image-minimal-atom-pc-20121212220600.hddimg: x86 boot sector, code offset 0x58, OEM-ID "SYSLINUX", sectors/cluster 4, root entries 512, sectors 41408 (volumes <=32 MB) , Media descriptor 0xf8, sectors/FAT 41, heads 64, serial number 0x50c8ffec, label: "boot ", FAT (16 bit)
I have tested and booted core-image-minimal and core-image-lsb-sdk for
atom-pc with qemu-system-i386 using this patch.
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Steve Sakoman <steve@sakoman.com>
Cc: Joshua Immanuel <josh@hipro.co.in>
Cc: Przemek Czesnowicz <przemyslawx.czesnowicz@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/classes/bootimg.bbclass | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/meta/classes/bootimg.bbclass b/meta/classes/bootimg.bbclass
index 11a29cd..83c8ac4 100644
--- a/meta/classes/bootimg.bbclass
+++ b/meta/classes/bootimg.bbclass
@@ -163,8 +163,15 @@ build_hddimg() {
# done in blocks, thus the mod by 16 instead of 32.
BLOCKS=$(expr $BLOCKS + $(expr 16 - $(expr $BLOCKS % 16)))
+ # mkdosfs will sometimes use FAT16 when it is not appropriate,
+ # resulting in a boot failure from SYSLINUX. Use FAT32 for
+ # images larger than 512MB, otherwise let mkdosfs decide.
+ if [ $(expr $BLOCKS / 1024) -gt 512 ]; then
+ FATSIZE="-F 32"
+ fi
+
IMG=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.hddimg
- mkdosfs -n ${BOOTIMG_VOLUME_ID} -S 512 -C ${IMG} ${BLOCKS}
+ mkdosfs ${FATSIZE} -n ${BOOTIMG_VOLUME_ID} -S 512 -C ${IMG} ${BLOCKS}
# Copy HDDDIR recursively into the image file directly
mcopy -i ${IMG} -s ${HDDDIR}/* ::/
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 2/7] Revert "initrdscripts: fix udevd in the live boot init scripts"
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
2013-01-07 11:09 ` [PATCH 1/7] bootimg: Use FAT 32 for images larger than 512MB Ross Burton
@ 2013-01-07 11:09 ` Ross Burton
2013-01-07 11:09 ` [PATCH 3/7] libnss-mdns: fix mDNS resolving speed Ross Burton
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:09 UTC (permalink / raw)
To: openembedded-core
This cherry-pick slipped through testing and lead to unbootable hddimg images.
This reverts commit 0140519ba15bfb27ccbfb3d41c7e678a1118fc5c.
[ YOCTO #3634 ]
Signed-off-by: Ross Burton <ross.burton@intel.com>
---
meta/recipes-core/initrdscripts/files/init-live.sh | 4 +---
meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb | 2 +-
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/meta/recipes-core/initrdscripts/files/init-live.sh b/meta/recipes-core/initrdscripts/files/init-live.sh
index c591f0d..5682fd1 100644
--- a/meta/recipes-core/initrdscripts/files/init-live.sh
+++ b/meta/recipes-core/initrdscripts/files/init-live.sh
@@ -14,14 +14,12 @@ early_setup() {
mkdir -p /sys
mount -t proc proc /proc
mount -t sysfs sysfs /sys
- mount -t devtmpfs none /dev
# support modular kernel
modprobe isofs 2> /dev/null
mkdir -p /run
- mkdir -p /var/run
- /lib/udev/udevd --daemon
+ udevd --daemon
udevadm trigger --action=add
}
diff --git a/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb b/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
index 55a8600..a41b66b 100644
--- a/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
+++ b/meta/recipes-core/initrdscripts/initramfs-live-boot_1.0.bb
@@ -5,7 +5,7 @@ RDEPENDS = "udev"
DEPENDS = "virtual/kernel"
SRC_URI = "file://init-live.sh"
-PR = "r11"
+PR = "r12"
do_compile() {
#if grep -q "CONFIG_UNION_FS=y" ${STAGING_KERNEL_DIR}/.config; then
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 3/7] libnss-mdns: fix mDNS resolving speed
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
2013-01-07 11:09 ` [PATCH 1/7] bootimg: Use FAT 32 for images larger than 512MB Ross Burton
2013-01-07 11:09 ` [PATCH 2/7] Revert "initrdscripts: fix udevd in the live boot init scripts" Ross Burton
@ 2013-01-07 11:09 ` Ross Burton
2013-01-07 11:09 ` [PATCH 4/7] cups: CVE-2012-5519 Ross Burton
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:09 UTC (permalink / raw)
To: openembedded-core
From: Constantin Musca <constantinx.musca@intel.com>
We need to fix the "hosts: files dns mdns4" nsswitch.conf line
because for a .local lookup it does a DNS lookup first which will fail.
The recommended solution is:
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
[YOCTO #2502]
(From OE-Core rev: dbb350b90417962f2da4c1064ab0174badeb0f26)
Signed-off-by: Constantin Musca <constantinx.musca@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../recipes-connectivity/libnss-mdns/libnss-mdns_0.10.bb | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.10.bb b/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.10.bb
index a1f2f9a..f7356e4 100644
--- a/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.10.bb
+++ b/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.10.bb
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2d5025d4aa3495befef8f17206a5b0a1"
DEPENDS = "avahi"
RDEPENDS_${PN} = "avahi-daemon"
-PR = "r5"
+PR = "r6"
SRC_URI = "http://0pointer.de/lennart/projects/nss-mdns/nss-mdns-${PV}.tar.gz"
@@ -24,13 +24,13 @@ DEBIANNAME_${PN} = "libnss-mdns"
EXTRA_OECONF = "--libdir=${base_libdir} --disable-lynx --enable-avahi"
pkg_postinst_${PN} () {
-if ! grep -q '^hosts:.*\<mdns4\>' $D/etc/nsswitch.conf; then
- sed -e 's/^hosts:.*/& mdns4/' -i $D/etc/nsswitch.conf
-fi
+ sed -e '/^hosts:/s/\s*\<mdns4\>//' \
+ -e 's/\(^hosts:.*\)\(\<files\>\)\(.*\)\(\<dns\>\)\(.*\)/\1\2 mdns4_minimal [NOTFOUND=return]\3\4 mdns4\5/' \
+ -i $D/etc/nsswitch.conf
}
pkg_prerm_${PN} () {
-if grep -q '^hosts:.*\<mdns4\>' /etc/nsswitch.conf; then
- sed -e '/^hosts:/s/\s\<mdns4\>//' -i /etc/nsswitch.conf
-fi
+ sed -e '/^hosts:/s/\s*\<mdns4\>//' \
+ -e '/^hosts:/s/\s*mdns4_minimal\s\+\[NOTFOUND=return\]//' \
+ -i /etc/nsswitch.conf
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 4/7] cups: CVE-2012-5519
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
` (2 preceding siblings ...)
2013-01-07 11:09 ` [PATCH 3/7] libnss-mdns: fix mDNS resolving speed Ross Burton
@ 2013-01-07 11:09 ` Ross Burton
2013-01-07 11:10 ` [PATCH 5/7] cups - CVE-2011-2896 Ross Burton
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:09 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
lpadmin to (limited) root privilege escalation
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5519
http://www.cups.org/strfiles/4223/str4223v2-1.4.4-debian.patch
[YOCTO #3579]
[ CQID: WIND00392016 ]
Upstream-Status: Backport
(From OE-Core rev: 9f6964b489ef3e0f175bf33a94ab819408875da8)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../cups/cups-1.4.6/cups-CVE-2012-5519.patch | 2965 ++++++++++++++++++++
meta/recipes-extended/cups/cups_1.4.6.bb | 3 +-
2 files changed, 2967 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2012-5519.patch
diff --git a/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2012-5519.patch b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2012-5519.patch
new file mode 100644
index 0000000..6b2887a
--- /dev/null
+++ b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2012-5519.patch
@@ -0,0 +1,2965 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## DP: Description: Move file, directory, user, and group configuration to a
+## DP: separate file. Also warn about directives that have moved and set
+## DP: default cups-files.conf.
+## DP:
+## DP: Author: Michael Sweet <msweet@apple.com>
+## DP: Origin: http://svn.cups.org/public/cups/branches/branch-1.6@10710
+## DP: Origin: http://svn.cups.org/public/cups/branches/branch-1.6@10713
+## DP:
+## DP: Author: Marc Deslauriers <marc.deslauriers@canonical.com>
+## DP: Author: Tim Waugh <twaugh@redhat.com>
+## DP:
+## DP: Bug-Upstream: https://www.cups.org/str.php?L4223
+## DP: Bug-Debian: http://bugs.debian.org/692791
+## DP: Bug-CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5519
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/conf/Makefile cups/conf/Makefile
+--- cups~/conf/Makefile 2012-12-08 00:29:09.000000000 +0100
++++ cups/conf/Makefile 2012-12-08 00:29:10.000000000 +0100
+@@ -19,7 +19,7 @@
+ # Config files...
+ #
+
+-KEEP = cupsd.conf snmp.conf
++KEEP = cups-files.conf cupsd.conf snmp.conf
+ REPLACE = mime.convs mime.types
+
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/conf/cups-files.conf.in cups/conf/cups-files.conf.in
+--- cups~/conf/cups-files.conf.in 1970-01-01 01:00:00.000000000 +0100
++++ cups/conf/cups-files.conf.in 2012-12-08 00:29:10.000000000 +0100
+@@ -0,0 +1,98 @@
++#
++# "$Id$"
++#
++# Sample file/directory/user/group configuration file for the CUPS scheduler.
++# See "man cups-files.conf" for a complete description of this file.
++#
++
++# List of events that are considered fatal errors for the scheduler...
++#FatalErrors @CUPS_FATAL_ERRORS@
++
++# Default user and group for filters/backends/helper programs; this cannot be
++# any user or group that resolves to ID 0 for security reasons...
++#User @CUPS_USER@
++#Group @CUPS_GROUP@
++
++# Administrator user group, used to match @SYSTEM in cupsd.conf policy rules...
++SystemGroup @CUPS_SYSTEM_GROUPS@
++@CUPS_SYSTEM_AUTHKEY@
++
++# User that is substituted for unauthenticated (remote) root accesses...
++#RemoteRoot remroot
++
++# Do we allow file: device URIs other than to /dev/null?
++#FileDevice No
++
++# Permissions for configuration and log files...
++#ConfigFilePerm @CUPS_CONFIG_FILE_PERM@
++#LogFilePerm @CUPS_LOG_FILE_PERM@
++
++# Location of the file logging all access to the scheduler; may be the name
++# "syslog". If not an absolute path, the value of ServerRoot is used as the
++# root directory. Also see the "AccessLogLevel" directive in cupsd.conf.
++AccessLog @CUPS_LOGDIR@/access_log
++
++# Location of cache files used by the scheduler...
++#CacheDir @CUPS_CACHEDIR@
++
++# Location of data files used by the scheduler...
++#DataDir @CUPS_DATADIR@
++
++# Location of the static web content served by the scheduler...
++#DocumentRoot @CUPS_DOCROOT@
++
++# Location of the file logging all messages produced by the scheduler and any
++# helper programs; may be the name "syslog". If not an absolute path, the value
++# of ServerRoot is used as the root directory. Also see the "LogLevel"
++# directive in cupsd.conf.
++ErrorLog @CUPS_LOGDIR@/error_log
++
++# Location of fonts used by older print filters...
++#FontPath @CUPS_FONTPATH@
++
++# Location of LPD configuration
++#LPDConfigFile @CUPS_DEFAULT_LPD_CONFIG_FILE@
++
++# Location of the file logging all pages printed by the scheduler and any
++# helper programs; may be the name "syslog". If not an absolute path, the value
++# of ServerRoot is used as the root directory. Also see the "PageLogFormat"
++# directive in cupsd.conf.
++PageLog @CUPS_LOGDIR@/page_log
++
++# Location of the file listing all of the local printers...
++#Printcap @CUPS_DEFAULT_PRINTCAP@
++
++# Format of the Printcap file...
++#PrintcapFormat bsd
++#PrintcapFormat plist
++#PrintcapFormat solaris
++
++# Location of all spool files...
++#RequestRoot @CUPS_REQUESTS@
++
++# Location of helper programs...
++#ServerBin @CUPS_SERVERBIN@
++
++# SSL/TLS certificate for the scheduler...
++#ServerCertificate @CUPS_SERVERCERT@
++
++# SSL/TLS private key for the scheduler...
++#ServerKey @CUPS_SERVERKEY@
++
++# Location of other configuration files...
++#ServerRoot @CUPS_SERVERROOT@
++
++# Location of Samba configuration file...
++#SMBConfigFile @CUPS_DEFAULT_SMB_CONFIG_FILE@
++
++# Location of scheduler state files...
++#StateDir @CUPS_STATEDIR@
++
++# Location of scheduler/helper temporary files. This directory is emptied on
++# scheduler startup and cannot be one of the standard (public) temporary
++# directory locations for security reasons...
++#TempDir @CUPS_REQUESTS@/tmp
++
++#
++# End of "$Id$".
++#
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/conf/cupsd.conf.in cups/conf/cupsd.conf.in
+--- cups~/conf/cupsd.conf.in 2012-12-08 00:29:09.000000000 +0100
++++ cups/conf/cupsd.conf.in 2012-12-08 00:29:10.000000000 +0100
+@@ -13,10 +13,6 @@
+ # LogLevel debug2 gets usable now
+ MaxLogSize 0
+
+-# Administrator user group...
+-SystemGroup @CUPS_SYSTEM_GROUPS@
+-@CUPS_SYSTEM_AUTHKEY@
+-
+ # Only listen for connections from the local machine.
+ Listen localhost:@DEFAULT_IPP_PORT@
+ @CUPS_LISTEN_DOMAINSOCKET@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/config-scripts/cups-defaults.m4 cups/config-scripts/cups-defaults.m4
+--- cups~/config-scripts/cups-defaults.m4 2012-12-07 13:00:47.000000000 +0100
++++ cups/config-scripts/cups-defaults.m4 2012-12-08 00:29:10.000000000 +0100
+@@ -353,6 +353,7 @@
+ fi
+
+ AC_DEFINE_UNQUOTED(CUPS_DEFAULT_LPD_CONFIG_FILE, "$CUPS_DEFAULT_LPD_CONFIG_FILE")
++AC_SUBST(CUPS_DEFAULT_LPD_CONFIG_FILE)
+
+ dnl Default SMB config file...
+ AC_ARG_WITH(smbconfigfile, [ --with-smbconfigfile set default SMBConfigFile URI],
+@@ -374,6 +375,7 @@
+ fi
+
+ AC_DEFINE_UNQUOTED(CUPS_DEFAULT_SMB_CONFIG_FILE, "$CUPS_DEFAULT_SMB_CONFIG_FILE")
++AC_SUBST(CUPS_DEFAULT_SMB_CONFIG_FILE)
+
+ dnl Default MaxCopies value...
+ AC_ARG_WITH(max-copies, [ --with-max-copies set default max copies value, default=9999 ],
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/config-scripts/cups-ssl.m4 cups/config-scripts/cups-ssl.m4
+--- cups~/config-scripts/cups-ssl.m4 2012-12-07 13:00:47.000000000 +0100
++++ cups/config-scripts/cups-ssl.m4 2012-12-08 00:29:10.000000000 +0100
+@@ -27,6 +27,8 @@
+ SSLFLAGS=""
+ SSLLIBS=""
+ have_ssl=0
++CUPS_SERVERCERT=""
++CUPS_SERVERKEY=""
+
+ if test x$enable_ssl != xno; then
+ dnl Look for CDSA...
+@@ -36,6 +38,7 @@
+ have_ssl=1
+ AC_DEFINE(HAVE_SSL)
+ AC_DEFINE(HAVE_CDSASSL)
++ CUPS_SERVERCERT="/Library/Keychains/System.keychain"
+
+ dnl Check for the various security headers...
+ AC_CHECK_HEADER(Security/SecPolicy.h,
+@@ -85,6 +88,9 @@
+ fi
+
+ if test $have_ssl = 1; then
++ CUPS_SERVERCERT="ssl/server.crt"
++ CUPS_SERVERKEY="ssl/server.key"
++
+ if $PKGCONFIG --exists gcrypt; then
+ SSLLIBS="$SSLLIBS `$PKGCONFIG --libs gcrypt`"
+ SSLFLAGS="$SSLFLAGS `$PKGCONFIG --cflags gcrypt`"
+@@ -122,6 +128,9 @@
+ $libcrypto)
+
+ if test "x${SSLLIBS}" != "x"; then
++ CUPS_SERVERCERT="ssl/server.crt"
++ CUPS_SERVERKEY="ssl/server.key"
++
+ break
+ fi
+ done
+@@ -135,6 +144,8 @@
+ AC_MSG_RESULT([ Using SSLFLAGS="$SSLFLAGS"])
+ fi
+
++AC_SUBST(CUPS_SERVERCERT)
++AC_SUBST(CUPS_SERVERKEY)
+ AC_SUBST(SSLFLAGS)
+ AC_SUBST(SSLLIBS)
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/configure.in cups/configure.in
+--- cups~/configure.in 2012-12-07 13:00:47.000000000 +0100
++++ cups/configure.in 2012-12-08 00:29:10.000000000 +0100
+@@ -63,14 +63,14 @@
+ AC_SUBST(UNINSTALL_LANGUAGES)
+
+ AC_OUTPUT(Makedefs packaging/cups.list init/cups.sh init/cups-lpd cups-config
+- conf/cupsd.conf conf/mime.convs conf/pam.std conf/snmp.conf
++ conf/cups-files.conf conf/cupsd.conf conf/mime.convs conf/pam.std conf/snmp.conf
+ data/testprint
+ desktop/cups.desktop
+ doc/index.html doc/help/ref-cupsd-conf.html doc/help/standard.html
+ init/org.cups.cups-lpd.plist init/cups.xml
+ man/client.conf.man man/cups-deviced.man man/cups-driverd.man
+ man/cups-lpd.man man/cupsaddsmb.man man/cupsd.man
+- man/cupsd.conf.man man/lpoptions.man
++ man/cups-files.conf.man man/cupsd.conf.man man/lpoptions.man
+ templates/header.tmpl
+ $LANGFILES)
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/doc/help/ref-cups-files-conf.html.in cups/doc/help/ref-cups-files-conf.html.in
+--- cups~/doc/help/ref-cups-files-conf.html.in 1970-01-01 01:00:00.000000000 +0100
++++ cups/doc/help/ref-cups-files-conf.html.in 2012-12-08 00:29:10.000000000 +0100
+@@ -0,0 +1,531 @@
++<HTML>
++<!-- SECTION: References -->
++<HEAD>
++ <TITLE>cups-files.conf</TITLE>
++ <LINK REL="STYLESHEET" TYPE="text/css" HREF="../cups-printable.css">
++</HEAD>
++<BODY>
++
++<H1 CLASS="title">cups-files.conf</H1>
++
++<P>The <VAR>/etc/cups/cups-files.conf</VAR> file contains configuration <I>directives</I> that control the files, directories. users. and groups that are used by the CUPS scheduler, <CODE>cupsd(8)</CODE>. Each directive is listed on a line by itself followed by its value. Comments are introduced using the number sign ("#") character at the beginning of a line.</P>
++
++<H2 CLASS="title"><A NAME="AccessLog">AccessLog</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++AccessLog /var/log/cups/access_log
++AccessLog /var/log/cups/access_log-%s
++AccessLog syslog
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>AccessLog</CODE> directive sets the name of the
++access log file. If the filename is not absolute then it is
++assumed to be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++access log file is stored in "common log format" and can be used
++by any web access reporting tool to generate a report on CUPS
++server activity.</P>
++
++<P>The server name can be included in the filename by using
++<CODE>%s</CODE> in the name.</P>
++
++<P>The special name "syslog" can be used to send the access
++information to the system log instead of a plain file.</P>
++
++<P>The default access log file is
++<VAR>@CUPS_LOGDIR@/access_log</VAR>.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.15</SPAN><A NAME="ConfigFilePerm">ConfigFilePerm</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ConfigFilePerm 0644
++ConfigFilePerm 0640
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ConfigFilePerm</CODE> directive specifies the permissions to use when the scheduler writes configuration and cache files, typically in response to IPP or HTTP requests. The default is @CUPS_CONFIG_FILE_PERM@.</P>
++
++<BLOCKQUOTE><B>Note:</B>
++
++<P>The permissions for the <VAR>printers.conf</VAR> file are always masked to only allow access from the scheduler user (typically root). This is done because printer device URIs sometimes contain sensitive authentication information that should not be generally known on the system. There is no way to disable this security feature.</P>
++
++</BLOCKQUOTE>
++
++
++<H2 CLASS="title"><A NAME="DataDir">DataDir</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++DataDir /usr/share/cups
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>DataDir</CODE> directive sets the directory to use
++for data files.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.2/OS X 10.5</SPAN><A NAME="DefaultAuthType">DefaultAuthType</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++DefaultAuthType Basic
++DefaultAuthType BasicDigest
++DefaultAuthType Digest
++DefaultAuthType Negotiate
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>DefaultAuthType</CODE> directive specifies the type
++of authentication to use for IPP operations that require a
++username. The default is <CODE>Basic</CODE>.</P>
++
++
++<H2 CLASS="title"><A NAME="DocumentRoot">DocumentRoot</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++DocumentRoot /usr/share/doc/cups
++DocumentRoot /foo/bar/doc/cups
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>DocumentRoot</CODE> directive specifies the location
++of web content for the HTTP server in CUPS. If an absolute path
++is not specified then it is assumed to be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++default directory is <VAR>@CUPS_DOCROOT@</VAR>.</P>
++
++<P>Documents are first looked up in a sub-directory for the
++primary language requested by the client (e.g.
++<VAR>@CUPS_DOCROOT@/fr/...</VAR>) and then directly under
++the <CODE>DocumentRoot</CODE> directory (e.g.
++<VAR>@CUPS_DOCROOT@/...</VAR>), so it is possible to
++localize the web content by providing subdirectories for each
++language needed.</P>
++
++
++<H2 CLASS="title"><A NAME="ErrorLog">ErrorLog</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ErrorLog /var/log/cups/error_log
++ErrorLog /var/log/cups/error_log-%s
++ErrorLog syslog
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ErrorLog</CODE> directive sets the name of the error
++log file. If the filename is not absolute then it is assumed to
++be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++default error log file is <VAR>@CUPS_LOGDIR@/error_log</VAR>.</P>
++
++<P>The server name can be included in the filename by using
++<CODE>%s</CODE> in the name.</P>
++
++<P>The special name "syslog" can be used to send the error
++information to the system log instead of a plain file.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.4/OS X 10.6</SPAN><A NAME="FatalErrors">FatalErrors</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++FatalErrors none
++FatalErrors all
++FatalErrors browse
++FatalErrors config
++FatalErrors listen
++FatalErrors log
++FatalErrors permissions
++FatalErrors all -permissions
++FatalErrors config permissions log
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>FatalErrors</CODE> directive determines whether certain kinds of
++errors are fatal. The following kinds of errors are currently recognized:</P>
++
++<UL>
++
++ <LI><CODE>none</CODE> - No errors are fatal</LI>
++
++ <LI><CODE>all</CODE> - All of the errors below are fatal</LI>
++
++ <LI><CODE>browse</CODE> - Browsing initialization errors are fatal,
++ for example failed binding to the CUPS browse port or failed connections
++ to LDAP servers</LI>
++
++ <LI><CODE>config</CODE> - Configuration file syntax errors are
++ fatal</LI>
++
++ <LI><CODE>listen</CODE> - Listen or Port errors are fatal, except for
++ IPv6 failures on the loopback or "any" addresses</LI>
++
++ <LI><CODE>log</CODE> - Log file creation or write errors are fatal</LI>
++
++ <LI><CODE>permissions</CODE> - Bad startup file permissions are
++ fatal, for example shared SSL certificate and key files with world-
++ read permissions</LI>
++
++</UL>
++
++<P>Multiple errors can be listed, and the form "-kind" can be used with
++<CODE>all</CODE> to remove specific kinds of errors. The default setting is
++<CODE>@CUPS_FATAL_ERRORS@</CODE>.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.18</SPAN><A NAME="FileDevice">FileDevice</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++FileDevice Yes
++FileDevice No
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>FileDevice</CODE> directive determines whether the
++scheduler allows new printers to be added using device URIs of
++the form <CODE>file:/filename</CODE>. File devices are most often
++used to test new printer drivers and do not support raw file
++printing.</P>
++
++<P>The default setting is <CODE>No</CODE>.</P>
++
++<BLOCKQUOTE><B>Note:</B>
++
++<P>File devices are managed by the scheduler. Since the
++scheduler normally runs as the root user, file devices
++can be used to overwrite system files and potentially
++gain unauthorized access to the system. If you must
++create printers using file devices, we recommend that
++you set the <CODE>FileDevice</CODE> directive to
++<CODE>Yes</CODE> for only as long as you need to add the
++printers to the system, and then reset the directive to
++<CODE>No</CODE>.</P>
++
++</BLOCKQUOTE>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.3</SPAN><A NAME="FontPath">FontPath</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++FontPath /foo/bar/fonts
++FontPath /usr/share/cups/fonts:/foo/bar/fonts
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>FontPath</CODE> directive specifies the font path to
++use when searching for fonts. The default font path is
++<CODE>/usr/share/cups/fonts</CODE>.</P>
++
++
++<H2 CLASS="title"><A NAME="Group">Group</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++Group lp
++Group nobody
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>Group</CODE> directive specifies the UNIX group that
++filter and CGI programs run as. The default group is
++system-specific but is usually <CODE>lp</CODE> or
++<CODE>nobody</CODE>.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.15</SPAN><A NAME="LogFilePerm">LogFilePerm</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++LogFilePerm 0644
++LogFilePerm 0600
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>LogFilePerm</CODE> directive specifies the
++permissions to use when writing log files. The default
++is @CUPS_LOG_FILE_PERM@.</P>
++
++
++<H2 CLASS="title"><A NAME="PageLog">PageLog</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++PageLog /var/log/cups/page_log
++PageLog /var/log/cups/page_log-%s
++PageLog syslog
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>PageLog</CODE> directive sets the name of the page
++log file. If the filename is not absolute then it is assumed to
++be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++default page log file is <VAR>@CUPS_LOGDIR@/page_log</VAR>.</P>
++
++<P>The server name can be included in the filename by using
++<CODE>%s</CODE> in the name.</P>
++
++<P>The special name "syslog" can be used to send the page
++information to the system log instead of a plain file.</P>
++
++
++<H2 CLASS="title"><A NAME="Printcap">Printcap</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++Printcap
++Printcap /etc/printcap
++Printcap /etc/printers.conf
++Printcap /Library/Preferences/org.cups.printers.plist
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>Printcap</CODE> directive controls whether or not a
++printcap file is automatically generated and updated with a list
++of available printers. If specified with no value, then no
++printcap file will be generated. The default is to generate a
++file named <VAR>@CUPS_DEFAULT_PRINTCAP@</VAR>.</P>
++
++<P>When a filename is specified (e.g. <VAR>@CUPS_DEFAULT_PRINTCAP@</VAR>),
++the printcap file is written whenever a printer is added or
++removed. The printcap file can then be used by applications that
++are hardcoded to look at the printcap file for the available
++printers.</P>
++
++
++<H2 CLASS="title"><A NAME="PrintcapFormat">PrintcapFormat</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++PrintcapFormat BSD
++PrintcapFormat Solaris
++PrintcapFormat plist
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>PrintcapFormat</CODE> directive controls the output format of the
++printcap file. The default is to generate the plist format on OS X, the
++Solaris format on Solaris, and the BSD format on other operating systems.</P>
++
++
++<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.3</SPAN><A NAME="RemoteRoot">RemoteRoot</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++RemoteRoot remroot
++RemoteRoot root
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>RemoteRoot</CODE> directive sets the username for
++unauthenticated root requests from remote hosts. The default
++username is <VAR>remroot</VAR>. Setting <CODE>RemoteRoot</CODE>
++to <VAR>root</VAR> effectively disables this security
++mechanism.</P>
++
++
++<H2 CLASS="title"><A NAME="RequestRoot">RequestRoot</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++RequestRoot /var/spool/cups
++RequestRoot /foo/bar/spool/cups
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>RequestRoot</CODE> directive sets the directory for
++incoming IPP requests and HTML forms. If an absolute path is not
++provided then it is assumed to be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++default request directory is <VAR>@CUPS_REQUESTS@</VAR>.</P>
++
++
++<H2 CLASS="title"><A NAME="ServerBin">ServerBin</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ServerBin /usr/lib/cups
++ServerBin /foo/bar/lib/cups
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ServerBin</CODE> directive sets the directory for
++server-run executables. If an absolute path is not provided then
++it is assumed to be relative to the <A
++HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
++default executable directory is <VAR>/usr/lib/cups</VAR>,
++<VAR>/usr/lib32/cups</VAR>, or <VAR>/usr/libexec/cups</VAR>
++depending on the operating system.</P>
++
++
++<H2 CLASS="title"><A NAME="ServerCertificate">ServerCertificate</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ServerCertificate /etc/cups/ssl/server.crt
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ServerCertificate</CODE> directive specifies the
++location of the SSL certificate file used by the server when
++negotiating encrypted connections. The certificate must not be
++encrypted (password protected) since the scheduler normally runs
++in the background and will be unable to ask for a password.</P>
++
++<P>The default certificate file is
++<VAR>/etc/cups/ssl/server.crt</VAR>.</P>
++
++
++<H2 CLASS="title"><A NAME="ServerKey">ServerKey</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ServerKey /etc/cups/ssl/server.key
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ServerKey</CODE> directive specifies the location of
++the SSL private key file used by the server when negotiating
++encrypted connections.</P>
++
++<P>The default key file is
++<VAR>/etc/cups/ssl/server.crt</VAR>.</P>
++
++
++<H2 CLASS="title"><A NAME="ServerRoot">ServerRoot</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++ServerRoot /etc/cups
++ServerRoot /foo/bar/cups
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>ServerRoot</CODE> directive specifies the absolute
++path to the server configuration and state files. It is also used
++to resolve relative paths in the <VAR>cupsd.conf</VAR> file. The
++default server directory is <VAR>/etc/cups</VAR>.</P>
++
++
++<H2 CLASS="title"><A NAME="SystemGroup">SystemGroup</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++SystemGroup lpadmin
++SystemGroup sys
++SystemGroup system
++SystemGroup root
++SystemGroup root lpadmin
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>SystemGroup</CODE> directive specifies the system
++administration group for <CODE>System</CODE> authentication.
++Multiple groups can be listed, separated with spaces. The default
++group list is <CODE>@CUPS_SYSTEM_GROUPS@</CODE>.</P>
++
++
++<H2 CLASS="title"><A NAME="TempDir">TempDir</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++TempDir /var/tmp
++TempDir /foo/bar/tmp
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>TempDir</CODE> directive specifies an absolute path
++for the directory to use for temporary files. The default
++directory is <VAR>@CUPS_REQUESTS@/tmp</VAR>.</P>
++
++<P>Temporary directories must be world-writable and should have
++the "sticky" permission bit enabled so that other users cannot
++delete filter temporary files. The following commands will create
++an appropriate temporary directory called
++<VAR>/foo/bar/tmp</VAR>:</P>
++
++<PRE CLASS="command">
++<KBD>mkdir /foo/bar/tmp</KBD>
++<KBD>chmod a+rwxt /foo/bar/tmp</KBD>
++</PRE>
++
++
++<H2 CLASS="title"><A NAME="User">User</A></H2>
++
++<H3>Examples</H3>
++
++<PRE CLASS="command">
++User lp
++User guest
++</PRE>
++
++<H3>Description</H3>
++
++<P>The <CODE>User</CODE> directive specifies the UNIX user that
++filter and CGI programs run as. The default user is
++<CODE>@CUPS_USER@</CODE>.</P>
++
++<BLOCKQUOTE><B>Note:</B>
++
++<P>You may not use user <CODE>root</CODE>, as that would expose
++the system to unacceptable security risks. The scheduler will
++automatically choose user <CODE>nobody</CODE> if you specify a
++user whose ID is 0.</P>
++
++</BLOCKQUOTE>
++
++
++</BODY>
++</HTML>
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/doc/help/ref-cupsd-conf.html.in cups/doc/help/ref-cupsd-conf.html.in
+--- cups~/doc/help/ref-cupsd-conf.html.in 2012-12-07 13:00:48.000000000 +0100
++++ cups/doc/help/ref-cupsd-conf.html.in 2012-12-08 00:29:10.000000000 +0100
+@@ -191,82 +191,6 @@
+ HREF="#Limit"><CODE>Limit</CODE></A> section.</P>
+
+
+-<H2 CLASS="title"><SPAN CLASS="info">Deprecated</SPAN><A NAME="AuthClass">AuthClass</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-<Location /path>
+- ...
+- AuthClass Anonymous
+- AuthClass User
+- AuthClass System
+- AuthClass Group
+-</Location>
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>AuthClass</CODE> directive defines what level of
+-authentication is required:</P>
+-
+-<UL>
+-
+- <LI><CODE>Anonymous</CODE> - No authentication should be
+- performed (default)</LI>
+-
+- <LI><CODE>User</CODE> - A valid username and password is
+- required</LI>
+-
+- <LI><CODE>System</CODE> - A valid username and password
+- is required, and the username must belong to the "sys"
+- group; this can be changed using the <A
+- HREF="#SystemGroup"><CODE>SystemGroup</CODE></A>
+- directive</LI>
+-
+- <LI><CODE>Group</CODE> - A valid username and password is
+- required, and the username must belong to the group named
+- by the <A
+- HREF="#AuthGroupName"><CODE>AuthGroupName</CODE></A>
+- directive</LI>
+-
+-</UL>
+-
+-<P>The <CODE>AuthClass</CODE> directive must appear inside a <A
+-HREF="#Location"><CODE>Location</CODE></A> or <A
+-HREF="#Limit"><CODE>Limit</CODE></A> section.</P>
+-
+-<P><B>This directive is deprecated and will be removed from a
+-future release of CUPS.</B> Consider using the more flexible <A
+-HREF="#Require"><CODE>Require</CODE></A> directive instead.</P>
+-
+-
+-<H2 CLASS="title"><SPAN CLASS="info">Deprecated</SPAN><A NAME="AuthGroupName">AuthGroupName</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-<Location /path>
+- ...
+- AuthGroupName mygroup
+- AuthGroupName lp
+-</Location>
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>AuthGroupName</CODE> directive sets the group to use
+-for <CODE>Group</CODE> authentication.</P>
+-
+-<P>The <CODE>AuthGroupName</CODE> directive must appear inside a
+-<A HREF="#Location"><CODE>Location</CODE></A> or <A
+-HREF="#Limit"><CODE>Limit</CODE></A> section.</P>
+-
+-<P><B>This directive is deprecated and will be removed from a
+-future release of CUPS.</B> Consider using the more flexible <A
+-HREF="#Require"><CODE>Require</CODE></A> directive instead.</P>
+-
+-
+ <H2 CLASS="title"><A NAME="AuthType">AuthType</A></H2>
+
+ <H3>Examples</H3>
+@@ -2494,65 +2418,6 @@
+ files as soon as each job is completed, canceled, or aborted.</P>
+
+
+-<H2 CLASS="title"><A NAME="Printcap">Printcap</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-Printcap
+-Printcap /etc/printcap
+-Printcap /etc/printers.conf
+-Printcap /Library/Preferences/org.cups.printers.plist
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>Printcap</CODE> directive controls whether or not a
+-printcap file is automatically generated and updated with a list
+-of available printers. If specified with no value, then no
+-printcap file will be generated. The default is to generate a
+-file named <VAR>@CUPS_DEFAUL_PRINTCAP@</VAR>.</P>
+-
+-<P>When a filename is specified (e.g. <VAR>@CUPS_DEFAULT_PRINTCAP@</VAR>),
+-the printcap file is written whenever a printer is added or
+-removed. The printcap file can then be used by applications that
+-are hardcoded to look at the printcap file for the available
+-printers.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="PrintcapFormat">PrintcapFormat</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-PrintcapFormat BSD
+-PrintcapFormat Solaris
+-PrintcapFormat plist
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>PrintcapFormat</CODE> directive controls the output format of the
+-printcap file. The default is to generate the plist format on Mac OS X, the
+-Solaris format on Solaris, and the BSD format on other operating systems.</P>
+-
+-
+-<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.13</SPAN><A NAME="PrintcapGUI">PrintcapGUI</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-PrintGUI /usr/bin/glpoptions
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>PrintcapGUI</CODE> directive sets the program to
+-associate with the IRIX printer GUI interface script which is
+-used by IRIX applications to display printer-specific options.
+-There is no default program.</P>
+-
+-
+ <H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.21</SPAN><A NAME="ReloadTimeout">ReloadTimeout</A></H2>
+
+ <H3>Examples</H3>
+@@ -2569,42 +2434,6 @@
+ before doing a restart. The default is 30 seconds.</P>
+
+
+-<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.3</SPAN><A NAME="RemoteRoot">RemoteRoot</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-RemoteRoot remroot
+-RemoteRoot root
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>RemoteRoot</CODE> directive sets the username for
+-unauthenticated root requests from remote hosts. The default
+-username is <VAR>remroot</VAR>. Setting <CODE>RemoteRoot</CODE>
+-to <VAR>root</VAR> effectively disables this security
+-mechanism.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="RequestRoot">RequestRoot</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-RequestRoot /var/spool/cups
+-RequestRoot /foo/bar/spool/cups
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>RequestRoot</CODE> directive sets the directory for
+-incoming IPP requests and HTML forms. If an absolute path is not
+-provided then it is assumed to be relative to the <A
+-HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
+-default request directory is <VAR>@CUPS_REQUESTS@</VAR>.</P>
+-
+-
+ <H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.7</SPAN><A NAME="Require">Require</A></H2>
+
+ <H3>Examples</H3>
+@@ -2759,64 +2588,6 @@
+ </BLOCKQUOTE>
+
+
+-<H2 CLASS="title"><A NAME="ServerBin">ServerBin</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-ServerBin /usr/lib/cups
+-ServerBin /foo/bar/lib/cups
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>ServerBin</CODE> directive sets the directory for
+-server-run executables. If an absolute path is not provided then
+-it is assumed to be relative to the <A
+-HREF="#ServerRoot"><CODE>ServerRoot</CODE></A> directory. The
+-default executable directory is <VAR>/usr/lib/cups</VAR>,
+-<VAR>/usr/lib32/cups</VAR>, or <VAR>/usr/libexec/cups</VAR>
+-depending on the operating system.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="ServerCertificate">ServerCertificate</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-ServerCertificate /etc/cups/ssl/server.crt
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>ServerCertificate</CODE> directive specifies the
+-location of the SSL certificate file used by the server when
+-negotiating encrypted connections. The certificate must not be
+-encrypted (password protected) since the scheduler normally runs
+-in the background and will be unable to ask for a password.</P>
+-
+-<P>The default certificate file is
+-<VAR>/etc/cups/ssl/server.crt</VAR>.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="ServerKey">ServerKey</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-ServerKey /etc/cups/ssl/server.key
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>ServerKey</CODE> directive specifies the location of
+-the SSL private key file used by the server when negotiating
+-encrypted connections.</P>
+-
+-<P>The default key file is
+-<VAR>/etc/cups/ssl/server.crt</VAR>.</P>
+-
+-
+ <H2 CLASS="title"><A NAME="ServerName">ServerName</A></H2>
+
+ <H3>Examples</H3>
+@@ -2833,23 +2604,6 @@
+ hostname.</P>
+
+
+-<H2 CLASS="title"><A NAME="ServerRoot">ServerRoot</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-ServerRoot /etc/cups
+-ServerRoot /foo/bar/cups
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>ServerRoot</CODE> directive specifies the absolute
+-path to the server configuration and state files. It is also used
+-to resolve relative paths in the <VAR>cupsd.conf</VAR> file. The
+-default server directory is <VAR>/etc/cups</VAR>.</P>
+-
+-
+ <H2 CLASS="title"><SPAN CLASS="info">CUPS 1.1.21</SPAN><A NAME="ServerTokens">ServerTokens</A></H2>
+
+ <H3>Examples</H3>
+@@ -2985,53 +2739,6 @@
+ can be specified to listen on multiple ports.</P>
+
+
+-<H2 CLASS="title"><A NAME="SystemGroup">SystemGroup</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-SystemGroup lpadmin
+-SystemGroup sys
+-SystemGroup system
+-SystemGroup root
+-SystemGroup root lpadmin
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>SystemGroup</CODE> directive specifies the system
+-administration group for <CODE>System</CODE> authentication.
+-Multiple groups can be listed, separated with spaces. The default
+-group list is <CODE>@CUPS_SYSTEM_GROUPS@</CODE>.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="TempDir">TempDir</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-TempDir /var/tmp
+-TempDir /foo/bar/tmp
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>TempDir</CODE> directive specifies an absolute path
+-for the directory to use for temporary files. The default
+-directory is <VAR>@CUPS_REQUESTS@/tmp</VAR>.</P>
+-
+-<P>Temporary directories must be world-writable and should have
+-the "sticky" permission bit enabled so that other users cannot
+-delete filter temporary files. The following commands will create
+-an appropriate temporary directory called
+-<VAR>/foo/bar/tmp</VAR>:</P>
+-
+-<PRE CLASS="command">
+-<KBD>mkdir /foo/bar/tmp</KBD>
+-<KBD>chmod a+rwxt /foo/bar/tmp</KBD>
+-</PRE>
+-
+-
+ <H2 CLASS="title"><A NAME="Timeout">Timeout</A></H2>
+
+ <H3>Examples</H3>
+@@ -3048,52 +2755,5 @@
+ default timeout is 300 seconds.</P>
+
+
+-<H2 CLASS="title"><SPAN CLASS="info">CUPS 1.2/Mac OS X 10.5</SPAN><A NAME="UseNetworkDefault">UseNetworkDefault</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-UseNetworkDefault yes
+-UseNetworkDefault no
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>UseNetworkDefault</CODE> directive controls whether
+-the client will use a network/remote printer as a default
+-printer. If enabled, the default printer of a server is used as
+-the default printer on a client. When multiple servers are
+-advertising a default printer, the client's default printer is
+-set to the first discovered printer, or to the implicit class for
+-the same printer available from multiple servers.</P>
+-
+-<P>The default is <CODE>@CUPS_USE_NETWORK_DEFAULT@</CODE>.</P>
+-
+-
+-<H2 CLASS="title"><A NAME="User">User</A></H2>
+-
+-<H3>Examples</H3>
+-
+-<PRE CLASS="command">
+-User lp
+-User guest
+-</PRE>
+-
+-<H3>Description</H3>
+-
+-<P>The <CODE>User</CODE> directive specifies the UNIX user that
+-filter and CGI programs run as. The default user is
+-<CODE>@CUPS_USER@</CODE>.</P>
+-
+-<BLOCKQUOTE><B>Note:</B>
+-
+-<P>You may not use user <CODE>root</CODE>, as that would expose
+-the system to unacceptable security risks. The scheduler will
+-automatically choose user <CODE>nobody</CODE> if you specify a
+-user whose ID is 0.</P>
+-
+-</BLOCKQUOTE>
+-
+-
+ </BODY>
+ </HTML>
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_da.po cups/locale/cups_da.po
+--- cups~/locale/cups_da.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_da.po 2012-12-08 01:01:31.675672771 +0100
+@@ -2881,10 +2881,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Arkivets enheds-URI'er er blevet slået fra! Du slår det til ved at se i "
+-"FileDevice-direktivet i \"%s/cupsd.conf\"."
++"FileDevice-direktivet i \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "8,5 x 13\""
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_de.po cups/locale/cups_de.po
+--- cups~/locale/cups_de.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_de.po 2012-12-08 00:56:57.515682472 +0100
+@@ -2909,10 +2909,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Dateigeräte-URIs wurden deaktiviert! Infos zum Aktivieren finden Sie im "
+-"FileDevice-Verzeichnis unter „%s/cupsd.conf“."
++"FileDevice-Verzeichnis unter „%s/cups-files.conf“."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_es.po cups/locale/cups_es.po
+--- cups~/locale/cups_es.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_es.po 2012-12-08 00:57:31.903681255 +0100
+@@ -2941,10 +2941,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Los URIs del dispositivo de archivo han sido deshabilitados. Para "
+-"habilitarlos, vea la directiva FileDevice en \"%s/cupsd.conf\"."
++"habilitarlos, vea la directiva FileDevice en \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_eu.po cups/locale/cups_eu.po
+--- cups~/locale/cups_eu.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_eu.po 2012-12-08 00:58:35.175679014 +0100
+@@ -3793,10 +3793,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Fitxategiaren gailuaren URIak desgaitu egin dira. Gaitzeko, ikus FileDevice "
+-"direktiba \"%s/cupsd.conf\" fitxategian."
++"direktiba \"%s/cups-files.conf\" fitxategian."
+
+ #: ppdc/sample.c:92
+ msgid "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_fi.po cups/locale/cups_fi.po
+--- cups~/locale/cups_fi.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_fi.po 2012-12-08 01:02:01.039671731 +0100
+@@ -2886,10 +2886,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Tiedostolaitteiden osoitteet on poistettu käytöstä! Voit ottaa ne käyttöön ”%"
+-"s/cupsd.conf”-tiedoston FileDevice-säännöllä."
++"s/cups-files.conf”-tiedoston FileDevice-säännöllä."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_fr.po cups/locale/cups_fr.po
+--- cups~/locale/cups_fr.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_fr.po 2012-12-08 01:03:03.287669533 +0100
+@@ -2925,10 +2925,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Les URI des périphériques de fichier ont été désactivés. Pour l’activer, "
+-"reportez-vous à la directive FileDevice dans « %s/cupsd.conf »."
++"reportez-vous à la directive FileDevice dans « %s/cups-files.conf »."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_id.po cups/locale/cups_id.po
+--- cups~/locale/cups_id.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_id.po 2012-12-08 01:03:26.919668695 +0100
+@@ -3712,10 +3712,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Berkas URI perangkat telah dinonaktifkan! Untuk mengaktifkannya, lihatlah "
+-"petunjuk FileDevice dalam \"%s/cupsd.conf\"."
++"petunjuk FileDevice dalam \"%s/cups-files.conf\"."
+
+ #: ppdc/sample.c:92
+ msgid "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_it.po cups/locale/cups_it.po
+--- cups~/locale/cups_it.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_it.po 2012-12-08 01:04:46.011665881 +0100
+@@ -2819,8 +2819,8 @@
+ msgstr "Cartella documento: 9/16 x 3 7/16\""
+
+ #, c-format
+-msgid "File device URIs have been disabled! To enable, see the FileDevice directive in \"%s/cupsd.conf\"."
+-msgstr "Gli URI del dispositivo documento sono stati disabilitati! Per abilitarli, consulta l'istruzione del FileDevice in \"%s/cupsd.conf\"."
++msgid "File device URIs have been disabled! To enable, see the FileDevice directive in \"%s/cups-files.conf\"."
++msgstr "Gli URI del dispositivo documento sono stati disabilitati! Per abilitarli, consulta l'istruzione del FileDevice in \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Foglio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_ja.po cups/locale/cups_ja.po
+--- cups~/locale/cups_ja.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_ja.po 2012-12-08 01:05:34.883664166 +0100
+@@ -2867,8 +2867,8 @@
+ msgstr "ファイルフォルダー - 9/16 x 3 7/16\""
+
+ #, c-format
+-msgid "File device URIs have been disabled! To enable, see the FileDevice directive in \"%s/cupsd.conf\"."
+-msgstr "ファイルデバイス URI は無効になっています! 有効にするには、\"%s/cupsd.conf\" の FileDevice ディレクティブを参照してください。"
++msgid "File device URIs have been disabled! To enable, see the FileDevice directive in \"%s/cups-files.conf\"."
++msgstr "ファイルデバイス URI は無効になっています! 有効にするには、\"%s/cups-files.conf\" の FileDevice ディレクティブを参照してください。"
+
+ msgid "Folio"
+ msgstr "フォリオ"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_ko.po cups/locale/cups_ko.po
+--- cups~/locale/cups_ko.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_ko.po 2012-12-08 01:06:35.647662090 +0100
+@@ -2866,9 +2866,9 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+-"파일 장비 URI가 비활성화되었습니다! 활성화하려면, \"%s/cupsd.conf\"에 있는 "
++"파일 장비 URI가 비활성화되었습니다! 활성화하려면, \"%s/cups-files.conf\"에 있는 "
+ "FileDevice 지시문을 보십시오."
+
+ msgid "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_nl.po cups/locale/cups_nl.po
+--- cups~/locale/cups_nl.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_nl.po 2012-12-08 01:07:07.987660903 +0100
+@@ -2910,10 +2910,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "File device-URI&aops;s zijn uitgeschakeld! Raadpleeg als u de URI&aops;s "
+-"weer wilt inschakelen de richtlijn voor FileDevice in \"%s/cupsd.conf\"."
++"weer wilt inschakelen de richtlijn voor FileDevice in \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_no.po cups/locale/cups_no.po
+--- cups~/locale/cups_no.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_no.po 2012-12-08 01:07:18.003660528 +0100
+@@ -2871,10 +2871,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Enhets-URIer for filer er deaktivert! Hvis du vil aktivere funksjonen, leser "
+-"du FileDevice-direktivet i «%s/cupsd.conf»."
++"du FileDevice-direktivet i «%s/cups-files.conf»."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_pl.po cups/locale/cups_pl.po
+--- cups~/locale/cups_pl.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_pl.po 2012-12-08 01:07:24.747660332 +0100
+@@ -2895,10 +2895,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "URI pliku urządzenia zostało wyłączone! Aby włączyć, zobacz dyrektywę "
+-"FileDevice w \"%s/cupsd.conf\"."
++"FileDevice w \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_pt.po cups/locale/cups_pt.po
+--- cups~/locale/cups_pt.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_pt.po 2012-12-08 01:07:37.875659840 +0100
+@@ -2897,10 +2897,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "URIs do periférico do ficheiro foram desactivados! Para activar, consulte a "
+-"directiva FileDevice em \"%s/cupsd.conf\"."
++"directiva FileDevice em \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Fólio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_pt_BR.po cups/locale/cups_pt_BR.po
+--- cups~/locale/cups_pt_BR.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_pt_BR.po 2012-12-08 01:07:31.707660026 +0100
+@@ -2904,10 +2904,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "URIs de dispositivo de arquivo foram desativados! Para ativá-los, consulte a "
+-"diretiva FileDevice em \"%s/cupsd.conf\"."
++"diretiva FileDevice em \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Fólio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_ru.po cups/locale/cups_ru.po
+--- cups~/locale/cups_ru.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_ru.po 2012-12-08 01:07:51.439659296 +0100
+@@ -2884,10 +2884,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "URI-адреса файлового устройства отключены! Чтобы включить их, используйте "
+-"директиву FileDevice в «%s/cupsd.conf»."
++"директиву FileDevice в «%s/cups-files.conf»."
+
+ msgid "Folio"
+ msgstr "Фолио"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_sv.po cups/locale/cups_sv.po
+--- cups~/locale/cups_sv.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_sv.po 2012-12-08 01:07:58.247659102 +0100
+@@ -2875,10 +2875,10 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+ "Filenhets URI:er har blivit avaktiverade! För att aktivera, se direktivet "
+-"FileDevice i \"%s/cupsd.conf\"."
++"FileDevice i \"%s/cups-files.conf\"."
+
+ msgid "Folio"
+ msgstr "Folio"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_zh.po cups/locale/cups_zh.po
+--- cups~/locale/cups_zh.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_zh.po 2012-12-08 01:08:56.791657022 +0100
+@@ -2844,9 +2844,9 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+-"文件设备 URI 已被停用！要启用，请参阅“%s/cupsd.conf”中的 FileDevice 指令。"
++"文件设备 URI 已被停用！要启用，请参阅“%s/cups-files.conf”中的 FileDevice 指令。"
+
+ msgid "Folio"
+ msgstr "对开本"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/locale/cups_zh_TW.po cups/locale/cups_zh_TW.po
+--- cups~/locale/cups_zh_TW.po 2012-12-07 13:00:48.000000000 +0100
++++ cups/locale/cups_zh_TW.po 2012-12-08 01:09:07.407656652 +0100
+@@ -2845,9 +2845,9 @@
+ #, c-format
+ msgid ""
+ "File device URIs have been disabled! To enable, see the FileDevice directive "
+-"in \"%s/cupsd.conf\"."
++"in \"%s/cups-files.conf\"."
+ msgstr ""
+-"已停用檔案設備 URI！若要啟用，請參閱“%s/cupsd.conf”中的 FileDevice 指示。"
++"已停用檔案設備 URI！若要啟用，請參閱“%s/cups-files.conf”中的 FileDevice 指示。"
+
+ msgid "Folio"
+ msgstr "對開紙"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/man/Makefile cups/man/Makefile
+--- cups~/man/Makefile 2012-12-08 00:29:09.000000000 +0100
++++ cups/man/Makefile 2012-12-08 00:29:10.000000000 +0100
+@@ -39,6 +39,7 @@
+ ppdpo.$(MAN1EXT)
+ MAN5 = classes.conf.$(MAN5EXT) \
+ client.conf.$(MAN5EXT) \
++ cups-files.conf.$(MAN5EXT) \
+ cups-snmp.conf.$(MAN5EXT) \
+ cupsd.conf.$(MAN5EXT) \
+ mailto.conf.$(MAN5EXT) \
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/man/cups-files.conf.man.in cups/man/cups-files.conf.man.in
+--- cups~/man/cups-files.conf.man.in 1970-01-01 01:00:00.000000000 +0100
++++ cups/man/cups-files.conf.man.in 2012-12-08 00:29:10.000000000 +0100
+@@ -0,0 +1,146 @@
++.\"
++.\" "$Id$"
++.\"
++.\" cupsd.conf man page for CUPS.
++.\"
++.\" Copyright 2007-2012 by Apple Inc.
++.\" Copyright 1997-2006 by Easy Software Products.
++.\"
++.\" These coded instructions, statements, and computer programs are the
++.\" property of Apple Inc. and are protected by Federal copyright
++.\" law. Distribution and use rights are outlined in the file "LICENSE.txt"
++.\" which should have been included with this file. If this file is
++.\" file is missing or damaged, see the license at "http://www.cups.org/".
++.\"
++.TH cups-files.conf 5 "CUPS" "19 November 2012" "Apple Inc."
++.SH NAME
++cups-files.conf \- file and directory configuration file for cups
++.SH DESCRIPTION
++The \fIcups-file.conf\fR file configures the files and directories used by the
++CUPS scheduler, \fIcupsd(8)\fR. It is normally located in the
++\fI@CUPS_SERVERROOT@\fR directory.
++.LP
++Each line in the file can be a configuration directive, a blank line,
++or a comment. Comment lines start with the # character.
++.SH DIRECTIVES
++The following directives are understood by \fIcupsd(8)\fR. Consult the
++on-line help for detailed descriptions:
++.TP 5
++AccessLog filename
++.TP 5
++AccessLog syslog
++.br
++Defines the access log filename.
++.TP 5
++ConfigFilePerm mode
++.br
++Specifies the permissions for all configuration files that the scheduler
++writes.
++.TP 5
++DataDir path
++.br
++Specified the directory where data files can be found.
++.TP 5
++DocumentRoot directory
++.br
++Specifies the root directory for the internal web server documents.
++.TP 5
++ErrorLog filename
++.TP 5
++ErrorLog syslog
++.br
++Specifies the error log filename.
++.TP 5
++FatalErrors none
++.TP 5
++FatalErrors all -kind [... -kind]
++.TP 5
++FatalErrors kind [... kind]
++.br
++Specifies which errors are fatal, causing the scheduler to exit. "Kind" is
++"browse", "config", "listen", "log", or "permissions".
++.TP 5
++FileDevice Yes
++.TP 5
++FileDevice No
++.br
++Specifies whether the file pseudo-device can be used for new
++printer queues.
++.TP 5
++FontPath directory[:directory:...]
++.br
++Specifies the search path for fonts.
++.TP 5
++Group group-name-or-number
++.br
++Specifies the group name or ID that will be used when executing
++external programs.
++.TP 5
++LogFilePerm mode
++.br
++Specifies the permissions for all log files that the scheduler writes.
++.TP 5
++PageLog filename
++.TP 5
++PageLog syslog
++.br
++Specifies the page log filename.
++.TP 5
++Printcap
++.TP 5
++Printcap filename
++.br
++Specifies the filename for a printcap file that is updated
++automatically with a list of available printers (needed for
++legacy applications); specifying Printcap with no filename
++disables printcap generation.
++.TP 5
++RemoteRoot user-name
++.br
++Specifies the username that is associated with unauthenticated root
++accesses.
++.TP 5
++RequestRoot directory
++.br
++Specifies the directory to store print jobs and other HTTP request
++data.
++.TP 5
++ServerBin directory
++.br
++Specifies the directory where backends, CGIs, daemons, and filters may
++be found.
++.TP 5
++ServerCertificate filename
++.br
++Specifies the encryption certificate to use.
++.TP 5
++ServerKey filename
++.br
++Specifies the encryption key to use.
++.TP 5
++ServerRoot directory
++.br
++Specifies the directory where the server configuration files can be found.
++.TP 5
++SystemGroup group-name [group-name ...]
++.br
++Specifies the group(s) to use for System class authentication.
++.TP 5
++TempDir directory
++.br
++Specifies the directory where temporary files are stored.
++.TP 5
++User user-name
++.br
++Specifies the user name or ID that is used when running external programs.
++.SH SEE ALSO
++\fIclasses.conf(5)\fR, \fIcupsd(8)\fR, \fIcupsd.conf(5)\fR, \fImime.convs(5)\fR,
++\fImime.types(5)\fR, \fIprinters.conf(5)\fR,
++\fIsubscriptions.conf(5)\fR,
++.br
++http://localhost:631/help
++.SH COPYRIGHT
++Copyright 2007-2012 by Apple Inc.
++.\"
++.\" End of "$Id$".
++.\"
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/man/cupsd.conf.man.in cups/man/cupsd.conf.man.in
+--- cups~/man/cupsd.conf.man.in 2012-12-07 13:00:48.000000000 +0100
++++ cups/man/cupsd.conf.man.in 2012-12-08 00:29:10.000000000 +0100
+@@ -12,13 +12,16 @@
+ .\" which should have been included with this file. If this file is
+ .\" file is missing or damaged, see the license at "http://www.cups.org/".
+ .\"
+-.TH cupsd.conf 5 "CUPS" "28 January 2010" "Apple Inc."
++.TH cupsd.conf 5 "CUPS" "19 November 2012" "Apple Inc."
+ .SH NAME
+ cupsd.conf \- server configuration file for cups
+ .SH DESCRIPTION
+ The \fIcupsd.conf\fR file configures the CUPS scheduler, \fIcupsd(8)\fR. It
+-is normally located in the \fI@CUPS_SERVERROOT@\fR directory.
+-.LP
++is normally located in the \fI@CUPS_SERVERROOT@\fR directory. \fBNote:\fR
++File, directory, and user configuration directives that used to be allowed in
++the \fIcupsd.conf\fR file are now stored in the \fIcups-files.conf(5)\fR instead
++in order to prevent certain types of privilege escalation attacks.
++LP
+ Each line in the file can be a configuration directive, a blank line,
+ or a comment. Comment lines start with the # character. The
+ configuration directives are intentionally similar to those used by the
+@@ -27,12 +30,6 @@
+ The following directives are understood by \fIcupsd(8)\fR. Consult the
+ on-line help for detailed descriptions:
+ .TP 5
+-AccessLog filename
+-.TP 5
+-AccessLog syslog
+-.br
+-Defines the access log filename.
+-.TP 5
+ AccessLogLevel config
+ .TP 5
+ AccessLogLevel actions
+@@ -61,20 +58,6 @@
+ .br
+ Allows access from the named hosts or addresses.
+ .TP 5
+-AuthClass User
+-.TP 5
+-AuthClass Group
+-.TP 5
+-AuthClass System
+-.br
+-Specifies the authentication class (User, Group, System) -
+-\fBthis directive is deprecated\fR.
+-.TP 5
+-AuthGroupName group-name
+-.br
+-Specifies the authentication group - \fBthis directive is
+-deprecated\fR.
+-.TP 5
+ AuthType None
+ .TP 5
+ AuthType Basic
+@@ -220,7 +203,7 @@
+ .TP 5
+ Browsing No
+ .br
+-Specifies whether or not remote printer browsing should be enabled.
++Specifies whether or not shared printers should be advertised.
+ .TP 5
+ Classification banner
+ .br
+@@ -233,15 +216,6 @@
+ Specifies whether to allow users to override the classification
+ of individual print jobs.
+ .TP 5
+-ConfigFilePerm mode
+-.br
+-Specifies the permissions for all configuration files that the scheduler
+-writes.
+-.TP 5
+-DataDir path
+-.br
+-Specified the directory where data files can be found.
+-.TP 5
+ DefaultAuthType Basic
+ .TP 5
+ DefaultAuthType BasicDigest
+@@ -309,10 +283,6 @@
+ causes the update to happen as soon as possible, typically within a few
+ milliseconds.
+ .TP 5
+-DocumentRoot directory
+-.br
+-Specifies the root directory for the internal web server documents.
+-.TP 5
+ Encryption IfRequested
+ .TP 5
+ Encryption Never
+@@ -322,28 +292,6 @@
+ Specifies the level of encryption that is required for a particular
+ location.
+ .TP 5
+-ErrorLog filename
+-.TP 5
+-ErrorLog syslog
+-.br
+-Specifies the error log filename.
+-.TP 5
+-FatalErrors none
+-.TP 5
+-FatalErrors all -kind [... -kind]
+-.TP 5
+-FatalErrors kind [... kind]
+-.br
+-Specifies which errors are fatal, causing the scheduler to exit. "Kind" is
+-"browse", "config", "listen", "log", or "permissions".
+-.TP 5
+-FileDevice Yes
+-.TP 5
+-FileDevice No
+-.br
+-Specifies whether the file pseudo-device can be used for new
+-printer queues.
+-.TP 5
+ FilterLimit limit
+ .br
+ Specifies the maximum cost of filters that are run concurrently.
+@@ -449,10 +397,6 @@
+ Specifies the number of debugging messages that are logged when an error
+ occurs in a print job.
+ .TP 5
+-LogFilePerm mode
+-.br
+-Specifies the permissions for all log files that the scheduler writes.
+-.TP 5
+ LogLevel alert
+ .TP 5
+ LogLevel crit
+@@ -526,12 +470,6 @@
+ .br
+ Specifies the order of HTTP access control (allow,deny or deny,allow)
+ .TP 5
+-PageLog filename
+-.TP 5
+-PageLog syslog
+-.br
+-Specifies the page log filename.
+-.TP 5
+ PageLogFormat format string
+ .br
+ Specifies the format of page log lines.
+@@ -561,15 +499,6 @@
+ Specifies whether or not to preserve the job history after they are
+ printed.
+ .TP 5
+-Printcap
+-.TP 5
+-Printcap filename
+-.br
+-Specifies the filename for a printcap file that is updated
+-automatically with a list of available printers (needed for
+-legacy applications); specifying Printcap with no filename
+-disables printcap generation.
+-.TP 5
+ PrintcapFormat bsd
+ .TP 5
+ PrintcapFormat plist
+@@ -578,29 +507,11 @@
+ .br
+ Specifies the format of the printcap file.
+ .TP 5
+-PrintcapGUI
+-.TP 5
+-PrintcapGUI gui-program-filename
+-.br
+-Specifies whether to generate option panel definition files on
+-some operating systems. When provided with no program filename,
+-disables option panel definition files.
+-.TP 5
+ ReloadTimeout seconds
+ .br
+ Specifies the amount of time to wait for job completion before
+ restarting the scheduler.
+ .TP 5
+-RemoteRoot user-name
+-.br
+-Specifies the username that is associated with unauthenticated root
+-accesses.
+-.TP 5
+-RequestRoot directory
+-.br
+-Specifies the directory to store print jobs and other HTTP request
+-data.
+-.TP 5
+ Require group group-name-list
+ .TP 5
+ Require user user-name-list
+@@ -630,27 +541,10 @@
+ Specifies an alternate name that the server is known by. The special name "*"
+ allows any name to be used.
+ .TP 5
+-ServerBin directory
+-.br
+-Specifies the directory where backends, CGIs, daemons, and filters may
+-be found.
+-.TP 5
+-ServerCertificate filename
+-.br
+-Specifies the encryption certificate to use.
+-.TP 5
+-ServerKey filename
+-.br
+-Specifies the encryption key to use.
+-.TP 5
+ ServerName hostname-or-ip-address
+ .br
+ Specifies the fully-qualified hostname of the server.
+ .TP 5
+-ServerRoot directory
+-.br
+-Specifies the directory where the server configuration files can be found.
+-.TP 5
+ ServerTokens Full
+ .TP 5
+ ServerTokens Major
+@@ -686,14 +580,6 @@
+ .br
+ Listens on the specified port for encrypted connections.
+ .TP 5
+-SystemGroup group-name [group-name ...]
+-.br
+-Specifies the group(s) to use for System class authentication.
+-.TP 5
+-TempDir directory
+-.br
+-Specifies the directory where temporary files are stored.
+-.TP 5
+ Timeout seconds
+ .br
+ Specifies the HTTP request timeout in seconds.
+@@ -702,7 +588,7 @@
+ .br
+ Specifies the user name or ID that is used when running external programs.
+ .SH SEE ALSO
+-\fIclasses.conf(5)\fR, \fIcupsd(8)\fR, \fImime.convs(5)\fR,
++\fIclasses.conf(5)\fR, \fIcups-files.conf(8)\fR, \fIcupsd(8)\fR, \fImime.convs(5)\fR,
+ \fImime.types(5)\fR, \fIprinters.conf(5)\fR,
+ \fIsubscriptions.conf(5)\fR,
+ .br
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/scheduler/client.c cups/scheduler/client.c
+--- cups~/scheduler/client.c 2012-12-08 00:29:09.000000000 +0100
++++ cups/scheduler/client.c 2012-12-08 00:29:10.000000000 +0100
+@@ -35,7 +35,7 @@
+ * get_cdsa_certificate() - Get a SSL/TLS certificate from the System
+ * keychain.
+ * get_file() - Get a filename and state info.
+- * install_conf_file() - Install a configuration file.
++ * install_cupsd_conf() - Install a configuration file.
+ * is_cgi() - Is the resource a CGI script/program?
+ * is_path_absolute() - Is a path absolute and free of relative elements
+ * (i.e. "..").
+@@ -102,7 +102,7 @@
+ #endif /* HAVE_CDSASSL */
+ static char *get_file(cupsd_client_t *con, struct stat *filestats,
+ char *filename, int len);
+-static http_status_t install_conf_file(cupsd_client_t *con);
++static http_status_t install_cupsd_conf(cupsd_client_t *con);
+ static int is_cgi(cupsd_client_t *con, const char *filename,
+ struct stat *filestats, mime_type_t *type);
+ static int is_path_absolute(const char *path);
+@@ -1691,17 +1691,14 @@
+ * Validate the resource name...
+ */
+
+- if (strncmp(con->uri, "/admin/conf/", 12) ||
+- strchr(con->uri + 12, '/') ||
+- strlen(con->uri) == 12)
++ if (strcmp(con->uri, "/admin/conf/cupsd.conf"))
+ {
+ /*
+- * PUT can only be done to configuration files under
+- * /admin/conf...
++ * PUT can only be done to the cupsd.conf file...
+ */
+
+ cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Request for subdirectory \"%s\"!", con->uri);
++ "Disallowed PUT request for \"%s\"!", con->uri);
+
+ if (!cupsdSendError(con, HTTP_FORBIDDEN, CUPSD_AUTH_NONE))
+ {
+@@ -2019,7 +2016,7 @@
+ * Install the configuration file...
+ */
+
+- status = install_conf_file(con);
++ status = install_cupsd_conf(con);
+
+ /*
+ * Return the status to the client...
+@@ -3685,11 +3682,11 @@
+
+
+ /*
+- * 'install_conf_file()' - Install a configuration file.
++ * 'install_cupsd_conf()' - Install a configuration file.
+ */
+
+ static http_status_t /* O - Status */
+-install_conf_file(cupsd_client_t *con) /* I - Connection */
++install_cupsd_conf(cupsd_client_t *con) /* I - Connection */
+ {
+ cups_file_t *in, /* Input file */
+ *out; /* Output file */
+@@ -3705,9 +3702,9 @@
+ * First construct the filenames...
+ */
+
+- snprintf(conffile, sizeof(conffile), "%s%s", ServerRoot, con->uri + 11);
+- snprintf(newfile, sizeof(newfile), "%s%s.N", ServerRoot, con->uri + 11);
+- snprintf(oldfile, sizeof(oldfile), "%s%s.O", ServerRoot, con->uri + 11);
++ snprintf(conffile, sizeof(conffile), "%s/cupsd.conf", ServerRoot);
++ snprintf(newfile, sizeof(newfile), "%s/cupsd.conf.N", ServerRoot);
++ snprintf(oldfile, sizeof(oldfile), "%s/cupsd.conf.O", ServerRoot);
+
+ cupsdLogMessage(CUPSD_LOG_INFO, "Installing config file \"%s\"...", conffile);
+
+@@ -3829,14 +3826,10 @@
+ }
+
+ /*
+- * If the cupsd.conf file was updated, set the NeedReload flag...
++ * Set the NeedReload flag...
+ */
+
+- if (!strcmp(con->uri, "/admin/conf/cupsd.conf"))
+- NeedReload = RELOAD_CUPSD;
+- else
+- NeedReload = RELOAD_ALL;
+-
++ NeedReload = RELOAD_CUPSD;
+ ReloadTime = time(NULL);
+
+ /*
+--- a/scheduler/conf.c
++++ b/scheduler/conf.c
+@@ -26,7 +26,9 @@
+ * parse_fatal_errors() - Parse FatalErrors values in a string.
+ * parse_groups() - Parse system group names in a string.
+ * parse_protocols() - Parse browse protocols in a string.
+- * read_configuration() - Read a configuration file.
++ * parse_variable() - Parse a variable line.
++ * read_cupsd_conf() - Read the cupsd.conf configuration file.
++ * read_cups_files_conf() - Read the cups-files.conf configuration file.
+ * read_location() - Read a <Location path> definition.
+ * read_policy() - Read a <Policy name> definition.
+ */
+@@ -79,9 +81,8 @@
+ * Local globals...
+ */
+
+-static const cupsd_var_t variables[] =
++static const cupsd_var_t cupsd_vars[] =
+ {
+- { "AccessLog", &AccessLog, CUPSD_VARTYPE_STRING },
+ #ifdef __APPLE__
+ { "AppleQuotas", &AppleQuotas, CUPSD_VARTYPE_BOOLEAN },
+ #endif /* __APPLE__ */
+@@ -103,24 +104,17 @@
+ { "BrowseTimeout", &BrowseTimeout, CUPSD_VARTYPE_INTEGER },
+ { "BrowseWebIF", &BrowseWebIF, CUPSD_VARTYPE_BOOLEAN },
+ { "Browsing", &Browsing, CUPSD_VARTYPE_BOOLEAN },
+- { "CacheDir", &CacheDir, CUPSD_VARTYPE_STRING },
+ { "Classification", &Classification, CUPSD_VARTYPE_STRING },
+ { "ClassifyOverride", &ClassifyOverride, CUPSD_VARTYPE_BOOLEAN },
+- { "ConfigFilePerm", &ConfigFilePerm, CUPSD_VARTYPE_INTEGER },
+- { "DataDir", &DataDir, CUPSD_VARTYPE_STRING },
+ { "DefaultLanguage", &DefaultLanguage, CUPSD_VARTYPE_STRING },
+ { "DefaultLeaseDuration", &DefaultLeaseDuration, CUPSD_VARTYPE_INTEGER },
+ { "DefaultPaperSize", &DefaultPaperSize, CUPSD_VARTYPE_STRING },
+ { "DefaultPolicy", &DefaultPolicy, CUPSD_VARTYPE_STRING },
+ { "DefaultShared", &DefaultShared, CUPSD_VARTYPE_BOOLEAN },
+ { "DirtyCleanInterval", &DirtyCleanInterval, CUPSD_VARTYPE_INTEGER },
+- { "DocumentRoot", &DocumentRoot, CUPSD_VARTYPE_STRING },
+- { "ErrorLog", &ErrorLog, CUPSD_VARTYPE_STRING },
+ { "ErrorPolicy", &ErrorPolicy, CUPSD_VARTYPE_STRING },
+- { "FileDevice", &FileDevice, CUPSD_VARTYPE_BOOLEAN },
+ { "FilterLimit", &FilterLimit, CUPSD_VARTYPE_INTEGER },
+ { "FilterNice", &FilterNice, CUPSD_VARTYPE_INTEGER },
+- { "FontPath", &FontPath, CUPSD_VARTYPE_STRING },
+ { "HideImplicitMembers", &HideImplicitMembers, CUPSD_VARTYPE_BOOLEAN },
+ { "ImplicitClasses", &ImplicitClasses, CUPSD_VARTYPE_BOOLEAN },
+ { "ImplicitAnyClasses", &ImplicitAnyClasses, CUPSD_VARTYPE_BOOLEAN },
+@@ -135,8 +129,6 @@
+ { "LimitRequestBody", &MaxRequestSize, CUPSD_VARTYPE_INTEGER },
+ { "ListenBackLog", &ListenBackLog, CUPSD_VARTYPE_INTEGER },
+ { "LogDebugHistory", &LogDebugHistory, CUPSD_VARTYPE_INTEGER },
+- { "LogFilePerm", &LogFilePerm, CUPSD_VARTYPE_INTEGER },
+- { "LPDConfigFile", &LPDConfigFile, CUPSD_VARTYPE_STRING },
+ { "MaxActiveJobs", &MaxActiveJobs, CUPSD_VARTYPE_INTEGER },
+ { "MaxClients", &MaxClients, CUPSD_VARTYPE_INTEGER },
+ { "MaxClientsPerHost", &MaxClientsPerHost, CUPSD_VARTYPE_INTEGER },
+@@ -154,18 +146,34 @@
+ { "MaxSubscriptionsPerPrinter",&MaxSubscriptionsPerPrinter, CUPSD_VARTYPE_INTEGER },
+ { "MaxSubscriptionsPerUser", &MaxSubscriptionsPerUser, CUPSD_VARTYPE_INTEGER },
+ { "MultipleOperationTimeout", &MultipleOperationTimeout, CUPSD_VARTYPE_INTEGER },
+- { "PageLog", &PageLog, CUPSD_VARTYPE_STRING },
+ { "PageLogFormat", &PageLogFormat, CUPSD_VARTYPE_STRING },
+ { "PreserveJobFiles", &JobFiles, CUPSD_VARTYPE_BOOLEAN },
+ { "PreserveJobHistory", &JobHistory, CUPSD_VARTYPE_BOOLEAN },
+- { "Printcap", &Printcap, CUPSD_VARTYPE_STRING },
+- { "PrintcapGUI", &PrintcapGUI, CUPSD_VARTYPE_STRING },
+ { "ReloadTimeout", &ReloadTimeout, CUPSD_VARTYPE_INTEGER },
+- { "RemoteRoot", &RemoteRoot, CUPSD_VARTYPE_STRING },
+- { "RequestRoot", &RequestRoot, CUPSD_VARTYPE_STRING },
+ { "RIPCache", &RIPCache, CUPSD_VARTYPE_STRING },
+ { "RootCertDuration", &RootCertDuration, CUPSD_VARTYPE_INTEGER },
+ { "ServerAdmin", &ServerAdmin, CUPSD_VARTYPE_STRING },
++ { "ServerName", &ServerName, CUPSD_VARTYPE_STRING },
++ { "Timeout", &Timeout, CUPSD_VARTYPE_INTEGER },
++ { "UseNetworkDefault", &UseNetworkDefault, CUPSD_VARTYPE_BOOLEAN }
++};
++static const cupsd_var_t cupsfiles_vars[] =
++{
++ { "AccessLog", &AccessLog, CUPSD_VARTYPE_STRING },
++ { "CacheDir", &CacheDir, CUPSD_VARTYPE_STRING },
++ { "ConfigFilePerm", &ConfigFilePerm, CUPSD_VARTYPE_INTEGER },
++ { "DataDir", &DataDir, CUPSD_VARTYPE_STRING },
++ { "DocumentRoot", &DocumentRoot, CUPSD_VARTYPE_STRING },
++ { "ErrorLog", &ErrorLog, CUPSD_VARTYPE_STRING },
++ { "FileDevice", &FileDevice, CUPSD_VARTYPE_BOOLEAN },
++ { "FontPath", &FontPath, CUPSD_VARTYPE_STRING },
++ { "LogFilePerm", &LogFilePerm, CUPSD_VARTYPE_INTEGER },
++ { "LPDConfigFile", &LPDConfigFile, CUPSD_VARTYPE_STRING },
++ { "PageLog", &PageLog, CUPSD_VARTYPE_STRING },
++ { "Printcap", &Printcap, CUPSD_VARTYPE_STRING },
++ { "PrintcapGUI", &PrintcapGUI, CUPSD_VARTYPE_STRING },
++ { "RemoteRoot", &RemoteRoot, CUPSD_VARTYPE_STRING },
++ { "RequestRoot", &RequestRoot, CUPSD_VARTYPE_STRING },
+ { "ServerBin", &ServerBin, CUPSD_VARTYPE_PATHNAME },
+ #ifdef HAVE_SSL
+ { "ServerCertificate", &ServerCertificate, CUPSD_VARTYPE_PATHNAME },
+@@ -173,7 +181,6 @@
+ { "ServerKey", &ServerKey, CUPSD_VARTYPE_PATHNAME },
+ # endif /* HAVE_LIBSSL || HAVE_GNUTLS */
+ #endif /* HAVE_SSL */
+- { "ServerName", &ServerName, CUPSD_VARTYPE_STRING },
+ { "ServerRoot", &ServerRoot, CUPSD_VARTYPE_PATHNAME },
+ { "SMBConfigFile", &SMBConfigFile, CUPSD_VARTYPE_STRING },
+ { "StateDir", &StateDir, CUPSD_VARTYPE_STRING },
+@@ -181,11 +188,7 @@
+ { "SystemGroupAuthKey", &SystemGroupAuthKey, CUPSD_VARTYPE_STRING },
+ #endif /* HAVE_AUTHORIZATION_H */
+ { "TempDir", &TempDir, CUPSD_VARTYPE_PATHNAME },
+- { "Timeout", &Timeout, CUPSD_VARTYPE_INTEGER },
+- { "UseNetworkDefault", &UseNetworkDefault, CUPSD_VARTYPE_BOOLEAN }
+ };
+-#define NUM_VARS (sizeof(variables) / sizeof(variables[0]))
+-
+
+ static const unsigned ones[4] =
+ {
+@@ -209,7 +212,12 @@
+ static int parse_fatal_errors(const char *s);
+ static int parse_groups(const char *s);
+ static int parse_protocols(const char *s);
+-static int read_configuration(cups_file_t *fp);
++static int parse_variable(const char *filename, int linenum,
++ const char *line, const char *value,
++ size_t num_vars,
++ const cupsd_var_t *vars);
++static int read_cupsd_conf(cups_file_t *fp);
++static int read_cups_files_conf(cups_file_t *fp);
+ static int read_location(cups_file_t *fp, char *name, int linenum);
+ static int read_policy(cups_file_t *fp, char *name, int linenum);
+
+@@ -695,18 +703,59 @@
+ #endif /* __APPLE__ */
+
+ /*
+- * Read the configuration file...
++ * Read the cups-files.conf file...
++ */
++
++ if ((fp = cupsFileOpen(CupsFilesFile, "r")) != NULL)
++ {
++ status = read_cups_files_conf(fp);
++
++ cupsFileClose(fp);
++
++ if (!status)
++ {
++ if (TestConfigFile)
++ printf("%s contains errors\n", CupsFilesFile);
++ else
++ cupsdLogMessage(CUPSD_LOG_CRIT, "Unable to read %s", CupsFilesFile);
++ return (0);
++ }
++ }
++ else if (errno == ENOENT)
++ cupsdLogMessage(CUPSD_LOG_INFO, "No %s, using defaults.", CupsFilesFile);
++ else
++ {
++ cupsdLogMessage(CUPSD_LOG_CRIT, "Unable to open %s: %s", CupsFilesFile,
++ strerror(errno));
++ return (0);
++ }
++
++ if (!ErrorLog)
++ cupsdSetString(&ErrorLog, CUPS_LOGDIR "/error_log");
++
++ /*
++ * Read the cupsd.conf file...
+ */
+
+ if ((fp = cupsFileOpen(ConfigurationFile, "r")) == NULL)
++ {
++ cupsdLogMessage(CUPSD_LOG_CRIT, "Unable to open %s: %s", ConfigurationFile,
++ strerror(errno));
+ return (0);
++ }
+
+- status = read_configuration(fp);
++ status = read_cupsd_conf(fp);
+
+ cupsFileClose(fp);
+
+ if (!status)
++ {
++ if (TestConfigFile)
++ printf("%s contains errors\n", ConfigurationFile);
++ else
++ cupsdLogMessage(CUPSD_LOG_CRIT, "Unable to read %s", ConfigurationFile);
+ return (0);
++ }
+
+ RunUser = getuid();
+
+@@ -826,6 +875,13 @@
+ BrowseACL = cupsdFindLocation("CUPS_INTERNAL_BROWSE_ACL");
+
+ /*
++ * Make sure ConfigFilePerm and LogFilePerm have sane values...
++ */
++
++ ConfigFilePerm &= 0664;
++ LogFilePerm &= 0664;
++
++ /*
+ * Open the system log for cupsd if necessary...
+ */
+
+@@ -2398,13 +2454,174 @@
+
+
+ /*
+- * 'read_configuration()' - Read a configuration file.
++ * 'parse_variable()' - Parse a variable line.
+ */
+
+ static int /* O - 1 on success, 0 on failure */
+-read_configuration(cups_file_t *fp) /* I - File to read from */
++parse_variable(
++ const char *filename, /* I - Name of configuration file */
++ int linenum, /* I - Line in configuration file */
++ const char *line, /* I - Line from configuration file */
++ const char *value, /* I - Value from configuration file */
++ size_t num_vars, /* I - Number of variables */
++ const cupsd_var_t *vars) /* I - Variables */
++{
++ size_t i; /* Looping var */
++ const cupsd_var_t *var; /* Variables */
++ char temp[1024]; /* Temporary string */
++
++
++ for (i = num_vars, var = vars; i > 0; i --, var ++)
++ if (!strcasecmp(line, var->name))
++ break;
++
++ if (i == 0)
++ {
++ /*
++ * Unknown directive! Output an error message and continue...
++ */
++
++ if (!value)
++ cupsdLogMessage(CUPSD_LOG_ERROR, "Missing value for %s on line %d of %s.",
++ line, linenum, filename);
++ else
++ cupsdLogMessage(CUPSD_LOG_ERROR, "Unknown directive %s on line %d of %s.",
++ line, linenum, filename);
++
++ return (0);
++ }
++
++ switch (var->type)
++ {
++ case CUPSD_VARTYPE_INTEGER :
++ if (!value)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Missing integer value for %s on line %d of %s.",
++ line, linenum, filename);
++ return (0);
++ }
++ else if (!isdigit(*value & 255))
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Bad integer value for %s on line %d of %s.",
++ line, linenum, filename);
++ return (0);
++ }
++ else
++ {
++ int n; /* Number */
++ char *units; /* Units */
++
++ n = strtol(value, &units, 0);
++
++ if (units && *units)
++ {
++ if (tolower(units[0] & 255) == 'g')
++ n *= 1024 * 1024 * 1024;
++ else if (tolower(units[0] & 255) == 'm')
++ n *= 1024 * 1024;
++ else if (tolower(units[0] & 255) == 'k')
++ n *= 1024;
++ else if (tolower(units[0] & 255) == 't')
++ n *= 262144;
++ else
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown integer value for %s on line %d of %s.",
++ line, linenum, filename);
++ return (0);
++ }
++ }
++
++ if (n < 0)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Bad negative integer value for %s on line %d of "
++ "%s.", line, linenum, filename);
++ return (0);
++ }
++ else
++ {
++ *((int *)var->ptr) = n;
++ }
++ }
++ break;
++
++ case CUPSD_VARTYPE_BOOLEAN :
++ if (!value)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Missing boolean value for %s on line %d of %s.",
++ line, linenum, filename);
++ return (0);
++ }
++ else if (!strcasecmp(value, "true") ||
++ !strcasecmp(value, "on") ||
++ !strcasecmp(value, "enabled") ||
++ !strcasecmp(value, "yes") ||
++ atoi(value) != 0)
++ {
++ *((int *)var->ptr) = TRUE;
++ }
++ else if (!strcasecmp(value, "false") ||
++ !strcasecmp(value, "off") ||
++ !strcasecmp(value, "disabled") ||
++ !strcasecmp(value, "no") ||
++ !strcasecmp(value, "0"))
++ {
++ *((int *)var->ptr) = FALSE;
++ }
++ else
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown boolean value %s on line %d of %s.",
++ value, linenum, filename);
++ return (0);
++ }
++ break;
++
++ case CUPSD_VARTYPE_PATHNAME :
++ if (!value)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Missing pathname value for %s on line %d of %s.",
++ line, linenum, filename);
++ return (0);
++ }
++
++ if (value[0] == '/')
++ strlcpy(temp, value, sizeof(temp));
++ else
++ snprintf(temp, sizeof(temp), "%s/%s", ServerRoot, value);
++
++ if (access(temp, 0))
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "File or directory for \"%s %s\" on line %d of %s "
++ "does not exist.", line, value, linenum, filename);
++ return (0);
++ }
++
++ cupsdSetString((char **)var->ptr, temp);
++ break;
++
++ case CUPSD_VARTYPE_STRING :
++ cupsdSetString((char **)var->ptr, value);
++ break;
++ }
++
++ return (1);
++}
++
++
++/*
++ * 'read_cupsd_conf()' - Read the cupsd.conf configuration file.
++ */
++
++static int /* O - 1 on success, 0 on failure */
++read_cupsd_conf(cups_file_t *fp) /* I - File to read from */
+ {
+- int i; /* Looping var */
+ int linenum; /* Current line number */
+ char line[HTTP_MAX_BUFFER],
+ /* Line from file */
+@@ -2416,7 +2633,6 @@
+ *value, /* Pointer to value */
+ *valueptr; /* Pointer into value */
+ int valuelen; /* Length of value */
+- cupsd_var_t const *var; /* Current variable */
+ http_addrlist_t *addrlist, /* Address list */
+ *addr; /* Current address */
+ unsigned ip[4], /* Address value */
+@@ -2426,7 +2642,6 @@
+ cupsd_location_t *location; /* Browse location */
+ cups_file_t *incfile; /* Include file */
+ char incname[1024]; /* Include filename */
+- struct group *group; /* Group */
+
+
+ /*
+@@ -2458,7 +2673,7 @@
+ incname, strerror(errno));
+ else
+ {
+- read_configuration(incfile);
++ read_cupsd_conf(incfile);
+ cupsFileClose(incfile);
+ }
+ }
+@@ -2482,8 +2697,6 @@
+ if (linenum == 0)
+ return (0);
+ }
+- else if (!strcasecmp(line, "FatalErrors"))
+- FatalErrors = parse_fatal_errors(value);
+ else if (!strcasecmp(line, "FaxRetryInterval") && value)
+ {
+ JobRetryInterval = atoi(value);
+@@ -3160,81 +3373,6 @@
+ }
+ }
+ #endif /* HAVE_SSL */
+- else if (!strcasecmp(line, "User") && value)
+- {
+- /*
+- * User ID to run as...
+- */
+-
+- if (isdigit(value[0] & 255))
+- {
+- int uid = atoi(value);
+-
+- if (!uid)
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Will not use User 0 as specified on line %d "
+- "for security reasons. You must use a non-"
+- "privileged account instead.",
+- linenum);
+- else
+- User = atoi(value);
+- }
+- else
+- {
+- struct passwd *p; /* Password information */
+-
+- endpwent();
+- p = getpwnam(value);
+-
+- if (p)
+- {
+- if (!p->pw_uid)
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Will not use User %s (UID=0) as specified on line "
+- "%d for security reasons. You must use a non-"
+- "privileged account instead.",
+- value, linenum);
+- else
+- User = p->pw_uid;
+- }
+- else
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Unknown User \"%s\" on line %d, ignoring!",
+- value, linenum);
+- }
+- }
+- else if (!strcasecmp(line, "Group") && value)
+- {
+- /*
+- * Group ID to run as...
+- */
+-
+- if (isdigit(value[0]))
+- Group = atoi(value);
+- else
+- {
+- endgrent();
+- group = getgrnam(value);
+-
+- if (group != NULL)
+- Group = group->gr_gid;
+- else
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Unknown Group \"%s\" on line %d, ignoring!",
+- value, linenum);
+- }
+- }
+- else if (!strcasecmp(line, "SystemGroup") && value)
+- {
+- /*
+- * SystemGroup (admin) group(s)...
+- */
+-
+- if (!parse_groups(value))
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Unknown SystemGroup \"%s\" on line %d, ignoring!",
+- value, linenum);
+- }
+ else if (!strcasecmp(line, "HostNameLookups") && value)
+ {
+ /*
+@@ -3313,22 +3451,6 @@
+ cupsdLogMessage(CUPSD_LOG_WARN, "Unknown LogTimeFormat %s on line %d.",
+ value, linenum);
+ }
+- else if (!strcasecmp(line, "PrintcapFormat") && value)
+- {
+- /*
+- * Format of printcap file?
+- */
+-
+- if (!strcasecmp(value, "bsd"))
+- PrintcapFormat = PRINTCAP_BSD;
+- else if (!strcasecmp(value, "plist"))
+- PrintcapFormat = PRINTCAP_PLIST;
+- else if (!strcasecmp(value, "solaris"))
+- PrintcapFormat = PRINTCAP_SOLARIS;
+- else
+- cupsdLogMessage(CUPSD_LOG_WARN, "Unknown PrintcapFormat %s on line %d.",
+- value, linenum);
+- }
+ else if (!strcasecmp(line, "ServerTokens") && value)
+ {
+ /*
+@@ -3432,123 +3554,197 @@
+ "line %d.", value, linenum);
+ }
+ #endif /* HAVE_SSL */
++ else if (!strcasecmp(line, "AccessLog") ||
++ !strcasecmp(line, "CacheDir") ||
++ !strcasecmp(line, "ConfigFilePerm") ||
++ !strcasecmp(line, "DataDir") ||
++ !strcasecmp(line, "DocumentRoot") ||
++ !strcasecmp(line, "ErrorLog") ||
++ !strcasecmp(line, "FatalErrors") ||
++ !strcasecmp(line, "FileDevice") ||
++ !strcasecmp(line, "FontPath") ||
++ !strcasecmp(line, "Group") ||
++ !strcasecmp(line, "LogFilePerm") ||
++ !strcasecmp(line, "LPDConfigFile") ||
++ !strcasecmp(line, "PageLog") ||
++ !strcasecmp(line, "Printcap") ||
++ !strcasecmp(line, "PrintcapFormat") ||
++ !strcasecmp(line, "RemoteRoot") ||
++ !strcasecmp(line, "RequestRoot") ||
++ !strcasecmp(line, "ServerBin") ||
++ !strcasecmp(line, "ServerCertificate") ||
++ !strcasecmp(line, "ServerKey") ||
++ !strcasecmp(line, "ServerRoot") ||
++ !strcasecmp(line, "SMBConfigFile") ||
++ !strcasecmp(line, "StateDir") ||
++ !strcasecmp(line, "SystemGroup") ||
++ !strcasecmp(line, "SystemGroupAuthKey") ||
++ !strcasecmp(line, "TempDir") ||
++ !strcasecmp(line, "User"))
++ {
++ cupsdLogMessage(CUPSD_LOG_WARN,
++ "Please move \"%s%s%s\" on line %d of %s to the %s file; "
++ "this will become an error in a future release.",
++ line, value ? " " : "", value ? value : "", linenum,
++ ConfigurationFile, CupsFilesFile);
++ }
+ else
++ parse_variable(ConfigurationFile, linenum, line, value,
++ sizeof(cupsd_vars) / sizeof(cupsd_vars[0]), cupsd_vars);
++ }
++
++ return (1);
++}
++
++/*
++ * 'read_cups_files_conf()' - Read the cups-files.conf configuration file.
++ */
++
++static int /* O - 1 on success, 0 on failure */
++read_cups_files_conf(cups_file_t *fp) /* I - File to read from */
++{
++ int linenum; /* Current line number */
++ char line[HTTP_MAX_BUFFER], /* Line from file */
++ *value; /* Value from line */
++ struct group *group; /* Group */
++
++
++ /*
++ * Loop through each line in the file...
++ */
++
++ linenum = 0;
++
++ while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
++ {
++ if (!strcasecmp(line, "FatalErrors"))
++ FatalErrors = parse_fatal_errors(value);
++ else if (!strcasecmp(line, "Group") && value)
+ {
+ /*
+- * Find a simple variable in the list...
++ * Group ID to run as...
+ */
+
+- for (i = NUM_VARS, var = variables; i > 0; i --, var ++)
+- if (!strcasecmp(line, var->name))
+- break;
+-
+- if (i == 0)
++ if (isdigit(value[0]))
++ Group = atoi(value);
++ else
+ {
+- /*
+- * Unknown directive! Output an error message and continue...
+- */
++ endgrent();
++ group = getgrnam(value);
+
+- if (!value)
+- cupsdLogMessage(CUPSD_LOG_ERROR, "Missing value for %s on line %d.",
+- line, linenum);
++ if (group != NULL)
++ Group = group->gr_gid;
+ else
+- cupsdLogMessage(CUPSD_LOG_ERROR, "Unknown directive %s on line %d.",
+- line, linenum);
+- continue;
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown Group \"%s\" on line %d of %s.", value,
++ linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
+ }
++ }
++ else if (!strcasecmp(line, "PrintcapFormat") && value)
++ {
++ /*
++ * Format of printcap file?
++ */
+
+- switch (var->type)
++ if (!strcasecmp(value, "bsd"))
++ PrintcapFormat = PRINTCAP_BSD;
++ else if (!strcasecmp(value, "plist"))
++ PrintcapFormat = PRINTCAP_PLIST;
++ else if (!strcasecmp(value, "solaris"))
++ PrintcapFormat = PRINTCAP_SOLARIS;
++ else
+ {
+- case CUPSD_VARTYPE_INTEGER :
+- if (!value)
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Missing integer value for %s on line %d!",
+- line, linenum);
+- else
+- {
+- int n; /* Number */
+- char *units; /* Units */
+-
+-
+- n = strtol(value, &units, 0);
+-
+- if (units && *units)
+- {
+- if (tolower(units[0] & 255) == 'g')
+- n *= 1024 * 1024 * 1024;
+- else if (tolower(units[0] & 255) == 'm')
+- n *= 1024 * 1024;
+- else if (tolower(units[0] & 255) == 'k')
+- n *= 1024;
+- else if (tolower(units[0] & 255) == 't')
+- n *= 262144;
+- }
+-
+- if (n < 0)
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Bad negative integer value for %s on line %d!",
+- line, linenum);
+- else
+- *((int *)var->ptr) = n;
+- }
+- break;
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown PrintcapFormat \"%s\" on line %d of %s.",
++ value, linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
++ }
++ else if (!strcasecmp(line, "SystemGroup") && value)
++ {
++ /*
++ * SystemGroup (admin) group(s)...
++ */
+
+- case CUPSD_VARTYPE_BOOLEAN :
+- if (!value)
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Missing boolean value for %s on line %d!",
+- line, linenum);
+- else if (!strcasecmp(value, "true") ||
+- !strcasecmp(value, "on") ||
+- !strcasecmp(value, "enabled") ||
+- !strcasecmp(value, "yes") ||
+- atoi(value) != 0)
+- *((int *)var->ptr) = TRUE;
+- else if (!strcasecmp(value, "false") ||
+- !strcasecmp(value, "off") ||
+- !strcasecmp(value, "disabled") ||
+- !strcasecmp(value, "no") ||
+- !strcasecmp(value, "0"))
+- *((int *)var->ptr) = FALSE;
+- else
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Unknown boolean value %s on line %d.",
+- value, linenum);
+- break;
++ if (!parse_groups(value))
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown SystemGroup \"%s\" on line %d of %s.", value,
++ linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
++ }
++ else if (!strcasecmp(line, "User") && value)
++ {
++ /*
++ * User ID to run as...
++ */
+
+- case CUPSD_VARTYPE_PATHNAME :
+- if (!value)
+- {
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "Missing pathname value for %s on line %d!",
+- line, linenum);
+- break;
+- }
++ if (isdigit(value[0] & 255))
++ {
++ int uid = atoi(value);
+
+- if (value[0] == '/')
+- strlcpy(temp, value, sizeof(temp));
+- else
+- snprintf(temp, sizeof(temp), "%s/%s", ServerRoot, value);
++ if (!uid)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Will not use User 0 as specified on line %d of %s "
++ "for security reasons. You must use a non-"
++ "privileged account instead.",
++ linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
++ else
++ User = atoi(value);
++ }
++ else
++ {
++ struct passwd *p; /* Password information */
+
+- if (access(temp, 0))
+- {
+- cupsdLogMessage(CUPSD_LOG_ERROR,
+- "File or directory for \"%s %s\" on line %d "
+- "does not exist!", line, value, linenum);
+- break;
+- }
++ endpwent();
++ p = getpwnam(value);
+
+- case CUPSD_VARTYPE_STRING :
+- cupsdSetString((char **)var->ptr, value);
+- break;
++ if (p)
++ {
++ if (!p->pw_uid)
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Will not use User %s (UID=0) as specified on line "
++ "%d of %s for security reasons. You must use a "
++ "non-privileged account instead.",
++ value, linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
++ else
++ User = p->pw_uid;
++ }
++ else
++ {
++ cupsdLogMessage(CUPSD_LOG_ERROR,
++ "Unknown User \"%s\" on line %d of %s.",
++ value, linenum, CupsFilesFile);
++ if (FatalErrors & CUPSD_FATAL_CONFIG)
++ return (0);
++ }
+ }
+ }
++ else if (!parse_variable(CupsFilesFile, linenum, line, value,
++ sizeof(cupsfiles_vars) / sizeof(cupsfiles_vars[0]),
++ cupsfiles_vars) &&
++ (FatalErrors & CUPSD_FATAL_CONFIG))
++ return (0);
+ }
+
+ return (1);
+ }
+
+-
+ /*
+ * 'read_location()' - Read a <Location path> definition.
+ */
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/scheduler/conf.h cups/scheduler/conf.h
+--- cups~/scheduler/conf.h 2012-12-08 00:29:09.000000000 +0100
++++ cups/scheduler/conf.h 2012-12-08 00:29:10.000000000 +0100
+@@ -96,7 +96,9 @@
+ */
+
+ VAR char *ConfigurationFile VALUE(NULL),
+- /* Configuration file to use */
++ /* cupsd.conf file to use */
++ *CupsFilesFile VALUE(NULL),
++ /* cups-files.conf file to use */
+ *ServerName VALUE(NULL),
+ /* FQDN for server */
+ *ServerAdmin VALUE(NULL),
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/scheduler/ipp.c cups/scheduler/ipp.c
+--- cups~/scheduler/ipp.c 2012-12-08 00:29:09.000000000 +0100
++++ cups/scheduler/ipp.c 2012-12-08 00:54:10.627688371 +0100
+@@ -2597,7 +2597,7 @@
+ send_ipp_status(con, IPP_NOT_POSSIBLE,
+ _("File device URIs have been disabled! "
+ "To enable, see the FileDevice directive in "
+- "\"%s/cupsd.conf\"."),
++ "\"%s/cups-files.conf\"."),
+ ServerRoot);
+ return;
+ }
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' cups~/scheduler/main.c cups/scheduler/main.c
+--- cups~/scheduler/main.c 2012-12-08 00:29:09.000000000 +0100
++++ cups/scheduler/main.c 2012-12-08 00:29:10.000000000 +0100
+@@ -251,6 +251,35 @@
+ cupsdSetStringf(&ConfigurationFile, "%s/%s", current, argv[i]);
+ free(current);
+ }
++
++ if (!CupsFilesFile)
++ {
++ char *filename, /* Copy of cupsd.conf filename */
++ *slash; /* Final slash in cupsd.conf filename */
++ size_t len; /* Size of buffer */
++
++ len = strlen(ConfigurationFile) + 15;
++ if ((filename = malloc(len)) == NULL)
++ {
++ _cupsLangPrintf(stderr,
++ _("cupsd: Unable to get path to "
++ "cups-files.conf file."));
++ return (1);
++ }
++
++ strlcpy(filename, ConfigurationFile, len);
++ if ((slash = strrchr(filename, '/')) == NULL)
++ {
++ _cupsLangPrintf(stderr,
++ _("cupsd: Unable to get path to "
++ "cups-files.conf file."));
++ return (1);
++ }
++
++ strlcpy(slash, "/cups-files.conf", len - (slash - filename));
++ cupsdSetString(&CupsFilesFile, filename);
++ free(filename);
++ }
+ break;
+
+ case 'f' : /* Run in foreground... */
+@@ -289,6 +318,29 @@
+ UseProfiles = 0;
+ break;
+
++ case 's' : /* Set cups-files.conf location */
++ i ++;
++ if (i >= argc)
++ {
++ _cupsLangPuts(stderr, _("cupsd: Expected cups-files.conf "
++ "filename after \"-s\" option."));
++ usage(1);
++ }
++
++ if (argv[i][0] != '/')
++ {
++ /*
++ * Relative filename not allowed...
++ */
++
++ _cupsLangPuts(stderr, _("cupsd: Relative cups-files.conf "
++ "filename not allowed."));
++ usage(1);
++ }
++
++ cupsdSetString(&CupsFilesFile, argv[i]);
++ break;
++
+ #ifdef __APPLE__
+ case 'S' : /* Disable system management functions */
+ fputs("cupsd: -S (disable system management) for internal "
+@@ -315,8 +367,40 @@
+ usage(1);
+ }
+
+- if (!ConfigurationFile)
+- cupsdSetString(&ConfigurationFile, CUPS_SERVERROOT "/cupsd.conf");
++ if (!ConfigurationFile)
++ {
++ cupsdSetString(&ConfigurationFile, CUPS_SERVERROOT "/cupsd.conf");
++ cupsdSetString(&CupsFilesFile, CUPS_SERVERROOT "/cups-files.conf");
++ }
++
++ if (!CupsFilesFile)
++ {
++ char *filename, /* Copy of cupsd.conf filename */
++ *slash; /* Final slash in cupsd.conf filename */
++ size_t len; /* Size of buffer */
++
++ len = strlen(ConfigurationFile) + 15;
++ if ((filename = malloc(len)) == NULL)
++ {
++ _cupsLangPrintf(stderr,
++ _("cupsd: Unable to get path to "
++ "cups-files.conf file."));
++ return (1);
++ }
++
++ strlcpy(filename, ConfigurationFile, len);
++ if ((slash = strrchr(filename, '/')) == NULL)
++ {
++ _cupsLangPrintf(stderr,
++ _("cupsd: Unable to get path to "
++ "cups-files.conf file."));
++ return (1);
++ }
++
++ strlcpy(slash, "/cups-files.conf", len - (slash - filename));
++ cupsdSetString(&CupsFilesFile, filename);
++ free(filename);
++ }
+
+ /*
+ * If the user hasn't specified "-f", run in the background...
+--- a/test/run-stp-tests.sh
++++ b/test/run-stp-tests.sh
+@@ -326,25 +326,10 @@
+
+ cat >/tmp/cups-$user/cupsd.conf <<EOF
+ Browsing Off
+-FileDevice yes
+-Printcap
+ Listen 127.0.0.1:$port
+-User $user
+-ServerRoot /tmp/cups-$user
+-StateDir /tmp/cups-$user
+-ServerBin /tmp/cups-$user/bin
+-CacheDir /tmp/cups-$user/share
+-DataDir /tmp/cups-$user/share
+-FontPath /tmp/cups-$user/share/fonts
+ PassEnv LOCALEDIR
+-DocumentRoot $root/doc
+-RequestRoot /tmp/cups-$user/spool
+-TempDir /tmp/cups-$user/spool/temp
+ MaxSubscriptions 3
+ MaxLogSize 0
+-AccessLog /tmp/cups-$user/log/access_log
+-ErrorLog /tmp/cups-$user/log/error_log
+-PageLog /tmp/cups-$user/log/page_log
+ AccessLogLevel actions
+ LogLevel debug2
+ LogTimeFormat usecs
+@@ -359,6 +344,25 @@
+ </Policy>
+ EOF
+
++cat >/tmp/cups-$user/cups-files.conf <<EOF
++FileDevice yes
++Printcap
++User $user
++ServerRoot /tmp/cups-$user
++StateDir /tmp/cups-$user
++ServerBin /tmp/cups-$user/bin
++CacheDir /tmp/cups-$user/share
++DataDir /tmp/cups-$user/share
++FontPath /tmp/cups-$user/share/fonts
++DocumentRoot $root/doc
++RequestRoot /tmp/cups-$user/spool
++TempDir /tmp/cups-$user/spool/temp
++PidFile /tmp/cups-$user/cupsd.pid
++AccessLog /tmp/cups-$user/log/access_log
++ErrorLog /tmp/cups-$user/log/error_log
++PageLog /tmp/cups-$user/log/page_log
++EOF
++
+ #
+ # Setup lots of test queues - half with PPD files, half without...
+ #
diff --git a/meta/recipes-extended/cups/cups_1.4.6.bb b/meta/recipes-extended/cups/cups_1.4.6.bb
index aadaa07..53dc149 100644
--- a/meta/recipes-extended/cups/cups_1.4.6.bb
+++ b/meta/recipes-extended/cups/cups_1.4.6.bb
@@ -1,6 +1,6 @@
require cups14.inc
-PR = "r6"
+PR = "r7"
DEPENDS += "libusb \
${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
@@ -9,6 +9,7 @@ SRC_URI += " \
file://use_echo_only_in_init.patch \
file://0001-don-t-try-to-run-generated-binaries.patch \
file://cups_serverbin.patch \
+ file://cups-CVE-2012-5519.patch \
"
SRC_URI[md5sum] = "de8fb5a29c36554925c0c6a6e2c0dae1"
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 5/7] cups - CVE-2011-2896
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
` (3 preceding siblings ...)
2013-01-07 11:09 ` [PATCH 4/7] cups: CVE-2012-5519 Ross Burton
@ 2013-01-07 11:10 ` Ross Burton
2013-01-07 11:10 ` [PATCH 6/7] cups CVE-2011-3170 Ross Burton
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:10 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
the patch come from:
http://cups.org/strfiles/3867/str3867.patch
The LZW decompressor in the LWZReadByte function in giftoppm.c
in the David Koblas GIF decoder in PBMPLUS, as used in the
gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7,
the LZWReadByte function in plug-ins/common/file-gif-load.c
in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c
in XPCE in SWI-Prolog 5.10.4 and earlier, and other products,
does not properly handle code words that are absent from the
decompression table when encountered, which allows remote attackers to
trigger an infinite loop or a heap-based buffer overflow, and possibly
execute arbitrary code, via a crafted compressed stream, a related
issue to CVE-2006-1168 and CVE-2011-2895.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2896
[YOCTO #3582]
[ CQID: WIND00299595 ]
Upstream-Status: Backport
(From OE-Core rev: 0742b7aecaada435f90f39f26914906a5eb1fd4f)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../cups/cups-1.4.6/cups-CVE-2011-2896.patch | 140 ++++++++++++++++++++
meta/recipes-extended/cups/cups_1.4.6.bb | 3 +-
2 files changed, 142 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-2896.patch
diff --git a/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-2896.patch b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-2896.patch
new file mode 100644
index 0000000..7c6f75b
--- /dev/null
+++ b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-2896.patch
@@ -0,0 +1,140 @@
+cups - CVE-2011-2896
+
+the patch come from:
+http://cups.org/strfiles/3867/str3867.patch
+
+The LZW decompressor in the LWZReadByte function in giftoppm.c
+in the David Koblas GIF decoder in PBMPLUS, as used in the
+gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7,
+the LZWReadByte function in plug-ins/common/file-gif-load.c
+in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c
+in XPCE in SWI-Prolog 5.10.4 and earlier, and other products,
+does not properly handle code words that are absent from the
+decompression table when encountered, which allows remote attackers to
+trigger an infinite loop or a heap-based buffer overflow, and possibly
+execute arbitrary code, via a crafted compressed stream, a related
+issue to CVE-2006-1168 and CVE-2011-2895.
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2896
+
+Integrated-by: Li Wang <li.wang@windriver.com>
+---
+ filter/image-gif.c | 46 ++++++++++++++++++++--------------------------
+ 1 files changed, 20 insertions(+), 26 deletions(-)
+
+diff --git a/filter/image-gif.c b/filter/image-gif.c
+index 3857c21..fa9691e 100644
+--- a/filter/image-gif.c
++++ b/filter/image-gif.c
+@@ -353,7 +353,7 @@ gif_get_code(FILE *fp, /* I - File to read from */
+ * Read in another buffer...
+ */
+
+- if ((count = gif_get_block (fp, buf + last_byte)) <= 0)
++ if ((count = gif_get_block(fp, buf + last_byte)) <= 0)
+ {
+ /*
+ * Whoops, no more data!
+@@ -582,19 +582,13 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+ gif_get_code(fp, 0, 1);
+
+ /*
+- * Wipe the decompressor table...
++ * Wipe the decompressor table (already mostly 0 due to the calloc above...)
+ */
+
+ fresh = 1;
+
+- for (i = 0; i < clear_code; i ++)
+- {
+- table[0][i] = 0;
++ for (i = 1; i < clear_code; i ++)
+ table[1][i] = i;
+- }
+-
+- for (; i < 4096; i ++)
+- table[0][i] = table[1][0] = 0;
+
+ sp = stack;
+
+@@ -605,29 +599,30 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+ fresh = 0;
+
+ do
++ {
+ firstcode = oldcode = gif_get_code(fp, code_size, 0);
++ }
+ while (firstcode == clear_code);
+
+- return (firstcode);
++ return (firstcode & 255);
+ }
+ else if (!table)
+ return (0);
+
+ if (sp > stack)
+- return (*--sp);
++ return ((*--sp) & 255);
+
+- while ((code = gif_get_code (fp, code_size, 0)) >= 0)
++ while ((code = gif_get_code(fp, code_size, 0)) >= 0)
+ {
+ if (code == clear_code)
+ {
+- for (i = 0; i < clear_code; i ++)
+- {
+- table[0][i] = 0;
+- table[1][i] = i;
+- }
++ /*
++ * Clear/reset the compression table...
++ */
+
+- for (; i < 4096; i ++)
+- table[0][i] = table[1][i] = 0;
++ memset(table, 0, 2 * sizeof(gif_table_t));
++ for (i = 1; i < clear_code; i ++)
++ table[1][i] = i;
+
+ code_size = set_code_size + 1;
+ max_code_size = 2 * clear_code;
+@@ -637,12 +632,11 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+
+ firstcode = oldcode = gif_get_code(fp, code_size, 0);
+
+- return (firstcode);
++ return (firstcode & 255);
+ }
+- else if (code == end_code)
++ else if (code == end_code || code > max_code)
+ {
+- unsigned char buf[260];
+-
++ unsigned char buf[260]; /* Block buffer */
+
+ if (!gif_eof)
+ while (gif_get_block(fp, buf) > 0);
+@@ -652,7 +646,7 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+
+ incode = code;
+
+- if (code >= max_code)
++ if (code == max_code)
+ {
+ if (sp < (stack + 8192))
+ *sp++ = firstcode;
+@@ -690,10 +684,10 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+ oldcode = incode;
+
+ if (sp > stack)
+- return (*--sp);
++ return ((*--sp) & 255);
+ }
+
+- return (code);
++ return (code & 255);
+ }
+
+
+--
+1.7.0.5
+
diff --git a/meta/recipes-extended/cups/cups_1.4.6.bb b/meta/recipes-extended/cups/cups_1.4.6.bb
index 53dc149..7cecd7f 100644
--- a/meta/recipes-extended/cups/cups_1.4.6.bb
+++ b/meta/recipes-extended/cups/cups_1.4.6.bb
@@ -1,6 +1,6 @@
require cups14.inc
-PR = "r7"
+PR = "r8"
DEPENDS += "libusb \
${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
@@ -9,6 +9,7 @@ SRC_URI += " \
file://use_echo_only_in_init.patch \
file://0001-don-t-try-to-run-generated-binaries.patch \
file://cups_serverbin.patch \
+ file://cups-CVE-2011-2896.patch \
file://cups-CVE-2012-5519.patch \
"
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 6/7] cups CVE-2011-3170
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
` (4 preceding siblings ...)
2013-01-07 11:10 ` [PATCH 5/7] cups - CVE-2011-2896 Ross Burton
@ 2013-01-07 11:10 ` Ross Burton
2013-01-07 11:10 ` [PATCH 7/7] librsvg: CVE-2011-3146 Ross Burton
2013-01-07 11:34 ` [danny] Consolidated Pull Request Richard Purdie
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:10 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
the patch come from:
http://cups.org/strfiles/3914/str3914.patch
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170
[YOCTO #3583]
[ CQID: WIND00299594 ]
Upstream-Status: Backport
(From OE-Core rev: c82517bb667484854eaa05b6e9efd9ee0f164fec)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../cups/cups-1.4.6/cups-CVE-2011-3170.patch | 54 ++++++++++++++++++++
meta/recipes-extended/cups/cups_1.4.6.bb | 3 +-
2 files changed, 56 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch
diff --git a/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch
new file mode 100644
index 0000000..fd1b958
--- /dev/null
+++ b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch
@@ -0,0 +1,54 @@
+cups CVE-2011-3170
+
+the patch come from:
+http://cups.org/strfiles/3914/str3914.patch
+
+The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
+earlier does not properly handle the first code word in an LZW stream,
+which allows remote attackers to trigger a heap-based buffer overflow,
+and possibly execute arbitrary code, via a crafted stream, a different
+vulnerability than CVE-2011-2896.
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170
+
+Integrated-by: Li Wang <li.wang@windriver.com>
+---
+ filter/image-gif.c | 14 +++++++++-----
+ 1 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/filter/image-gif.c b/filter/image-gif.c
+index 9542704..3857c21 100644
+--- a/filter/image-gif.c
++++ b/filter/image-gif.c
+@@ -654,11 +654,13 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+
+ if (code >= max_code)
+ {
+- *sp++ = firstcode;
+- code = oldcode;
++ if (sp < (stack + 8192))
++ *sp++ = firstcode;
++
++ code = oldcode;
+ }
+
+- while (code >= clear_code)
++ while (code >= clear_code && sp < (stack + 8192))
+ {
+ *sp++ = table[1][code];
+ if (code == table[0][code])
+@@ -667,8 +669,10 @@ gif_read_lzw(FILE *fp, /* I - File to read from */
+ code = table[0][code];
+ }
+
+- *sp++ = firstcode = table[1][code];
+- code = max_code;
++ if (sp < (stack + 8192))
++ *sp++ = firstcode = table[1][code];
++
++ code = max_code;
+
+ if (code < 4096)
+ {
+--
+1.7.0.5
+
diff --git a/meta/recipes-extended/cups/cups_1.4.6.bb b/meta/recipes-extended/cups/cups_1.4.6.bb
index 7cecd7f..75c23d3 100644
--- a/meta/recipes-extended/cups/cups_1.4.6.bb
+++ b/meta/recipes-extended/cups/cups_1.4.6.bb
@@ -1,6 +1,6 @@
require cups14.inc
-PR = "r8"
+PR = "r9"
DEPENDS += "libusb \
${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
@@ -10,6 +10,7 @@ SRC_URI += " \
file://0001-don-t-try-to-run-generated-binaries.patch \
file://cups_serverbin.patch \
file://cups-CVE-2011-2896.patch \
+ file://cups-CVE-2011-3170.patch \
file://cups-CVE-2012-5519.patch \
"
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 7/7] librsvg: CVE-2011-3146
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
` (5 preceding siblings ...)
2013-01-07 11:10 ` [PATCH 6/7] cups CVE-2011-3170 Ross Burton
@ 2013-01-07 11:10 ` Ross Burton
2013-01-07 11:34 ` [danny] Consolidated Pull Request Richard Purdie
7 siblings, 0 replies; 9+ messages in thread
From: Ross Burton @ 2013-01-07 11:10 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
Store node type separately in RsvgNode
commit 34c95743ca692ea0e44778e41a7c0a129363de84 upstream
The node name (formerly RsvgNode:type) cannot be used to infer
the sub-type of RsvgNode that we're dealing with, since for unknown
elements we put type = node-name. This lead to a (potentially exploitable)
crash e.g. when the element name started with "fe" which tricked
the old code into considering it as a RsvgFilterPrimitive.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3146
https://bugzilla.gnome.org/show_bug.cgi?id=658014
[YOCTO #3581]
[ CQID: WIND00376773 ]
Upstream-Status: Backport
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
---
.../librsvg-2.32.1/librsvg-CVE-2011-3146.patch | 1088 ++++++++++++++++++++
meta/recipes-gnome/librsvg/librsvg_2.32.1.bb | 6 +-
2 files changed, 1092 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-gnome/librsvg/librsvg-2.32.1/librsvg-CVE-2011-3146.patch
diff --git a/meta/recipes-gnome/librsvg/librsvg-2.32.1/librsvg-CVE-2011-3146.patch b/meta/recipes-gnome/librsvg/librsvg-2.32.1/librsvg-CVE-2011-3146.patch
new file mode 100644
index 0000000..251f31e
--- /dev/null
+++ b/meta/recipes-gnome/librsvg/librsvg-2.32.1/librsvg-CVE-2011-3146.patch
@@ -0,0 +1,1088 @@
+librsvg: CVE-2011-3146
+
+Store node type separately in RsvgNode
+
+commit 34c95743ca692ea0e44778e41a7c0a129363de84 upstream
+
+The node name (formerly RsvgNode:type) cannot be used to infer
+the sub-type of RsvgNode that we're dealing with, since for unknown
+elements we put type = node-name. This lead to a (potentially exploitable)
+crash e.g. when the element name started with "fe" which tricked
+the old code into considering it as a RsvgFilterPrimitive.
+http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3146
+
+https://bugzilla.gnome.org/show_bug.cgi?id=658014
+---
+ rsvg-base.c | 68 ++++++++++++++++++++++++++------------------
+ rsvg-cairo-draw.c | 2 +-
+ rsvg-filter.c | 79 +++++++++++++++++++++++++++------------------------
+ rsvg-filter.h | 2 +-
+ rsvg-image.c | 2 +-
+ rsvg-marker.c | 4 +-
+ rsvg-mask.c | 8 ++--
+ rsvg-paint-server.c | 25 ++++++++--------
+ rsvg-private.h | 60 ++++++++++++++++++++++++++++++++++++++-
+ rsvg-shapes.c | 25 ++++++++--------
+ rsvg-shapes.h | 2 +-
+ rsvg-structure.c | 25 ++++++++--------
+ rsvg-structure.h | 5 ++-
+ rsvg-text.c | 22 ++++++++------
+ 14 files changed, 204 insertions(+), 125 deletions(-)
+
+diff --git a/rsvg-base.c b/rsvg-base.c
+index 1f5c48c..b1a2d8b 100644
+--- a/rsvg-base.c
++++ b/rsvg-base.c
+@@ -147,7 +147,6 @@ rsvg_start_style (RsvgHandle * ctx, RsvgPropertyBag * atts)
+ static void
+ rsvg_standard_element_start (RsvgHandle * ctx, const char *name, RsvgPropertyBag * atts)
+ {
+-
+ /*replace this stuff with a hash for fast reading! */
+ RsvgNode *newnode = NULL;
+ if (!strcmp (name, "g"))
+@@ -241,11 +240,11 @@ rsvg_standard_element_start (RsvgHandle * ctx, const char *name, RsvgPropertyBag
+ else if (!strcmp (name, "feFuncA"))
+ newnode = rsvg_new_node_component_transfer_function ('a');
+ else if (!strcmp (name, "feDistantLight"))
+- newnode = rsvg_new_filter_primitive_light_source ('d');
++ newnode = rsvg_new_node_light_source ('d');
+ else if (!strcmp (name, "feSpotLight"))
+- newnode = rsvg_new_filter_primitive_light_source ('s');
++ newnode = rsvg_new_node_light_source ('s');
+ else if (!strcmp (name, "fePointLight"))
+- newnode = rsvg_new_filter_primitive_light_source ('p');
++ newnode = rsvg_new_node_light_source ('p');
+ /* hack to make multiImage sort-of work */
+ else if (!strcmp (name, "multiImage"))
+ newnode = rsvg_new_switch ();
+@@ -259,21 +258,22 @@ rsvg_standard_element_start (RsvgHandle * ctx, const char *name, RsvgPropertyBag
+ newnode = rsvg_new_tspan ();
+ else if (!strcmp (name, "tref"))
+ newnode = rsvg_new_tref ();
+- else {
++ else {
+ /* hack for bug 401115. whenever we encounter a node we don't understand, push it into a group.
+ this will allow us to handle things like conditionals properly. */
+ newnode = rsvg_new_group ();
+ }
+
+ if (newnode) {
+- newnode->type = g_string_new (name);
++ g_assert (RSVG_NODE_TYPE (newnode) != RSVG_NODE_TYPE_INVALID);
++ newnode->name = (char *) name; /* libxml will keep this while parsing */
+ newnode->parent = ctx->priv->currentnode;
+ rsvg_node_set_atts (newnode, ctx, atts);
+ rsvg_defs_register_memory (ctx->priv->defs, newnode);
+ if (ctx->priv->currentnode) {
+ rsvg_node_group_pack (ctx->priv->currentnode, newnode);
+ ctx->priv->currentnode = newnode;
+- } else if (!strcmp (name, "svg")) {
++ } else if (RSVG_NODE_TYPE (newnode) == RSVG_NODE_TYPE_SVG) {
+ ctx->priv->treebase = newnode;
+ ctx->priv->currentnode = newnode;
+ }
+@@ -689,10 +689,11 @@ rsvg_end_element (void *data, const xmlChar * name)
+ ctx->priv->handler = NULL;
+ }
+
+- if (ctx->priv->currentnode
+- && !strcmp ((const char *) name, ctx->priv->currentnode->type->str))
+- rsvg_pop_def_group (ctx);
++ if (ctx->priv->currentnode &&
++ !strcmp ((const char *) name, ctx->priv->currentnode->name))
++ rsvg_pop_def_group (ctx);
+
++ /* FIXMEchpe: shouldn't this check that currentnode == treebase or sth like that? */
+ if (ctx->priv->treebase && !strcmp ((const char *)name, "svg"))
+ _rsvg_node_svg_apply_atts ((RsvgNodeSvg *)ctx->priv->treebase, ctx);
+ }
+@@ -706,6 +707,30 @@ _rsvg_node_chars_free (RsvgNode * node)
+ _rsvg_node_free (node);
+ }
+
++static RsvgNodeChars *
++rsvg_new_node_chars (const char *text,
++ int len)
++{
++ RsvgNodeChars *self;
++
++ self = g_new (RsvgNodeChars, 1);
++ _rsvg_node_init (&self->super, RSVG_NODE_TYPE_CHARS);
++
++ if (!g_utf8_validate (text, len, NULL)) {
++ char *utf8;
++ utf8 = rsvg_make_valid_utf8 (text, len);
++ self->contents = g_string_new (utf8);
++ g_free (utf8);
++ } else {
++ self->contents = g_string_new_len (text, len);
++ }
++
++ self->super.free = _rsvg_node_chars_free;
++ self->super.state->cond_true = FALSE;
++
++ return self;
++}
++
+ static void
+ rsvg_characters_impl (RsvgHandle * ctx, const xmlChar * ch, int len)
+ {
+@@ -715,8 +740,9 @@ rsvg_characters_impl (RsvgHandle * ctx, const xmlChar * ch, int len)
+ return;
+
+ if (ctx->priv->currentnode) {
+- if (!strcmp ("tspan", ctx->priv->currentnode->type->str) ||
+- !strcmp ("text", ctx->priv->currentnode->type->str)) {
++ RsvgNodeType type = RSVG_NODE_TYPE (ctx->priv->currentnode);
++ if (type == RSVG_NODE_TYPE_TSPAN ||
++ type == RSVG_NODE_TYPE_TEXT) {
+ guint i;
+
+ /* find the last CHARS node in the text or tspan node, so that we
+@@ -724,7 +750,7 @@ rsvg_characters_impl (RsvgHandle * ctx, const xmlChar * ch, int len)
+ self = NULL;
+ for (i = 0; i < ctx->priv->currentnode->children->len; i++) {
+ RsvgNode *node = g_ptr_array_index (ctx->priv->currentnode->children, i);
+- if (!strcmp (node->type->str, "RSVG_NODE_CHARS")) {
++ if (RSVG_NODE_TYPE (node) == RSVG_NODE_TYPE_CHARS) {
+ self = (RsvgNodeChars*)node;
+ }
+ }
+@@ -744,21 +770,7 @@ rsvg_characters_impl (RsvgHandle * ctx, const xmlChar * ch, int len)
+ }
+ }
+
+- self = g_new (RsvgNodeChars, 1);
+- _rsvg_node_init (&self->super);
+-
+- if (!g_utf8_validate ((char *) ch, len, NULL)) {
+- char *utf8;
+- utf8 = rsvg_make_valid_utf8 ((char *) ch, len);
+- self->contents = g_string_new (utf8);
+- g_free (utf8);
+- } else {
+- self->contents = g_string_new_len ((char *) ch, len);
+- }
+-
+- self->super.type = g_string_new ("RSVG_NODE_CHARS");
+- self->super.free = _rsvg_node_chars_free;
+- self->super.state->cond_true = FALSE;
++ self = rsvg_new_node_chars ((char *) ch, len);
+
+ rsvg_defs_register_memory (ctx->priv->defs, (RsvgNode *) self);
+ if (ctx->priv->currentnode)
+diff --git a/rsvg-cairo-draw.c b/rsvg-cairo-draw.c
+index 0b74e22..c01cd17 100644
+--- a/rsvg-cairo-draw.c
++++ b/rsvg-cairo-draw.c
+@@ -147,7 +147,7 @@ _pattern_add_rsvg_color_stops (cairo_pattern_t * pattern,
+
+ for (i = 0; i < stops->len; i++) {
+ node = (RsvgNode *) g_ptr_array_index (stops, i);
+- if (strcmp (node->type->str, "stop"))
++ if (RSVG_NODE_TYPE (node) != RSVG_NODE_TYPE_STOP)
+ continue;
+ stop = (RsvgGradientStop *) node;
+ rgba = stop->rgba;
+diff --git a/rsvg-filter.c b/rsvg-filter.c
+index e65be41..ce96c4f 100644
+--- a/rsvg-filter.c
++++ b/rsvg-filter.c
+@@ -495,7 +495,7 @@ rsvg_filter_render (RsvgFilter * self, GdkPixbuf * source,
+
+ for (i = 0; i < self->super.children->len; i++) {
+ current = g_ptr_array_index (self->super.children, i);
+- if (!strncmp (current->super.type->str, "fe", 2))
++ if (RSVG_NODE_IS_FILTER_PRIMITIVE (¤t->super))
+ rsvg_filter_primitive_render (current, ctx);
+ }
+
+@@ -703,7 +703,7 @@ rsvg_filter_parse (const RsvgDefs * defs, const char *str)
+ val = rsvg_defs_lookup (defs, name);
+ g_free (name);
+
+- if (val && (!strcmp (val->type->str, "filter")))
++ if (val && RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_FILTER)
+ return (RsvgFilter *) val;
+ }
+ return NULL;
+@@ -754,7 +754,7 @@ rsvg_new_filter (void)
+ RsvgFilter *filter;
+
+ filter = g_new (RsvgFilter, 1);
+- _rsvg_node_init (&filter->super);
++ _rsvg_node_init (&filter->super, RSVG_NODE_TYPE_FILTER);
+ filter->filterunits = objectBoundingBox;
+ filter->primitiveunits = userSpaceOnUse;
+ filter->x = _rsvg_css_parse_length ("-10%");
+@@ -978,7 +978,7 @@ rsvg_new_filter_primitive_blend (void)
+ {
+ RsvgFilterPrimitiveBlend *filter;
+ filter = g_new (RsvgFilterPrimitiveBlend, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_BLEND);
+ filter->mode = normal;
+ filter->super.in = g_string_new ("none");
+ filter->in2 = g_string_new ("none");
+@@ -1230,7 +1230,7 @@ rsvg_new_filter_primitive_convolve_matrix (void)
+ {
+ RsvgFilterPrimitiveConvolveMatrix *filter;
+ filter = g_new (RsvgFilterPrimitiveConvolveMatrix, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_CONVOLVE_MATRIX);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -1471,7 +1471,7 @@ rsvg_new_filter_primitive_gaussian_blur (void)
+ {
+ RsvgFilterPrimitiveGaussianBlur *filter;
+ filter = g_new (RsvgFilterPrimitiveGaussianBlur, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_GAUSSIAN_BLUR);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -1607,7 +1607,7 @@ rsvg_new_filter_primitive_offset (void)
+ {
+ RsvgFilterPrimitiveOffset *filter;
+ filter = g_new (RsvgFilterPrimitiveOffset, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_OFFSET);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -1648,7 +1648,7 @@ rsvg_filter_primitive_merge_render (RsvgFilterPrimitive * self, RsvgFilterContex
+ for (i = 0; i < upself->super.super.children->len; i++) {
+ RsvgFilterPrimitive *mn;
+ mn = g_ptr_array_index (upself->super.super.children, i);
+- if (strcmp (mn->super.type->str, "feMergeNode"))
++ if (RSVG_NODE_TYPE (&mn->super) != RSVG_NODE_TYPE_FILTER_PRIMITIVE_MERGE_NODE)
+ continue;
+ in = rsvg_filter_get_in (mn->in, ctx);
+ rsvg_alpha_blt (in, boundarys.x0, boundarys.y0, boundarys.x1 - boundarys.x0,
+@@ -1701,7 +1701,7 @@ rsvg_new_filter_primitive_merge (void)
+ {
+ RsvgFilterPrimitiveMerge *filter;
+ filter = g_new (RsvgFilterPrimitiveMerge, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_MERGE);
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+ filter->super.height.factor = 'n';
+@@ -1744,7 +1744,7 @@ rsvg_new_filter_primitive_merge_node (void)
+ {
+ RsvgFilterPrimitive *filter;
+ filter = g_new (RsvgFilterPrimitive, 1);
+- _rsvg_node_init (&filter->super);
++ _rsvg_node_init (&filter->super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_MERGE_NODE);
+ filter->in = g_string_new ("none");
+ filter->super.free = rsvg_filter_primitive_merge_node_free;
+ filter->render = &rsvg_filter_primitive_merge_node_render;
+@@ -1978,7 +1978,7 @@ rsvg_new_filter_primitive_colour_matrix (void)
+ {
+ RsvgFilterPrimitiveColourMatrix *filter;
+ filter = g_new (RsvgFilterPrimitiveColourMatrix, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_COLOUR_MATRIX);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -2010,8 +2010,9 @@ struct _RsvgNodeComponentTransferFunc {
+ gint slope;
+ gint intercept;
+ gint amplitude;
+- gdouble exponent;
+ gint offset;
++ gdouble exponent;
++ char channel;
+ };
+
+ struct _RsvgFilterPrimitiveComponentTransfer {
+@@ -2107,15 +2108,18 @@ rsvg_filter_primitive_component_transfer_render (RsvgFilterPrimitive *
+ for (c = 0; c < 4; c++) {
+ char channel = "RGBA"[c];
+ for (i = 0; i < self->super.children->len; i++) {
+- RsvgNodeComponentTransferFunc *temp;
+- temp = (RsvgNodeComponentTransferFunc *)
+- g_ptr_array_index (self->super.children, i);
+- if (!strncmp (temp->super.type->str, "feFunc", 6))
+- if (temp->super.type->str[6] == channel) {
++ RsvgNode *child_node;
++
++ child_node = (RsvgNode *) g_ptr_array_index (self->super.children, i);
++ if (RSVG_NODE_TYPE (child_node) == RSVG_NODE_TYPE_FILTER_PRIMITIVE_COMPONENT_TRANSFER) {
++ RsvgNodeComponentTransferFunc *temp = (RsvgNodeComponentTransferFunc *) child_node;
++
++ if (temp->channel == channel) {
+ functions[ctx->channelmap[c]] = temp->function;
+ channels[ctx->channelmap[c]] = temp;
+ break;
+ }
++ }
+ }
+ if (i == self->super.children->len)
+ functions[ctx->channelmap[c]] = identity_component_transfer_func;
+@@ -2198,7 +2202,7 @@ rsvg_new_filter_primitive_component_transfer (void)
+ RsvgFilterPrimitiveComponentTransfer *filter;
+
+ filter = g_new (RsvgFilterPrimitiveComponentTransfer, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_COMPONENT_TRANSFER);
+ filter->super.result = g_string_new ("none");
+ filter->super.in = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -2272,7 +2276,7 @@ rsvg_new_node_component_transfer_function (char channel)
+ RsvgNodeComponentTransferFunc *filter;
+
+ filter = g_new (RsvgNodeComponentTransferFunc, 1);
+- _rsvg_node_init (&filter->super);
++ _rsvg_node_init (&filter->super, RSVG_NODE_TYPE_COMPONENT_TRANFER_FUNCTION);
+ filter->super.free = rsvg_component_transfer_function_free;
+ filter->super.set_atts = rsvg_node_component_transfer_function_set_atts;
+ filter->function = identity_component_transfer_func;
+@@ -2414,7 +2418,7 @@ rsvg_new_filter_primitive_erode (void)
+ {
+ RsvgFilterPrimitiveErode *filter;
+ filter = g_new (RsvgFilterPrimitiveErode, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_ERODE);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -2639,7 +2643,7 @@ rsvg_new_filter_primitive_composite (void)
+ {
+ RsvgFilterPrimitiveComposite *filter;
+ filter = g_new (RsvgFilterPrimitiveComposite, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_COMPOSITE);
+ filter->mode = COMPOSITE_MODE_OVER;
+ filter->super.in = g_string_new ("none");
+ filter->in2 = g_string_new ("none");
+@@ -2744,7 +2748,7 @@ rsvg_new_filter_primitive_flood (void)
+ {
+ RsvgFilterPrimitive *filter;
+ filter = g_new (RsvgFilterPrimitive, 1);
+- _rsvg_node_init (&filter->super);
++ _rsvg_node_init (&filter->super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_FLOOD);
+ filter->in = g_string_new ("none");
+ filter->result = g_string_new ("none");
+ filter->x.factor = filter->y.factor = filter->width.factor = filter->height.factor = 'n';
+@@ -2920,7 +2924,7 @@ rsvg_new_filter_primitive_displacement_map (void)
+ {
+ RsvgFilterPrimitiveDisplacementMap *filter;
+ filter = g_new (RsvgFilterPrimitiveDisplacementMap, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_DISPLACEMENT_MAP);
+ filter->super.in = g_string_new ("none");
+ filter->in2 = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+@@ -3291,7 +3295,7 @@ rsvg_new_filter_primitive_turbulence (void)
+ {
+ RsvgFilterPrimitiveTurbulence *filter;
+ filter = g_new (RsvgFilterPrimitiveTurbulence, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_TURBULENCE);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -3510,7 +3514,7 @@ rsvg_new_filter_primitive_image (void)
+ {
+ RsvgFilterPrimitiveImage *filter;
+ filter = g_new (RsvgFilterPrimitiveImage, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_IMAGE);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -3871,8 +3875,8 @@ get_light_colour (RsvgNodeLightSource * source, vector3 colour,
+
+
+ static void
+-rsvg_filter_primitive_light_source_set_atts (RsvgNode * self,
+- RsvgHandle * ctx, RsvgPropertyBag * atts)
++rsvg_node_light_source_set_atts (RsvgNode * self,
++ RsvgHandle * ctx, RsvgPropertyBag * atts)
+ {
+ RsvgNodeLightSource *data;
+ const char *value;
+@@ -3904,13 +3908,13 @@ rsvg_filter_primitive_light_source_set_atts (RsvgNode * self,
+ }
+
+ RsvgNode *
+-rsvg_new_filter_primitive_light_source (char type)
++rsvg_new_node_light_source (char type)
+ {
+ RsvgNodeLightSource *data;
+ data = g_new (RsvgNodeLightSource, 1);
+- _rsvg_node_init (&data->super);
++ _rsvg_node_init (&data->super, RSVG_NODE_TYPE_LIGHT_SOURCE);
+ data->super.free = _rsvg_node_free;
+- data->super.set_atts = rsvg_filter_primitive_light_source_set_atts;
++ data->super.set_atts = rsvg_node_light_source_set_atts;
+ data->specularExponent = 1;
+ if (type == 's')
+ data->type = SPOTLIGHT;
+@@ -3960,10 +3964,11 @@ rsvg_filter_primitive_diffuse_lighting_render (RsvgFilterPrimitive * self, RsvgF
+
+ for (i = 0; i < self->super.children->len; i++) {
+ RsvgNode *temp;
++
+ temp = g_ptr_array_index (self->super.children, i);
+- if (!strcmp (temp->type->str, "feDistantLight") ||
+- !strcmp (temp->type->str, "fePointLight") || !strcmp (temp->type->str, "feSpotLight"))
++ if (RSVG_NODE_TYPE (temp) == RSVG_NODE_TYPE_LIGHT_SOURCE) {
+ source = (RsvgNodeLightSource *) temp;
++ }
+ }
+ if (source == NULL)
+ return;
+@@ -4080,7 +4085,7 @@ rsvg_new_filter_primitive_diffuse_lighting (void)
+ {
+ RsvgFilterPrimitiveDiffuseLighting *filter;
+ filter = g_new (RsvgFilterPrimitiveDiffuseLighting, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_DIFFUSE_LIGHTING);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -4135,9 +4140,9 @@ rsvg_filter_primitive_specular_lighting_render (RsvgFilterPrimitive * self, Rsvg
+ for (i = 0; i < self->super.children->len; i++) {
+ RsvgNode *temp;
+ temp = g_ptr_array_index (self->super.children, i);
+- if (!strcmp (temp->type->str, "feDistantLight") ||
+- !strcmp (temp->type->str, "fePointLight") || !strcmp (temp->type->str, "feSpotLight"))
++ if (RSVG_NODE_TYPE (temp) == RSVG_NODE_TYPE_LIGHT_SOURCE) {
+ source = (RsvgNodeLightSource *) temp;
++ }
+ }
+ if (source == NULL)
+ return;
+@@ -4259,7 +4264,7 @@ rsvg_new_filter_primitive_specular_lighting (void)
+ {
+ RsvgFilterPrimitiveSpecularLighting *filter;
+ filter = g_new (RsvgFilterPrimitiveSpecularLighting, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_SPECULAR_LIGHTING);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+@@ -4381,7 +4386,7 @@ rsvg_new_filter_primitive_tile (void)
+ {
+ RsvgFilterPrimitiveTile *filter;
+ filter = g_new (RsvgFilterPrimitiveTile, 1);
+- _rsvg_node_init (&filter->super.super);
++ _rsvg_node_init (&filter->super.super, RSVG_NODE_TYPE_FILTER_PRIMITIVE_TILE);
+ filter->super.in = g_string_new ("none");
+ filter->super.result = g_string_new ("none");
+ filter->super.x.factor = filter->super.y.factor = filter->super.width.factor =
+diff --git a/rsvg-filter.h b/rsvg-filter.h
+index 25dac75..0aeda22 100644
+--- a/rsvg-filter.h
++++ b/rsvg-filter.h
+@@ -64,7 +64,7 @@ RsvgNode *rsvg_new_filter_primitive_displacement_map (void);
+ RsvgNode *rsvg_new_filter_primitive_turbulence (void);
+ RsvgNode *rsvg_new_filter_primitive_image (void);
+ RsvgNode *rsvg_new_filter_primitive_diffuse_lighting (void);
+-RsvgNode *rsvg_new_filter_primitive_light_source (char type);
++RsvgNode *rsvg_new_node_light_source (char type);
+ RsvgNode *rsvg_new_filter_primitive_specular_lighting (void);
+ RsvgNode *rsvg_new_filter_primitive_tile (void);
+
+diff --git a/rsvg-image.c b/rsvg-image.c
+index a81dcf5..02882bd 100644
+--- a/rsvg-image.c
++++ b/rsvg-image.c
+@@ -356,7 +356,7 @@ rsvg_new_image (void)
+ {
+ RsvgNodeImage *image;
+ image = g_new (RsvgNodeImage, 1);
+- _rsvg_node_init (&image->super);
++ _rsvg_node_init (&image->super, RSVG_NODE_TYPE_IMAGE);
+ g_assert (image->super.state);
+ image->img = NULL;
+ image->preserve_aspect_ratio = RSVG_ASPECT_RATIO_XMID_YMID;
+diff --git a/rsvg-marker.c b/rsvg-marker.c
+index 591e1e0..c7e76f1 100644
+--- a/rsvg-marker.c
++++ b/rsvg-marker.c
+@@ -84,7 +84,7 @@ rsvg_new_marker (void)
+ {
+ RsvgMarker *marker;
+ marker = g_new (RsvgMarker, 1);
+- _rsvg_node_init (&marker->super);
++ _rsvg_node_init (&marker->super, RSVG_NODE_TYPE_MARKER);
+ marker->orient = 0;
+ marker->orientAuto = FALSE;
+ marker->preserve_aspect_ratio = RSVG_ASPECT_RATIO_XMID_YMID;
+@@ -198,7 +198,7 @@ rsvg_marker_parse (const RsvgDefs * defs, const char *str)
+ val = rsvg_defs_lookup (defs, name);
+ g_free (name);
+
+- if (val && (!strcmp (val->type->str, "marker")))
++ if (val && RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_MARKER)
+ return val;
+ }
+ return NULL;
+diff --git a/rsvg-mask.c b/rsvg-mask.c
+index dd36a38..8e3cba3 100644
+--- a/rsvg-mask.c
++++ b/rsvg-mask.c
+@@ -74,7 +74,7 @@ rsvg_new_mask (void)
+ RsvgMask *mask;
+
+ mask = g_new (RsvgMask, 1);
+- _rsvg_node_init (&mask->super);
++ _rsvg_node_init (&mask->super, RSVG_NODE_TYPE_MASK);
+ mask->maskunits = objectBoundingBox;
+ mask->contentunits = userSpaceOnUse;
+ mask->x = _rsvg_css_parse_length ("0");
+@@ -113,7 +113,7 @@ rsvg_mask_parse (const RsvgDefs * defs, const char *str)
+ val = rsvg_defs_lookup (defs, name);
+ g_free (name);
+
+- if (val && (!strcmp (val->type->str, "mask")))
++ if (val && RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_MASK)
+ return val;
+ }
+ return NULL;
+@@ -130,7 +130,7 @@ rsvg_clip_path_parse (const RsvgDefs * defs, const char *str)
+ val = rsvg_defs_lookup (defs, name);
+ g_free (name);
+
+- if (val && (!strcmp (val->type->str, "clipPath")))
++ if (val && RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_CLIP_PATH)
+ return val;
+ }
+ return NULL;
+@@ -168,7 +168,7 @@ rsvg_new_clip_path (void)
+ RsvgClipPath *clip_path;
+
+ clip_path = g_new (RsvgClipPath, 1);
+- _rsvg_node_init (&clip_path->super);
++ _rsvg_node_init (&clip_path->super, RSVG_NODE_TYPE_CLIP_PATH);
+ clip_path->units = userSpaceOnUse;
+ clip_path->super.set_atts = rsvg_clip_path_set_atts;
+ clip_path->super.free = _rsvg_node_free;
+diff --git a/rsvg-paint-server.c b/rsvg-paint-server.c
+index 4967e03..7903684 100644
+--- a/rsvg-paint-server.c
++++ b/rsvg-paint-server.c
+@@ -129,11 +129,11 @@ rsvg_paint_server_parse (gboolean * inherit, const RsvgDefs * defs, const char *
+
+ if (val == NULL)
+ return NULL;
+- if (!strcmp (val->type->str, "linearGradient"))
++ if (RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_LINEAR_GRADIENT)
+ return rsvg_paint_server_lin_grad ((RsvgLinearGradient *) val);
+- else if (!strcmp (val->type->str, "radialGradient"))
++ else if (RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_RADIAL_GRADIENT)
+ return rsvg_paint_server_rad_grad ((RsvgRadialGradient *) val);
+- else if (!strcmp (val->type->str, "pattern"))
++ else if (RSVG_NODE_TYPE (val) == RSVG_NODE_TYPE_PATTERN)
+ return rsvg_paint_server_pattern ((RsvgPattern *) val);
+ else
+ return NULL;
+@@ -224,7 +224,7 @@ RsvgNode *
+ rsvg_new_stop (void)
+ {
+ RsvgGradientStop *stop = g_new (RsvgGradientStop, 1);
+- _rsvg_node_init (&stop->super);
++ _rsvg_node_init (&stop->super, RSVG_NODE_TYPE_STOP);
+ stop->super.set_atts = rsvg_stop_set_atts;
+ stop->offset = 0;
+ stop->rgba = 0;
+@@ -293,7 +293,7 @@ rsvg_new_linear_gradient (void)
+ {
+ RsvgLinearGradient *grad = NULL;
+ grad = g_new (RsvgLinearGradient, 1);
+- _rsvg_node_init (&grad->super);
++ _rsvg_node_init (&grad->super, RSVG_NODE_TYPE_LINEAR_GRADIENT);
+ _rsvg_affine_identity (grad->affine);
+ grad->has_current_color = FALSE;
+ grad->x1 = grad->y1 = grad->y2 = _rsvg_css_parse_length ("0");
+@@ -376,7 +376,7 @@ rsvg_new_radial_gradient (void)
+ {
+
+ RsvgRadialGradient *grad = g_new (RsvgRadialGradient, 1);
+- _rsvg_node_init (&grad->super);
++ _rsvg_node_init (&grad->super, RSVG_NODE_TYPE_RADIAL_GRADIENT);
+ _rsvg_affine_identity (grad->affine);
+ grad->has_current_color = FALSE;
+ grad->obj_bbox = TRUE;
+@@ -458,7 +458,7 @@ RsvgNode *
+ rsvg_new_pattern (void)
+ {
+ RsvgPattern *pattern = g_new (RsvgPattern, 1);
+- _rsvg_node_init (&pattern->super);
++ _rsvg_node_init (&pattern->super, RSVG_NODE_TYPE_PATTERN);
+ pattern->obj_bbox = TRUE;
+ pattern->obj_cbbox = FALSE;
+ pattern->x = pattern->y = pattern->width = pattern->height = _rsvg_css_parse_length ("0");
+@@ -477,7 +477,8 @@ hasstop (GPtrArray * lookin)
+ {
+ unsigned int i;
+ for (i = 0; i < lookin->len; i++) {
+- if (!strcmp (((RsvgNode *) g_ptr_array_index (lookin, i))->type->str, "stop"))
++ RsvgNode *node = g_ptr_array_index (lookin, i);
++ if (RSVG_NODE_TYPE (node) == RSVG_NODE_TYPE_STOP)
+ return 1;
+ }
+ return 0;
+@@ -490,7 +491,7 @@ rsvg_linear_gradient_fix_fallback (RsvgLinearGradient * grad)
+ int i;
+ ufallback = grad->fallback;
+ while (ufallback != NULL) {
+- if (!strcmp (ufallback->type->str, "linearGradient")) {
++ if (RSVG_NODE_TYPE (ufallback) == RSVG_NODE_TYPE_LINEAR_GRADIENT) {
+ RsvgLinearGradient *fallback = (RsvgLinearGradient *) ufallback;
+ if (!grad->hasx1 && fallback->hasx1) {
+ grad->hasx1 = TRUE;
+@@ -525,7 +526,7 @@ rsvg_linear_gradient_fix_fallback (RsvgLinearGradient * grad)
+ grad->super.children = fallback->super.children;
+ }
+ ufallback = fallback->fallback;
+- } else if (!strcmp (ufallback->type->str, "radialGradient")) {
++ } else if (RSVG_NODE_TYPE (ufallback) == RSVG_NODE_TYPE_RADIAL_GRADIENT) {
+ RsvgRadialGradient *fallback = (RsvgRadialGradient *) ufallback;
+ if (!grad->hastransform && fallback->hastransform) {
+ grad->hastransform = TRUE;
+@@ -555,7 +556,7 @@ rsvg_radial_gradient_fix_fallback (RsvgRadialGradient * grad)
+ int i;
+ ufallback = grad->fallback;
+ while (ufallback != NULL) {
+- if (!strcmp (ufallback->type->str, "radialGradient")) {
++ if (RSVG_NODE_TYPE (ufallback) == RSVG_NODE_TYPE_RADIAL_GRADIENT) {
+ RsvgRadialGradient *fallback = (RsvgRadialGradient *) ufallback;
+ if (!grad->hascx && fallback->hascx) {
+ grad->hascx = TRUE;
+@@ -594,7 +595,7 @@ rsvg_radial_gradient_fix_fallback (RsvgRadialGradient * grad)
+ grad->super.children = fallback->super.children;
+ }
+ ufallback = fallback->fallback;
+- } else if (!strcmp (ufallback->type->str, "linearGradient")) {
++ } else if (RSVG_NODE_TYPE (ufallback) == RSVG_NODE_TYPE_LINEAR_GRADIENT) {
+ RsvgLinearGradient *fallback = (RsvgLinearGradient *) ufallback;
+ if (!grad->hastransform && fallback->hastransform) {
+ grad->hastransform = TRUE;
+diff --git a/rsvg-private.h b/rsvg-private.h
+index 288c2de..162917a 100644
+--- a/rsvg-private.h
++++ b/rsvg-private.h
+@@ -255,16 +255,74 @@ struct RsvgSizeCallbackData {
+
+ void _rsvg_size_callback (int *width, int *height, gpointer data);
+
++typedef enum {
++ RSVG_NODE_TYPE_INVALID = 0,
++
++ RSVG_NODE_TYPE_CHARS,
++ RSVG_NODE_TYPE_CIRCLE,
++ RSVG_NODE_TYPE_CLIP_PATH,
++ RSVG_NODE_TYPE_COMPONENT_TRANFER_FUNCTION,
++ RSVG_NODE_TYPE_DEFS,
++ RSVG_NODE_TYPE_ELLIPSE,
++ RSVG_NODE_TYPE_FILTER,
++ RSVG_NODE_TYPE_GROUP,
++ RSVG_NODE_TYPE_IMAGE,
++ RSVG_NODE_TYPE_LIGHT_SOURCE,
++ RSVG_NODE_TYPE_LINE,
++ RSVG_NODE_TYPE_LINEAR_GRADIENT,
++ RSVG_NODE_TYPE_MARKER,
++ RSVG_NODE_TYPE_MASK,
++ RSVG_NODE_TYPE_PATH,
++ RSVG_NODE_TYPE_PATTERN,
++ RSVG_NODE_TYPE_POLYGON,
++ RSVG_NODE_TYPE_POLYLINE,
++ RSVG_NODE_TYPE_RADIAL_GRADIENT,
++ RSVG_NODE_TYPE_RECT,
++ RSVG_NODE_TYPE_STOP,
++ RSVG_NODE_TYPE_SVG,
++ RSVG_NODE_TYPE_SWITCH,
++ RSVG_NODE_TYPE_SYMBOL,
++ RSVG_NODE_TYPE_TEXT,
++ RSVG_NODE_TYPE_TREF,
++ RSVG_NODE_TYPE_TSPAN,
++ RSVG_NODE_TYPE_USE,
++
++ /* Filter primitives */
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE = 64,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_BLEND,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_COLOUR_MATRIX,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_COMPONENT_TRANSFER,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_COMPOSITE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_CONVOLVE_MATRIX,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_DIFFUSE_LIGHTING,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_DISPLACEMENT_MAP,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_ERODE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_FLOOD,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_GAUSSIAN_BLUR,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_IMAGE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_MERGE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_MERGE_NODE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_OFFSET,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_SPECULAR_LIGHTING,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_TILE,
++ RSVG_NODE_TYPE_FILTER_PRIMITIVE_TURBULENCE,
++
++} RsvgNodeType;
++
+ struct _RsvgNode {
+ RsvgState *state;
+ RsvgNode *parent;
+- GString *type;
+ GPtrArray *children;
++ RsvgNodeType type;
++ const char *name; /* owned by the xmlContext, invalid after parsing! */
+ void (*free) (RsvgNode * self);
+ void (*draw) (RsvgNode * self, RsvgDrawingCtx * ctx, int dominate);
+ void (*set_atts) (RsvgNode * self, RsvgHandle * ctx, RsvgPropertyBag *);
+ };
+
++#define RSVG_NODE_TYPE(node) ((node)->type)
++#define RSVG_NODE_IS_FILTER_PRIMITIVE(node) (RSVG_NODE_TYPE((node)) & RSVG_NODE_TYPE_FILTER_PRIMITIVE)
++
+ struct _RsvgNodeChars {
+ RsvgNode super;
+ GString *contents;
+diff --git a/rsvg-shapes.c b/rsvg-shapes.c
+index d481abf..07baf24 100644
+--- a/rsvg-shapes.c
++++ b/rsvg-shapes.c
+@@ -89,7 +89,7 @@ rsvg_new_path (void)
+ {
+ RsvgNodePath *path;
+ path = g_new (RsvgNodePath, 1);
+- _rsvg_node_init (&path->super);
++ _rsvg_node_init (&path->super, RSVG_NODE_TYPE_PATH);
+ path->d = NULL;
+ path->super.free = rsvg_node_path_free;
+ path->super.draw = rsvg_node_path_draw;
+@@ -101,7 +101,6 @@ rsvg_new_path (void)
+ struct _RsvgNodePoly {
+ RsvgNode super;
+ gdouble *pointlist;
+- gboolean is_polyline;
+ guint pointlist_len;
+ };
+
+@@ -126,7 +125,8 @@ _rsvg_node_poly_set_atts (RsvgNode * self, RsvgHandle * ctx, RsvgPropertyBag * a
+ rsvg_defs_register_name (ctx->priv->defs, value, self);
+ }
+
+- rsvg_parse_style_attrs (ctx, self->state, (poly->is_polyline ? "polyline" : "polygon"),
++ rsvg_parse_style_attrs (ctx, self->state,
++ RSVG_NODE_TYPE (self) == RSVG_NODE_TYPE_POLYLINE ? "polyline" : "polygon",
+ klazz, id, atts);
+ }
+
+@@ -160,7 +160,7 @@ _rsvg_node_poly_draw (RsvgNode * self, RsvgDrawingCtx * ctx, int dominate)
+ g_string_append (d, g_ascii_dtostr (buf, sizeof (buf), poly->pointlist[i + 1]));
+ }
+
+- if (!poly->is_polyline)
++ if (RSVG_NODE_TYPE (self) == RSVG_NODE_TYPE_POLYGON)
+ g_string_append (d, " Z");
+
+ rsvg_state_reinherit_top (ctx, self->state, dominate);
+@@ -181,16 +181,15 @@ _rsvg_node_poly_free (RsvgNode * self)
+
+
+ static RsvgNode *
+-rsvg_new_any_poly (gboolean is_polyline)
++rsvg_new_any_poly (RsvgNodeType type)
+ {
+ RsvgNodePoly *poly;
+ poly = g_new (RsvgNodePoly, 1);
+- _rsvg_node_init (&poly->super);
++ _rsvg_node_init (&poly->super, type);
+ poly->super.free = _rsvg_node_poly_free;
+ poly->super.draw = _rsvg_node_poly_draw;
+ poly->super.set_atts = _rsvg_node_poly_set_atts;
+ poly->pointlist = NULL;
+- poly->is_polyline = is_polyline;
+ poly->pointlist_len = 0;
+ return &poly->super;
+ }
+@@ -198,13 +197,13 @@ rsvg_new_any_poly (gboolean is_polyline)
+ RsvgNode *
+ rsvg_new_polygon (void)
+ {
+- return rsvg_new_any_poly (FALSE);
++ return rsvg_new_any_poly (RSVG_NODE_TYPE_POLYGON);
+ }
+
+ RsvgNode *
+ rsvg_new_polyline (void)
+ {
+- return rsvg_new_any_poly (TRUE);
++ return rsvg_new_any_poly (RSVG_NODE_TYPE_POLYLINE);
+ }
+
+
+@@ -275,7 +274,7 @@ rsvg_new_line (void)
+ {
+ RsvgNodeLine *line;
+ line = g_new (RsvgNodeLine, 1);
+- _rsvg_node_init (&line->super);
++ _rsvg_node_init (&line->super, RSVG_NODE_TYPE_LINE);
+ line->super.draw = _rsvg_node_line_draw;
+ line->super.set_atts = _rsvg_node_line_set_atts;
+ line->x1 = line->x2 = line->y1 = line->y2 = _rsvg_css_parse_length ("0");
+@@ -451,7 +450,7 @@ rsvg_new_rect (void)
+ {
+ RsvgNodeRect *rect;
+ rect = g_new (RsvgNodeRect, 1);
+- _rsvg_node_init (&rect->super);
++ _rsvg_node_init (&rect->super, RSVG_NODE_TYPE_RECT);
+ rect->super.draw = _rsvg_node_rect_draw;
+ rect->super.set_atts = _rsvg_node_rect_set_atts;
+ rect->x = rect->y = rect->w = rect->h = rect->rx = rect->ry = _rsvg_css_parse_length ("0");
+@@ -577,7 +576,7 @@ rsvg_new_circle (void)
+ {
+ RsvgNodeCircle *circle;
+ circle = g_new (RsvgNodeCircle, 1);
+- _rsvg_node_init (&circle->super);
++ _rsvg_node_init (&circle->super, RSVG_NODE_TYPE_CIRCLE);
+ circle->super.draw = _rsvg_node_circle_draw;
+ circle->super.set_atts = _rsvg_node_circle_set_atts;
+ circle->cx = circle->cy = circle->r = _rsvg_css_parse_length ("0");
+@@ -703,7 +702,7 @@ rsvg_new_ellipse (void)
+ {
+ RsvgNodeEllipse *ellipse;
+ ellipse = g_new (RsvgNodeEllipse, 1);
+- _rsvg_node_init (&ellipse->super);
++ _rsvg_node_init (&ellipse->super, RSVG_NODE_TYPE_ELLIPSE);
+ ellipse->super.draw = _rsvg_node_ellipse_draw;
+ ellipse->super.set_atts = _rsvg_node_ellipse_set_atts;
+ ellipse->cx = ellipse->cy = ellipse->rx = ellipse->ry = _rsvg_css_parse_length ("0");
+diff --git a/rsvg-shapes.h b/rsvg-shapes.h
+index 7cf6621..baad98f 100644
+--- a/rsvg-shapes.h
++++ b/rsvg-shapes.h
+@@ -34,7 +34,7 @@
+
+ G_BEGIN_DECLS
+
+-RsvgNode * rsvg_new_path (void);
++RsvgNode *rsvg_new_path (void);
+ RsvgNode *rsvg_new_polygon (void);
+ RsvgNode *rsvg_new_polyline (void);
+ RsvgNode *rsvg_new_line (void);
+diff --git a/rsvg-structure.c b/rsvg-structure.c
+index b078fea..33889be 100644
+--- a/rsvg-structure.c
++++ b/rsvg-structure.c
+@@ -103,8 +103,10 @@ _rsvg_node_dont_set_atts (RsvgNode * node, RsvgHandle * ctx, RsvgPropertyBag * a
+ }
+
+ void
+-_rsvg_node_init (RsvgNode * self)
++_rsvg_node_init (RsvgNode * self,
++ RsvgNodeType type)
+ {
++ self->type = type;
+ self->parent = NULL;
+ self->children = g_ptr_array_new ();
+ self->state = g_new (RsvgState, 1);
+@@ -112,7 +114,6 @@ _rsvg_node_init (RsvgNode * self)
+ self->free = _rsvg_node_free;
+ self->draw = _rsvg_node_draw_nothing;
+ self->set_atts = _rsvg_node_dont_set_atts;
+- self->type = NULL;
+ }
+
+ void
+@@ -124,8 +125,6 @@ _rsvg_node_finalize (RsvgNode * self)
+ }
+ if (self->children != NULL)
+ g_ptr_array_free (self->children, TRUE);
+- if (self->type != NULL)
+- g_string_free (self->type, TRUE);
+ }
+
+ void
+@@ -157,7 +156,7 @@ rsvg_new_group (void)
+ {
+ RsvgNodeGroup *group;
+ group = g_new (RsvgNodeGroup, 1);
+- _rsvg_node_init (&group->super);
++ _rsvg_node_init (&group->super, RSVG_NODE_TYPE_GROUP);
+ group->super.draw = _rsvg_node_draw_children;
+ group->super.set_atts = rsvg_node_group_set_atts;
+ return &group->super;
+@@ -166,8 +165,8 @@ rsvg_new_group (void)
+ void
+ rsvg_pop_def_group (RsvgHandle * ctx)
+ {
+- if (ctx->priv->currentnode != NULL)
+- ctx->priv->currentnode = ctx->priv->currentnode->parent;
++ g_assert (ctx->priv->currentnode != NULL);
++ ctx->priv->currentnode = ctx->priv->currentnode->parent;
+ }
+
+ void
+@@ -218,7 +217,7 @@ rsvg_node_use_draw (RsvgNode * self, RsvgDrawingCtx * ctx, int dominate)
+ return;
+
+ state = rsvg_current_state (ctx);
+- if (strcmp (child->type->str, "symbol")) {
++ if (RSVG_NODE_TYPE (child) != RSVG_NODE_TYPE_SYMBOL) {
+ _rsvg_affine_translate (affine, x, y);
+ _rsvg_affine_multiply (state->affine, affine, state->affine);
+
+@@ -397,7 +396,7 @@ rsvg_new_svg (void)
+ {
+ RsvgNodeSvg *svg;
+ svg = g_new (RsvgNodeSvg, 1);
+- _rsvg_node_init (&svg->super);
++ _rsvg_node_init (&svg->super, RSVG_NODE_TYPE_SVG);
+ svg->vbox.active = FALSE;
+ svg->preserve_aspect_ratio = RSVG_ASPECT_RATIO_XMID_YMID;
+ svg->x = _rsvg_css_parse_length ("0");
+@@ -444,7 +443,7 @@ rsvg_new_use (void)
+ {
+ RsvgNodeUse *use;
+ use = g_new (RsvgNodeUse, 1);
+- _rsvg_node_init (&use->super);
++ _rsvg_node_init (&use->super, RSVG_NODE_TYPE_USE);
+ use->super.draw = rsvg_node_use_draw;
+ use->super.set_atts = rsvg_node_use_set_atts;
+ use->x = _rsvg_css_parse_length ("0");
+@@ -485,7 +484,7 @@ rsvg_new_symbol (void)
+ {
+ RsvgNodeSymbol *symbol;
+ symbol = g_new (RsvgNodeSymbol, 1);
+- _rsvg_node_init (&symbol->super);
++ _rsvg_node_init (&symbol->super, RSVG_NODE_TYPE_SYMBOL);
+ symbol->vbox.active = FALSE;
+ symbol->preserve_aspect_ratio = RSVG_ASPECT_RATIO_XMID_YMID;
+ symbol->super.draw = _rsvg_node_draw_nothing;
+@@ -498,7 +497,7 @@ rsvg_new_defs (void)
+ {
+ RsvgNodeGroup *group;
+ group = g_new (RsvgNodeGroup, 1);
+- _rsvg_node_init (&group->super);
++ _rsvg_node_init (&group->super, RSVG_NODE_TYPE_DEFS);
+ group->super.draw = _rsvg_node_draw_nothing;
+ group->super.set_atts = rsvg_node_group_set_atts;
+ return &group->super;
+@@ -533,7 +532,7 @@ rsvg_new_switch (void)
+ {
+ RsvgNodeGroup *group;
+ group = g_new (RsvgNodeGroup, 1);
+- _rsvg_node_init (&group->super);
++ _rsvg_node_init (&group->super, RSVG_NODE_TYPE_SWITCH);
+ group->super.draw = _rsvg_node_switch_draw;
+ group->super.set_atts = rsvg_node_group_set_atts;
+ return &group->super;
+diff --git a/rsvg-structure.h b/rsvg-structure.h
+index d672977..7d17c82 100644
+--- a/rsvg-structure.h
++++ b/rsvg-structure.h
+@@ -36,7 +36,7 @@
+
+ G_BEGIN_DECLS
+
+-RsvgNode * rsvg_new_use (void);
++RsvgNode *rsvg_new_use (void);
+ RsvgNode *rsvg_new_symbol (void);
+ RsvgNode *rsvg_new_svg (void);
+ RsvgNode *rsvg_new_defs (void);
+@@ -50,6 +50,7 @@ typedef struct _RsvgNodeSvg RsvgNodeSvg;
+
+ struct _RsvgNodeGroup {
+ RsvgNode super;
++ char *name;
+ };
+
+ struct _RsvgNodeSymbol {
+@@ -80,7 +81,7 @@ void rsvg_node_draw (RsvgNode * self, RsvgDrawingCtx * ctx, int dominate
+ void _rsvg_node_draw_children (RsvgNode * self, RsvgDrawingCtx * ctx, int dominate);
+ void _rsvg_node_finalize (RsvgNode * self);
+ void _rsvg_node_free (RsvgNode * self);
+-void _rsvg_node_init (RsvgNode * self);
++void _rsvg_node_init (RsvgNode * self, RsvgNodeType type);
+ void _rsvg_node_svg_apply_atts (RsvgNodeSvg * self, RsvgHandle * ctx);
+
+ G_END_DECLS
+diff --git a/rsvg-text.c b/rsvg-text.c
+index 7066f24..89720de 100644
+--- a/rsvg-text.c
++++ b/rsvg-text.c
+@@ -170,17 +170,19 @@ _rsvg_node_text_type_children (RsvgNode * self, RsvgDrawingCtx * ctx,
+ rsvg_push_discrete_layer (ctx);
+ for (i = 0; i < self->children->len; i++) {
+ RsvgNode *node = g_ptr_array_index (self->children, i);
+- if (!strcmp (node->type->str, "RSVG_NODE_CHARS")) {
++ RsvgNodeType type = RSVG_NODE_TYPE (node);
++
++ if (type == RSVG_NODE_TYPE_CHARS) {
+ RsvgNodeChars *chars = (RsvgNodeChars *) node;
+ GString *str = _rsvg_text_chomp (rsvg_current_state (ctx), chars->contents, lastwasspace);
+ rsvg_text_render_text (ctx, str->str, x, y);
+ g_string_free (str, TRUE);
+- } else if (!strcmp (node->type->str, "tspan")) {
++ } else if (type == RSVG_NODE_TYPE_TSPAN) {
+ RsvgNodeText *tspan = (RsvgNodeText *) node;
+ rsvg_state_push (ctx);
+ _rsvg_node_text_type_tspan (tspan, ctx, x, y, lastwasspace);
+ rsvg_state_pop (ctx);
+- } else if (!strcmp (node->type->str, "tref")) {
++ } else if (type == RSVG_NODE_TYPE_TREF) {
+ RsvgNodeTref *tref = (RsvgNodeTref *) node;
+ _rsvg_node_text_type_tref (tref, ctx, x, y, lastwasspace);
+ }
+@@ -206,17 +208,19 @@ _rsvg_node_text_length_children (RsvgNode * self, RsvgDrawingCtx * ctx,
+ int out = FALSE;
+ for (i = 0; i < self->children->len; i++) {
+ RsvgNode *node = g_ptr_array_index (self->children, i);
++ RsvgNodeType type = RSVG_NODE_TYPE (node);
++
+ rsvg_state_push (ctx);
+ rsvg_state_reinherit_top (ctx, node->state, 0);
+- if (!strcmp (node->type->str, "RSVG_NODE_CHARS")) {
++ if (type == RSVG_NODE_TYPE_CHARS) {
+ RsvgNodeChars *chars = (RsvgNodeChars *) node;
+ GString *str = _rsvg_text_chomp (rsvg_current_state (ctx), chars->contents, lastwasspace);
+ *x += rsvg_text_length_text_as_string (ctx, str->str);
+ g_string_free (str, TRUE);
+- } else if (!strcmp (node->type->str, "tspan")) {
++ } else if (type == RSVG_NODE_TYPE_TSPAN) {
+ RsvgNodeText *tspan = (RsvgNodeText *) node;
+ out = _rsvg_node_text_length_tspan (tspan, ctx, x, lastwasspace);
+- } else if (!strcmp (node->type->str, "tref")) {
++ } else if (type == RSVG_NODE_TYPE_TREF) {
+ RsvgNodeTref *tref = (RsvgNodeTref *) node;
+ out = _rsvg_node_text_length_tref (tref, ctx, x, lastwasspace);
+ }
+@@ -259,7 +263,7 @@ rsvg_new_text (void)
+ {
+ RsvgNodeText *text;
+ text = g_new (RsvgNodeText, 1);
+- _rsvg_node_init (&text->super);
++ _rsvg_node_init (&text->super, RSVG_NODE_TYPE_TEXT);
+ text->super.draw = _rsvg_node_text_draw;
+ text->super.set_atts = _rsvg_node_text_set_atts;
+ text->x = text->y = text->dx = text->dy = _rsvg_css_parse_length ("0");
+@@ -331,7 +335,7 @@ rsvg_new_tspan (void)
+ {
+ RsvgNodeText *text;
+ text = g_new (RsvgNodeText, 1);
+- _rsvg_node_init (&text->super);
++ _rsvg_node_init (&text->super, RSVG_NODE_TYPE_TSPAN);
+ text->super.set_atts = _rsvg_node_tspan_set_atts;
+ text->x.factor = text->y.factor = 'n';
+ text->dx = text->dy = _rsvg_css_parse_length ("0");
+@@ -374,7 +378,7 @@ rsvg_new_tref (void)
+ {
+ RsvgNodeTref *text;
+ text = g_new (RsvgNodeTref, 1);
+- _rsvg_node_init (&text->super);
++ _rsvg_node_init (&text->super, RSVG_NODE_TYPE_TREF);
+ text->super.set_atts = _rsvg_node_tref_set_atts;
+ text->link = NULL;
+ return &text->super;
+--
+1.7.0.5
+
diff --git a/meta/recipes-gnome/librsvg/librsvg_2.32.1.bb b/meta/recipes-gnome/librsvg/librsvg_2.32.1.bb
index 100b51e..ad17014 100644
--- a/meta/recipes-gnome/librsvg/librsvg_2.32.1.bb
+++ b/meta/recipes-gnome/librsvg/librsvg_2.32.1.bb
@@ -11,7 +11,7 @@ DEPENDS = "gtk+ cairo libxml2"
DEPENDS_virtclass-native = "cairo-native pango-native gdk-pixbuf-native"
BBCLASSEXTEND = "native"
-PR = "r10"
+PR = "r11"
inherit autotools pkgconfig gnome gtk-doc
@@ -23,7 +23,9 @@ PACKAGECONFIG_virtclass-native = ""
PACKAGECONFIG[croco] = "--with-croco,--without-croco,libcroco"
-SRC_URI += "file://doc_Makefile.patch"
+SRC_URI += "file://doc_Makefile.patch \
+ file://librsvg-CVE-2011-3146.patch \
+ "
SRC_URI[archive.md5sum] = "4b00d0fee130c936644892c152f42db7"
SRC_URI[archive.sha256sum] = "91b98051f352fab8a6257688d6b2fd665b4648ed66144861f2f853ccf876d334"
--
1.7.10.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [danny] Consolidated Pull Request
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
` (6 preceding siblings ...)
2013-01-07 11:10 ` [PATCH 7/7] librsvg: CVE-2011-3146 Ross Burton
@ 2013-01-07 11:34 ` Richard Purdie
7 siblings, 0 replies; 9+ messages in thread
From: Richard Purdie @ 2013-01-07 11:34 UTC (permalink / raw)
To: Ross Burton; +Cc: openembedded-core
On Mon, 2013-01-07 at 11:09 +0000, Ross Burton wrote:
> Hi,
>
> This short series is mainly to fix a udev booting regression on hddimg and
> brings in a number of CVE fixes, with two other good fixing coming along.
>
> d88bdd6 librsvg: CVE-2011-3146
> c30e7e5 cups CVE-2011-3170
> b91e5f6 cups - CVE-2011-2896
> 6f966f8 cups: CVE-2012-5519
> d25e356 libnss-mdns: fix mDNS resolving speed
> 002ef4a Revert "initrdscripts: fix udevd in the live boot init scripts"
> 774b05e bootimg: Use FAT 32 for images larger than 512MB
Merged to danny, thanks.
Richard
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-01-07 11:49 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-07 11:09 [danny] Consolidated Pull Request Ross Burton
2013-01-07 11:09 ` [PATCH 1/7] bootimg: Use FAT 32 for images larger than 512MB Ross Burton
2013-01-07 11:09 ` [PATCH 2/7] Revert "initrdscripts: fix udevd in the live boot init scripts" Ross Burton
2013-01-07 11:09 ` [PATCH 3/7] libnss-mdns: fix mDNS resolving speed Ross Burton
2013-01-07 11:09 ` [PATCH 4/7] cups: CVE-2012-5519 Ross Burton
2013-01-07 11:10 ` [PATCH 5/7] cups - CVE-2011-2896 Ross Burton
2013-01-07 11:10 ` [PATCH 6/7] cups CVE-2011-3170 Ross Burton
2013-01-07 11:10 ` [PATCH 7/7] librsvg: CVE-2011-3146 Ross Burton
2013-01-07 11:34 ` [danny] Consolidated Pull Request Richard Purdie
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox