#602022 lprm: SIGSEGV signal with "-w" option

Package:
lpr
Source:
lpr
Description:
BSD lpr/lpd line printer spooling system
Submitter:
vladz
Date:
2026-02-05 04:59:03 UTC
Severity:
normal
Tags:
#602022#5
Date:
2010-10-31 20:53:49 UTC
From:
To:
I am using Debian squeeze/sid.

According to the lprm's source code, this command (which is setuid-root on
squeeze/sid) can be used with the "-w" option in order to specify a timeout
value.  But the program exits with SIGSEGV signal when using this option:

  $ lprm -w 30
  Segmentation fault

  $ cat -n lpr-2008.05.17/lprm/lprm.c
  [...]
  120		while ((ch = getopt(argc, argv, "P:w")) != -1) {
  121			switch (ch) {
  122			case 'P':
  123				printer = optarg;
  124				break;
  125			case 'w':
  126				l = strtol(optarg, &cp, 10);
  127				if (*cp != '\0' || l < 0 || l >= INT_MAX)

As seen in the source code, when parsing options (line 125 and 126),
"optarg" (supposed to be -w's argument) is stored as a long integer into
"&cp", but it fails because "optarg" is always NULL.  Function getopt()
sets optarg only when an option takes an argument, and according to the
optstring ("P:w", line 120), "-w" does not require an option which is
wrong.

Why is this option not documented in lprm(1) or "--help" ?

Anyway, this fixes the bug :
--- lprm.c.orig	2010-10-31 18:25:25.000000000 +0100
+++ lprm.c	2010-10-31 18:25:45.000000000 +0100
@@ -117,7 +117,7 @@
 		fatal("Your name is too long");
 	strlcpy(luser, pw->pw_name, sizeof(luser));
 	person = luser;
-	while ((ch = getopt(argc, argv, "P:w")) != -1) {
+	while ((ch = getopt(argc, argv, "P:w:")) != -1) {
 		switch (ch) {
 		case 'P':
 			printer = optarg;