Will calling ippDelete(request) or ippDelete(response) cause a crash?

[shilaoer1991]

Hello
I use cupsSendRequest to get printer status information. After successfully calling cupsGetResponse, should I immediately delete the request object with ippDelete? If I read the response attributes first and then call ippDelete in sequence, will there be any issues?

This is my code:

ipp_t *request = NULL;
 ipp_t *response = NULL;
 http_status_t result;
 request = ippNewRequest(op);
 ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, printer_uri);
 ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "requested-attributes",
         sizeof(pattrs) / sizeof(pattrs[0]), NULL, pattrs);

 do {
     result = cupsSendRequest(http, request, resource, ippLength(request));
     if (result <= HTTP_STATUS_CONTINUE || result == HTTP_STATUS_OK) {
         response = cupsGetResponse(http, resource);
         result = httpGetStatus(http);
     }

     if (result == HTTP_STATUS_ERROR ||  (result >= HTTP_STATUS_BAD_REQUEST && 
         result != HTTP_STATUS_UNAUTHORIZED && result != HTTP_STATUS_UPGRADE_REQUIRED)) {
         _cupsSetHTTPError(result);
         break;
     }

     if (http->state != HTTP_STATE_WAITING) {
         httpFlush(http);
     }
 } while (response == NULL);
 
 if (response  && (attrptr = ippFindAttribute(response, "printer-state", IPP_TAG_ENUM)) != NULL) {
      printer_ippstate = (ipp_pstate_t) ippGetInteger(attrptr, 0);
 }

 ippDelete(request);
 ippDelete(response);

[michaelrsweet]

Unlike cupsDoXxxRequest, cupsSendRequest does not delete the IPP request, so calling ippDelete is both safe and required.

You must call ippDelete on any IPP response when you are done using it (ippDelete is smart enough to ignore a NULL pointer if you happen to call it with one...)

[shilaoer1991]

Thank you for your answer. If Ippdelete is indeed safe, what could be the possible causes of the crash stack I encountered? I have reviewed the relevant source code of libcups, but did not find the cause of the crash. Do you have any better suggestions or ideas?

signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: 'Scudo ERROR: corrupted chunk header at address 0x200007bed31f910'
    x0  0000000000000000  x1  0000000000004ed6  x2  0000000000000006  x3  0000007b94e5d080
    x4  6064671f6a6d7467  x5  6064671f6a6d7467  x6  6064671f6a6d7467  x7  7f7f7f7f7f7f7f7f
    x8  00000000000000f0  x9  0000007e3f495588  x10 0000000000000001  x11 0000007e3f4e75a0
    x12 00000000683adf6f  x13 000000007fffffff  x14 0000000003060d60  x15 0000027e4aeb85f8
    x16 0000007e3f551008  x17 0000007e3f53b2c0  x18 0000007b9261c000  x19 0000000000001e4e
    x20 0000000000004ed6  x21 00000000ffffffff  x22 b400007d8d392e78  x23 0000000000000002
    x24 0000007b94e5ea80  x25 0000007b94e5d3c8  x26 0000007b94e5ea70  x27 0000007a78876fe0
    x28 0000000000104000  x29 0000007b94e5d100
    lr  0000007e3f4cfe98  sp  0000007b94e5d060  pc  0000007e3f4cfec4  pst 0000000000001000

15 total frames
backtrace:
      #00 pc 000000000005dec4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #01 pc 00000000000495c8  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+8) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #02 pc 000000000004a28c  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportRawError(char const*)+28) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #03 pc 000000000004a1fc  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::ScopedErrorReport::~ScopedErrorReport()+12) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #04 pc 000000000004a360  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportHeaderCorruption(void*)+96) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #05 pc 000000000004bdb8  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidNormalConfig, &scudo_malloc_postinit>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+280) (BuildId: 6e6d388a18e01218afe76eed8954f27f)
      #06 pc 000000000004cf64  /system/lib64/libcups.so (_cupsStrFree+100) (BuildId: 403aaa2b86c87946383ca2fe84737950)
      #07 pc 0000000000039dc4  /system/lib64/libcups.so (ipp_free_values+132) (BuildId: 403aaa2b86c87946383ca2fe84737950)
      #08 pc 0000000000039d20  /system/lib64/libcups.so (ippDelete+112) (BuildId: 403aaa2b86c87946383ca2fe84737950)

[michaelrsweet]

There isn't enough information here to say. Try building with address sanitizer enabled - if you have some sort of memory corruption in your application, that could lead to the problems when the IPP response is freed.

[shilaoer1991]

Thanks. I will continue to try to locate the issue according to your suggestions.