>Number:         17473
>Category:       bin
>Synopsis:       lpr options processing missing 'break'
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul 03 14:11:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Brian Ginsbach
>Release:        NetBSD 1.5.2, current
>Organization:
Cray Inc.
>Environment:
System: NetBSD nbtest.mw.cray.com 1.5.2 NetBSD 1.5.2 (NBTEST) #1: Wed Feb 20 03:38:32 CST 2002 ginsbach@nbtest.mw.cray.com:/usr/src/sys/arch/i386/compile/NBTEST i386


>Description:
	The command line options processing in lpr is missing a
	break in the case statement.  This missing break causes
	the n copy option '-#' to also set the troff font array.
	This probably won't work as intended and would cause a
	overflow of the fonts array.

	Also fix the usage and getopt options so that m comes before
	n and after l as expected.

>How-To-Repeat:
	This found by inpsection.

static char	*fonts[4];	/* troff font names */
...

		case '#':		/* n copies */
			if (isdigit(*optarg)) {
				i = atoi(optarg);
				if (i > 0)
					ncopies = i;
			}
Note missing break >>>>

		case '4':		/* troff fonts */
		case '3':
		case '2':
		case '1':
			fonts[optopt - '1'] = optarg;
			break;

Note that optopt - '1', when optopt is #, would be 35 - 49 or -14
which is not a good array index.
	
>Fix:
Index: lpr.c
===================================================================
RCS file: /cvsroot/basesrc/usr.sbin/lpr/lpr/lpr.c,v
retrieving revision 1.21
diff -u -r1.21 lpr.c
--- lpr.c	2002/06/08 23:43:24	1.21
+++ lpr.c	2002/07/03 20:43:12
@@ -153,7 +153,7 @@
 
 	errs = 0;
 	while ((c = getopt(argc, argv,
-	    ":#:1:2:3:4:C:J:P:T:U:cdfghi:lnmprstvw:")) != -1) {
+	    ":#:1:2:3:4:C:J:P:T:U:cdfghi:lmnprstvw:")) != -1) {
 		switch (c) {
 
 		case '#':		/* n copies */
@@ -162,6 +162,7 @@
 				if (i > 0)
 					ncopies = i;
 			}
+			break;
 
 		case '4':		/* troff fonts */
 		case '3':
@@ -787,6 +788,6 @@
 	fprintf(stderr, "%s\n%s\n",
 	    "usage: lpr [-Pprinter] [-#num] [-C class] [-J job] [-T title] "
 	    "[-U user]",
-	    "[-i[numcols]] [-1234 font] [-wnum] [-cdfghlnmprstv] [name ...]");
+	    "[-i[numcols]] [-1234 font] [-wnum] [-cdfghlmnprstv] [name ...]");
 	exit(1);
 }
>Release-Note:
>Audit-Trail:
>Unformatted: