Fix Heap UAF in cupsdContinueJob via Concurrent Filter Deletion

[Ashwinjali]

A heap use-after-free vulnerability exists in the CUPS scheduler where cupsdContinueJob drops MimeDatabase->lock while retaining references to borrowed mime_filter_t pointers in a local filters array.

While the lock is temporarily dropped, a concurrent background thread (e.g., create_local_bg_thread processing an unauthenticated CUPS-Create-Local-Printer request) can trigger cupsdSetPrinterAttrs which calls delete_printer_filters. This unconditionally frees the mime_filter_t objects. When the main thread resumes and dereferences these pointers later in the job processing loop, it results in a UAF.

This patch resolves the issue by creating a deep copy of the borrowed mime_filter_t pointers into a privately owned array before dropping the lock. This ensures the main thread iterates over a safe snapshot of the filter data, preventing the UAF if the original filters are freed in the background.

[michaelrsweet]

Deep copying is the wrong fix.

If a job is in progress then the MIME database entries should not be updated at all. We need to fix that erroneous behavior.

But honestly until the printer is actually setup you can't actually print - did you actually run into this issue or is this a theoretical AI-detected flaw that can't actually happen?