guard nvalues before reading values[nvalues-1] in cgi var getters

[aizu-m]

cgiGetVariable, cgiGetCheckbox and cgiGetTextfield read values[nvalues - 1] without the bounds check cgiGetArray already has, so a variable emptied by cgiSetSize(name, 0) indexes values[-1] and the stale word is then dereferenced as a char *; guard nvalues first.

[michaelrsweet]

Have you actually reproduced this issue happening?

[aizu-m]

Yes. Found it while running the cgi-bin code under AddressSanitizer.

Minimal repro, linked against the project's var.c + libcups:

#include "cgi.h"
int main(void) {
  cgiSetVariable("FOO", "bar");   /* nvalues = 1 */
  cgiSetSize("FOO", 0);           /* nvalues = 0, values buffer kept */
  return cgiGetVariable("FOO") ? 0 : 1;  /* reads values[-1] */
}

Before the patch ASAN flags a heap-buffer-overflow READ of size 8 at var.c:316, 8 bytes before the values region, and that stale word is then handed to strdup(). cgiGetCheckbox (var.c:193) and cgiGetTextfield (var.c:270) do the same values[nvalues-1] read.

The reachable path is the printer options page. admin.c empties PARAMS/PARAMTEXT/PARAMVALUE/INPUTTYPE with cgiSetSize(name, 0) around line 2908, and for a standard (non-custom) option those are never refilled, so they sit in the table with nvalues=0. The template then reads them as scalars in the {#name?...} existence test, which goes through cgiGetVariable (template.c:454) and hits the values[-1] read. cgiGetArray already guards element against nvalues; these three getters don't, which is all the patch lines up.