diff --git a/cups-str3262.patch b/cups-str3262.patch
new file mode 100644
index 0000000..3d9416c
--- /dev/null
+++ b/cups-str3262.patch
@@ -0,0 +1,21 @@
+diff -up cups-1.4rc1/backend/ipp.c.str3262 cups-1.4rc1/backend/ipp.c
+--- cups-1.4rc1/backend/ipp.c.str3262	2009-07-28 13:12:55.021509189 +0100
++++ cups-1.4rc1/backend/ipp.c	2009-07-28 13:13:19.817508734 +0100
+@@ -1315,7 +1315,16 @@ main(int  argc,				/* I - Number of comm
+       if (response)
+       {
+ 	if ((job_state = ippFindAttribute(response, "job-state",
+-	                                  IPP_TAG_ENUM)) != NULL)
++	                                  IPP_TAG_ENUM)) == NULL)
++	{
++	  ippDelete(response);
++
++	  _cupsLangPrintf(stderr,
++			  _("ERROR: Unable to get job-state for job %d!\n"),
++			  job_id);
++	  break;
++	}
++	else
+ 	{
+ 	 /*
+           * Stop polling if the job is finished or pending-held...
diff --git a/cups.spec b/cups.spec
index 04ee248..36bd6c8 100644
--- a/cups.spec
+++ b/cups.spec
@@ -57,7 +57,8 @@ Patch30: cups-uri-compat.patch
 Patch31: cups-str3254.patch
 Patch32: cups-str3253.patch
 Patch33: cups-str3266.patch
-Patch34: cups-avahi.patch
+Patch34: cups-str3262.patch
+Patch35: cups-avahi.patch
 Patch100: cups-lspp.patch
 Epoch: 1
 Url: http://www.cups.org/
@@ -212,7 +213,8 @@ module.
 %patch31 -p1 -b .str3254
 %patch32 -p1 -b .str3253
 %patch33 -p1 -b .str3266
-#%patch34 -p1 -b .avahi
+%patch34 -p1 -b .str3262
+#%patch35 -p1 -b .avahi
 
 %if %lspp
 %patch100 -p1 -b .lspp
@@ -506,6 +508,8 @@ rm -rf $RPM_BUILD_ROOT
 
 %changelog
 * Tue Jul 28 2009 Tim Waugh <twaugh@redhat.com> 1:1.4-0.rc1.12
+- Prevent ipp backend looping with bad IPP devices (bug #476424,
+  STR #3262).
 - Fixed Device ID reporting in the usb backend (STR #3266).
 
 * Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.4-0.rc1.11.1