48 lines
2.0 KiB
Diff
48 lines
2.0 KiB
Diff
diff -up cups-1.4.4/cups/ipp.c.CVE-2010-2941 cups-1.4.4/cups/ipp.c
|
|
--- cups-1.4.4/cups/ipp.c.CVE-2010-2941 2010-04-23 19:56:34.000000000 +0100
|
|
+++ cups-1.4.4/cups/ipp.c 2010-11-11 11:30:28.566745595 +0000
|
|
@@ -1275,7 +1275,9 @@ ippReadIO(void *src, /* I - Data
|
|
|
|
attr->value_tag = tag;
|
|
}
|
|
- else if ((value_tag >= IPP_TAG_TEXTLANG &&
|
|
+ else if (value_tag == IPP_TAG_TEXTLANG ||
|
|
+ value_tag == IPP_TAG_NAMELANG ||
|
|
+ (value_tag >= IPP_TAG_TEXT &&
|
|
value_tag <= IPP_TAG_MIMETYPE))
|
|
{
|
|
/*
|
|
@@ -1283,8 +1285,9 @@ ippReadIO(void *src, /* I - Data
|
|
* forms; accept sets of differing values...
|
|
*/
|
|
|
|
- if ((tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE) &&
|
|
- tag != IPP_TAG_NOVALUE)
|
|
+ if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&
|
|
+ (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE) &&
|
|
+ tag != IPP_TAG_NOVALUE)
|
|
{
|
|
DEBUG_printf(("1ippReadIO: 1setOf value tag %x(%s) != %x(%s)",
|
|
value_tag, ippTagString(value_tag), tag,
|
|
@@ -2766,6 +2769,7 @@ _ippFreeAttr(ipp_attribute_t *attr) /* I
|
|
{
|
|
case IPP_TAG_TEXT :
|
|
case IPP_TAG_NAME :
|
|
+ case IPP_TAG_RESERVED_STRING :
|
|
case IPP_TAG_KEYWORD :
|
|
case IPP_TAG_URI :
|
|
case IPP_TAG_URISCHEME :
|
|
diff -up cups-1.4.4/cups/ipp.h.CVE-2010-2941 cups-1.4.4/cups/ipp.h
|
|
--- cups-1.4.4/cups/ipp.h.CVE-2010-2941 2010-04-23 19:56:34.000000000 +0100
|
|
+++ cups-1.4.4/cups/ipp.h 2010-11-11 11:30:28.568745537 +0000
|
|
@@ -93,7 +93,8 @@ typedef enum ipp_tag_e /**** Format ta
|
|
IPP_TAG_END_COLLECTION, /* End of collection value */
|
|
IPP_TAG_TEXT = 0x41, /* Text value */
|
|
IPP_TAG_NAME, /* Name value */
|
|
- IPP_TAG_KEYWORD = 0x44, /* Keyword value */
|
|
+ IPP_TAG_RESERVED_STRING, /* Reserved for future string value @private@ */
|
|
+ IPP_TAG_KEYWORD, /* Keyword value */
|
|
IPP_TAG_URI, /* URI value */
|
|
IPP_TAG_URISCHEME, /* URI scheme value */
|
|
IPP_TAG_CHARSET, /* Character set value */
|