summaryrefslogtreecommitdiff
path: root/patches/source/cups/cups-1.3.x.CVE-2010-2941.diff
blob: 5dd4d7c08cb93c0c95205511ad821fcf5e5c8ccb (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
--- ./cups/ipp.c.orig	2009-01-21 17:43:53.000000000 -0600
+++ ./cups/ipp.c	2010-11-27 13:05:25.000000000 -0600
@@ -1187,15 +1187,18 @@
 
 	      attr->value_tag = tag;
 	    }
-	    else if (value_tag >= IPP_TAG_TEXTLANG &&
-		     value_tag <= IPP_TAG_MIMETYPE)
+	    else if (value_tag == IPP_TAG_TEXTLANG ||
+		     value_tag == IPP_TAG_NAMELANG ||
+		     (value_tag >= IPP_TAG_TEXT &&
+		      value_tag <= IPP_TAG_MIMETYPE))
             {
 	     /*
 	      * String values can sometimes come across in different
 	      * forms; accept sets of differing values...
 	      */
 
-	      if (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE)
+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&
+		  (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE))
 	        return (IPP_ERROR);
             }
 	    else if (value_tag != tag)
@@ -2529,6 +2532,7 @@
   {
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
+    case IPP_TAG_RESERVED_STRING :
     case IPP_TAG_KEYWORD :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
--- ./cups/ipp.h.orig	2008-07-11 17:48:49.000000000 -0500
+++ ./cups/ipp.h	2010-11-27 13:05:25.000000000 -0600
@@ -94,7 +94,8 @@
   IPP_TAG_END_COLLECTION,		/* End of collection value */
   IPP_TAG_TEXT = 0x41,			/* Text value */
   IPP_TAG_NAME,				/* Name value */
-  IPP_TAG_KEYWORD = 0x44,		/* Keyword value */
+  IPP_TAG_RESERVED_STRING,		/* Reserved for future string value @private@ */
+  IPP_TAG_KEYWORD,			/* Keyword value */
   IPP_TAG_URI,				/* URI value */
   IPP_TAG_URISCHEME,			/* URI scheme value */
   IPP_TAG_CHARSET,			/* Character set value */