diff options
Diffstat (limited to 'patches/source/cups/cups-1.3.x.CVE-2010-2941.diff')
| -rw-r--r-- | patches/source/cups/cups-1.3.x.CVE-2010-2941.diff | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/patches/source/cups/cups-1.3.x.CVE-2010-2941.diff b/patches/source/cups/cups-1.3.x.CVE-2010-2941.diff new file mode 100644 index 000000000..5dd4d7c08 --- /dev/null +++ b/patches/source/cups/cups-1.3.x.CVE-2010-2941.diff @@ -0,0 +1,44 @@ +--- ./cups/ipp.c.orig 2009-01-21 17:43:53.000000000 -0600 ++++ ./cups/ipp.c 2010-11-27 13:05:25.000000000 -0600 +@@ -1187,15 +1187,18 @@ + + attr->value_tag = tag; + } +- else if (value_tag >= IPP_TAG_TEXTLANG && +- value_tag <= IPP_TAG_MIMETYPE) ++ else if (value_tag == IPP_TAG_TEXTLANG || ++ value_tag == IPP_TAG_NAMELANG || ++ (value_tag >= IPP_TAG_TEXT && ++ value_tag <= IPP_TAG_MIMETYPE)) + { + /* + * String values can sometimes come across in different + * forms; accept sets of differing values... + */ + +- if (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE) ++ if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG && ++ (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE)) + return (IPP_ERROR); + } + else if (value_tag != tag) +@@ -2529,6 +2532,7 @@ + { + case IPP_TAG_TEXT : + case IPP_TAG_NAME : ++ case IPP_TAG_RESERVED_STRING : + case IPP_TAG_KEYWORD : + case IPP_TAG_URI : + case IPP_TAG_URISCHEME : +--- ./cups/ipp.h.orig 2008-07-11 17:48:49.000000000 -0500 ++++ ./cups/ipp.h 2010-11-27 13:05:25.000000000 -0600 +@@ -94,7 +94,8 @@ + IPP_TAG_END_COLLECTION, /* End of collection value */ + IPP_TAG_TEXT = 0x41, /* Text value */ + IPP_TAG_NAME, /* Name value */ +- IPP_TAG_KEYWORD = 0x44, /* Keyword value */ ++ IPP_TAG_RESERVED_STRING, /* Reserved for future string value @private@ */ ++ IPP_TAG_KEYWORD, /* Keyword value */ + IPP_TAG_URI, /* URI value */ + IPP_TAG_URISCHEME, /* URI scheme value */ + IPP_TAG_CHARSET, /* Character set value */ |