ALT Linux repositórios
| S: | 2.4.7-alt1 |
| 5.0: | 1.3.10-alt1 |
| 4.1: | 1.3.10-alt0.M41.4 |
| +updates: | 1.3.9-alt1.M41.1 |
| 4.0: | 1.2.12-alt6.M40.9 |
| +updates: | 1.2.12-alt6.M40.8 |
| 3.0: | 1.1.20-alt14.1 |
Group :: Sistema/Servidores
RPM: cups
Navegação
Main Changelog Spec Patches Sources Download Gear Bugs e FR Repocop
Patch: cups-1.2.12-CVE-2007-4351.patch
Download
Download
Index: ipp.c
===================================================================
--- ipp.c (revision 7023)
+++ ipp.c (working copy)
@@ -1315,6 +1315,12 @@
{case IPP_TAG_INTEGER :
case IPP_TAG_ENUM :
+ if (n != 4)
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, 4) < 4)
{ DEBUG_puts("ippReadIO: Unable to read integer value!");@@ -1327,6 +1333,12 @@
value->integer = n;
break;
case IPP_TAG_BOOLEAN :
+ if (n != 1)
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, 1) < 1)
{ DEBUG_puts("ippReadIO: Unable to read boolean value!");@@ -1344,6 +1356,12 @@
case IPP_TAG_CHARSET :
case IPP_TAG_LANGUAGE :
case IPP_TAG_MIMETYPE :
+ if (n >= sizeof(buffer))
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, n) < n)
{ DEBUG_puts("ippReadIO: unable to read name!");@@ -1356,6 +1374,12 @@
value->string.text));
break;
case IPP_TAG_DATE :
+ if (n != 11)
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, value->date, 11) < 11)
{ DEBUG_puts("ippReadIO: Unable to date integer value!");@@ -1363,6 +1387,12 @@
}
break;
case IPP_TAG_RESOLUTION :
+ if (n != 9)
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, 9) < 9)
{ DEBUG_puts("ippReadIO: Unable to read resolution value!");@@ -1379,6 +1409,12 @@
(ipp_res_t)buffer[8];
break;
case IPP_TAG_RANGE :
+ if (n != 8)
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, 8) < 8)
{ DEBUG_puts("ippReadIO: Unable to read range value!");@@ -1394,7 +1430,7 @@
break;
case IPP_TAG_TEXTLANG :
case IPP_TAG_NAMELANG :
- if (n > sizeof(buffer) || n < 4)
+ if (n >= sizeof(buffer) || n < 4)
{ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));return (IPP_ERROR);
@@ -1420,22 +1456,27 @@
n = (bufptr[0] << 8) | bufptr[1];
- if (n >= sizeof(string))
+ if ((bufptr + 2 + n) >= (buffer + sizeof(buffer)) ||
+ n >= sizeof(string))
{- memcpy(string, bufptr + 2, sizeof(string) - 1);
- string[sizeof(string) - 1] = '\0';
+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
}
- else
- {- memcpy(string, bufptr + 2, n);
- string[n] = '\0';
- }
+ memcpy(string, bufptr + 2, n);
+ string[n] = '\0';
+
value->string.charset = _cupsStrAlloc((char *)string);
bufptr += 2 + n;
n = (bufptr[0] << 8) | bufptr[1];
+ if ((bufptr + 2 + n) >= (buffer + sizeof(buffer)))
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
bufptr[2 + n] = '\0';
value->string.text = _cupsStrAlloc((char *)bufptr + 2);
break;
@@ -1477,6 +1518,12 @@
* we need to carry over...
*/
+ if (n >= sizeof(buffer))
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
if ((*cb)(src, buffer, n) < n)
{ DEBUG_puts("ippReadIO: Unable to read member name value!");@@ -1498,6 +1545,12 @@
break;
default : /* Other unsupported values */
+ if (n > sizeof(buffer))
+ {+ DEBUG_printf(("ippReadIO: bad value length %d!\n", n));+ return (IPP_ERROR);
+ }
+
value->unknown.length = n;
if (n > 0)
{