diff -up cups-1.2.4/scheduler/ipp.c.CVE-2008-5183 cups-1.2.4/scheduler/ipp.c
--- cups-1.2.4/scheduler/ipp.c.CVE-2008-5183	2008-12-03 15:35:31.000000000 +0000
+++ cups-1.2.4/scheduler/ipp.c	2008-12-03 15:35:31.000000000 +0000
@@ -1902,24 +1902,25 @@ add_job_subscriptions(
     if (mask == CUPSD_EVENT_NONE)
       mask = CUPSD_EVENT_JOB_COMPLETED;
 
-    sub = cupsdAddSubscription(mask, cupsdFindDest(job->dest), job, recipient,
-                               0);
+    if ((sub = cupsdAddSubscription(mask, cupsdFindDest(job->dest), job,
+                                    recipient, 0)) != NULL)
+    {
+      sub->interval = interval;
 
-    sub->interval = interval;
+      cupsdSetString(&sub->owner, job->username);
 
-    cupsdSetString(&sub->owner, job->username);
+      if (user_data)
+      {
+	sub->user_data_len = user_data->values[0].unknown.length;
+	memcpy(sub->user_data, user_data->values[0].unknown.data,
+	       sub->user_data_len);
+      }
 
-    if (user_data)
-    {
-      sub->user_data_len = user_data->values[0].unknown.length;
-      memcpy(sub->user_data, user_data->values[0].unknown.data,
-             sub->user_data_len);
+      ippAddSeparator(con->response);
+      ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
+		    "notify-subscription-id", sub->id);
     }
 
-    ippAddSeparator(con->response);
-    ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
-                  "notify-subscription-id", sub->id);
-
     if (attr)
       attr = attr->next;
   }
@@ -4965,7 +4966,12 @@ create_subscription(
     else
       job = NULL;
 
-    sub = cupsdAddSubscription(mask, printer, job, recipient, 0);
+    if ((sub = cupsdAddSubscription(mask, printer, job, recipient, 0)) == NULL)
+    {
+      send_ipp_status(con, IPP_TOO_MANY_SUBSCRIPTIONS,
+		      _("There are too many subscriptions."));
+      return;
+    }
 
     if (job)
       cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription %d for job %d",
diff -up cups-1.2.4/scheduler/subscriptions.c.CVE-2008-5183 cups-1.2.4/scheduler/subscriptions.c
--- cups-1.2.4/scheduler/subscriptions.c.CVE-2008-5183	2008-12-03 15:35:31.000000000 +0000
+++ cups-1.2.4/scheduler/subscriptions.c	2008-12-03 15:44:09.000000000 +0000
@@ -344,8 +344,54 @@ cupsdAddSubscription(
   * Limit the number of subscriptions...
   */
 
-  if (cupsArrayCount(Subscriptions) >= MaxSubscriptions)
+  if (MaxSubscriptions > 0 && cupsArrayCount(Subscriptions) >= MaxSubscriptions)
+  {
+    cupsdLogMessage(CUPSD_LOG_DEBUG,
+                    "cupsdAddSubscription: Reached MaxSubscriptions %d",
+		    MaxSubscriptions);
     return (NULL);
+  }
+
+  if (MaxSubscriptionsPerJob > 0 && job)
+  {
+    int	count;				/* Number of job subscriptions */
+
+    for (temp = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions),
+             count = 0;
+         temp;
+	 temp = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+      if (temp->job == job)
+        count ++;
+
+    if (count >= MaxSubscriptionsPerJob)
+    {
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+		      "cupsdAddSubscription: Reached MaxSubscriptionsPerJob %d "
+		      "for job #%d", MaxSubscriptionsPerJob, job->id);
+      return (NULL);
+    }
+  }
+
+  if (MaxSubscriptionsPerPrinter > 0 && dest)
+  {
+    int	count;				/* Number of printer subscriptions */
+
+    for (temp = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions),
+             count = 0;
+         temp;
+	 temp = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+      if (temp->dest == dest)
+        count ++;
+
+    if (count >= MaxSubscriptionsPerPrinter)
+    {
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+		      "cupsdAddSubscription: Reached "
+		      "MaxSubscriptionsPerPrinter %d for %s",
+		      MaxSubscriptionsPerPrinter, dest->name);
+      return (NULL);
+    }
+  }
 
  /*
   * Allocate memory for this subscription...
@@ -758,7 +804,6 @@ cupsdLoadAllSubscriptions(void)
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "Syntax error on line %d of subscriptions.conf.",
 	              linenum);
-      return;
     }
     else if (!strcasecmp(line, "Events"))
     {
diff -up cups-1.2.4/test/4.4-subscription-ops.test.CVE-2008-5183 cups-1.2.4/test/4.4-subscription-ops.test
--- cups-1.2.4/test/4.4-subscription-ops.test.CVE-2008-5183	2006-08-16 21:05:58.000000000 +0100
+++ cups-1.2.4/test/4.4-subscription-ops.test	2008-12-03 15:35:31.000000000 +0000
@@ -116,6 +116,32 @@
 	EXPECT notify-events
 	DISPLAY notify-events
 }
+{
+	# The name of the test...
+	NAME "Check MaxSubscriptions limits"
+
+	# The operation to use
+	OPERATION Create-Printer-Subscription
+	RESOURCE /
+
+	# The attributes to send
+	GROUP operation
+	ATTR charset attributes-charset utf-8
+	ATTR language attributes-natural-language en
+	ATTR uri printer-uri $method://$hostname:$port/printers/Test1
+
+        GROUP subscription
+	ATTR uri notify-recipient-uri testnotify://
+	ATTR keyword notify-events printer-state-changed
+	ATTR integer notify-lease-duration 5
+
+	# What statuses are OK?
+	STATUS client-error-too-many-subscriptions
+
+	# What attributes do we expect?
+	EXPECT attributes-charset
+	EXPECT attributes-natural-language
+}
 
 #
 # End of "$Id: 4.4-subscription-ops.test 5833 2006-08-16 20:05:58Z mike $"
diff -up cups-1.2.4/test/run-stp-tests.sh.CVE-2008-5183 cups-1.2.4/test/run-stp-tests.sh
--- cups-1.2.4/test/run-stp-tests.sh.CVE-2008-5183	2006-05-05 17:33:57.000000000 +0100
+++ cups-1.2.4/test/run-stp-tests.sh	2008-12-03 15:35:31.000000000 +0000
@@ -305,6 +305,7 @@ FontPath /tmp/cups-$user/share/fonts
 DocumentRoot $root/doc
 RequestRoot /tmp/cups-$user/spool
 TempDir /tmp/cups-$user/spool/temp
+MaxSubscriptions 3
 MaxLogSize 0
 AccessLog /tmp/cups-$user/log/access_log
 ErrorLog /tmp/cups-$user/log/error_log