diff -up cups-1.3.7/cups/ipp.c.CVE-2010-2941 cups-1.3.7/cups/ipp.c

--- cups-1.3.7/cups/ipp.c.CVE-2010-2941	2008-02-16 00:45:36.000000000 +0000

+++ cups-1.3.7/cups/ipp.c	2010-10-26 10:35:37.299870941 +0100

@@ -1187,15 +1187,18 @@ ippReadIO(void       *src,		/* I - Data 

 	      attr->value_tag = tag;

 	    }

-	    else if (value_tag >= IPP_TAG_TEXTLANG &&

-		     value_tag <= IPP_TAG_MIMETYPE)

+	    else if (value_tag == IPP_TAG_TEXTLANG ||

+		     value_tag == IPP_TAG_NAMELANG ||

+		     (value_tag >= IPP_TAG_TEXT &&

+		      value_tag <= IPP_TAG_MIMETYPE))

             {

 	     /*

 	      * String values can sometimes come across in different

 	      * forms; accept sets of differing values...

 	      */

-	      if (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE)

+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&

+		  (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE))

 	        return (IPP_ERROR);

             }

 	    else if (value_tag != tag)

@@ -2523,6 +2526,7 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I

   {

     case IPP_TAG_TEXT :

     case IPP_TAG_NAME :

+    case IPP_TAG_RESERVED_STRING :

     case IPP_TAG_KEYWORD :

     case IPP_TAG_URI :

     case IPP_TAG_URISCHEME :

diff -up cups-1.3.7/cups/ipp.h.CVE-2010-2941 cups-1.3.7/cups/ipp.h

--- cups-1.3.7/cups/ipp.h.CVE-2010-2941	2007-10-31 18:35:56.000000000 +0000

+++ cups-1.3.7/cups/ipp.h	2010-10-26 10:35:37.300871438 +0100

@@ -94,7 +94,8 @@ typedef enum ipp_tag_e			/**** Format ta

   IPP_TAG_END_COLLECTION,		/* End of collection value */

   IPP_TAG_TEXT = 0x41,			/* Text value */

   IPP_TAG_NAME,				/* Name value */

-  IPP_TAG_KEYWORD = 0x44,		/* Keyword value */

+  IPP_TAG_RESERVED_STRING,		/* Reserved for future string value @private@ */

+  IPP_TAG_KEYWORD,			/* Keyword value */

   IPP_TAG_URI,				/* URI value */

   IPP_TAG_URISCHEME,			/* URI scheme value */

   IPP_TAG_CHARSET,			/* Character set value */