Re: [MOD] STR #4219: Scheduler does not validate client-provided UTF8 strings
Michael Sweet <[email protected]> Fri, 18 Jan 2013 11:59:32 -0800 (PST)
| Newsgroups | gmane.comp.printing.cups.bugs |
|---|---|
| Message-ID | <[email protected]> |
DO NOT REPLY TO THIS MESSAGE. INSTEAD, POST ANY RESPONSES TO THE LINK BELOW. [STR Closed w/Resolution] Fixed in Subversion repository. Link: https://www.cups.org/str.php?L4219 Version: 1.6.1 Fix Version: 1.6-current (r10825) _______________________________________________ cups-bugs mailing list [email protected] http://lists.easysw.com/mailman/listinfo/cups-bugs
str4219-1.6.patch
(text/plain, 2.1 KB)
Index: scheduler/ipp.c
===================================================================
--- scheduler/ipp.c (revision 10823)
+++ scheduler/ipp.c (working copy)
@@ -1574,10 +1574,72 @@
priority);
}
- if (!ippFindAttribute(con->request, "job-name", IPP_TAG_NAME))
+ if ((attr = ippFindAttribute(con->request, "job-name", IPP_TAG_ZERO)) == NULL)
ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL,
"Untitled");
+ else if ((attr->value_tag != IPP_TAG_NAME &&
+ attr->value_tag != IPP_TAG_NAMELANG) ||
+ attr->num_values != 1)
+ {
+ send_ipp_status(con, IPP_ATTRIBUTES,
+ _("Bad job-name value: Wrong type or count."));
+ if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
+ attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+ return (NULL);
+ }
+ else
+ {
+ const char *ptr; /* Pointer into string */
+ for (ptr = attr->values[0].string.text; *ptr; ptr ++)
+ {
+ if ((*ptr & 0xe0) == 0xc0)
+ {
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ }
+ else if ((*ptr & 0xf0) == 0xe0)
+ {
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ }
+ else if ((*ptr & 0xf8) == 0xf0)
+ {
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ ptr ++;
+ if ((*ptr & 0xc0) != 0x80)
+ break;
+ }
+ else if (*ptr & 0x80)
+ break;
+ }
+
+ if (*ptr || (ptr - attr->values[0].string.text) > (IPP_MAX_NAME - 1))
+ {
+ if (*ptr)
+ send_ipp_status(con, IPP_ATTRIBUTES,
+ _("Bad job-name value: Bad UTF-8 sequence."));
+ else
+ send_ipp_status(con, IPP_ATTRIBUTES,
+ _("Bad job-name value: Name too long."));
+
+ if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
+ attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+
+ return (NULL);
+ }
+ }
+
if ((job = cupsdAddJob(priority, printer->name)) == NULL)
{
send_ipp_status(con, IPP_INTERNAL_ERROR,