Block invalid group tags when parsing IPP messages.

diff --git a/CHANGES.md b/CHANGES.md
index 7739a3fc4d56f282d0ce02557a6abbd9055b4114..6e46c56524a849debde2def06ab56268174f2bfe 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,7 +1,7 @@
-CHANGES - 2.3rc1 - 2018-05-11
+CHANGES - 2.3b5 - 2018-06-04
 =============================
 
-Changes in CUPS v2.3rc1
+Changes in CUPS v2.3b5
 -----------------------
 
 - The `ipptool` program no longer checks for duplicate attributes when running
@@ -18,6 +18,7 @@ Changes in CUPS v2.3rc1
 - Documentation updates (Issue #5299, Issue #5301, Issue #5306)
 - Fax queues did not support pause (p) or wait-for-dialtone (w) characters
   (rdar://39212256)
+- The IPP parser allowed invalid group tags (rdar://40442124)
 - Fixed a parsing bug in the new authentication code.
 
 

diff --git a/configure b/configure
index 5d7c3cfe58ce9f91af4b0f3741504adfd49a08f0..33a31400cad8d490f2f3da83296584a9b35604b9 100755 (executable)
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.68 for CUPS 2.3b4.
+# Generated by GNU Autoconf 2.68 for CUPS 2.3b5.
 #
 # Report bugs to <https://github.com/apple/cups/issues>.
 #
@@ -560,8 +560,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='CUPS'
 PACKAGE_TARNAME='cups'
-PACKAGE_VERSION='2.3b4'
-PACKAGE_STRING='CUPS 2.3b4'
+PACKAGE_VERSION='2.3b5'
+PACKAGE_STRING='CUPS 2.3b5'
 PACKAGE_BUGREPORT='https://github.com/apple/cups/issues'
 PACKAGE_URL='https://www.cups.org/'
 
@@ -1455,7 +1455,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures CUPS 2.3b4 to adapt to many kinds of systems.
+\`configure' configures CUPS 2.3b5 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1520,7 +1520,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of CUPS 2.3b4:";;
+     short | recursive ) echo "Configuration of CUPS 2.3b5:";;
    esac
   cat <<\_ACEOF
 
@@ -1697,7 +1697,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-CUPS configure 2.3b4
+CUPS configure 2.3b5
 generated by GNU Autoconf 2.68
 
 Copyright (C) 2010 Free Software Foundation, Inc.
@@ -2161,7 +2161,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by CUPS $as_me 2.3b4, which was
+It was created by CUPS $as_me 2.3b5, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   $ $0 $@
@@ -2636,7 +2636,7 @@ fi
 ac_config_headers="$ac_config_headers config.h"
 
 
-CUPS_VERSION="2.3b4"
+CUPS_VERSION="2.3b5"
 CUPS_REVISION=""
 CUPS_BUILD="cups-$CUPS_VERSION"
 
@@ -10586,7 +10586,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by CUPS $as_me 2.3b4, which was
+This file was extended by CUPS $as_me 2.3b5, which was
 generated by GNU Autoconf 2.68.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10649,7 +10649,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-CUPS config.status 2.3b4
+CUPS config.status 2.3b5
 configured by $0, generated by GNU Autoconf 2.68,
   with options \\"\$ac_cs_config\\"
 

diff --git a/configure.ac b/configure.ac
index c502d6471b2fc0ddd3746ad3488ca2ea5b9d14a1..d3423e7e1ffb59508cf76f89c5c08240b930f333 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -12,7 +12,7 @@ dnl We need at least autoconf 2.60...
 AC_PREREQ(2.60)
 
 dnl Package name and version...
-AC_INIT([CUPS], [2.3b4], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
+AC_INIT([CUPS], [2.3b5], [https://github.com/apple/cups/issues], [cups], [https://www.cups.org/])
 
 sinclude(config-scripts/cups-opsys.m4)
 sinclude(config-scripts/cups-common.m4)

diff --git a/cups/ipp.c b/cups/ipp.c
index 7e3b06dd49f38162f3e33461a363e481fc4a0d55..714c2e522fed2720c0573b3a3f552c969670ac9e 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -3084,6 +3084,13 @@ ippReadIO(void       *src,               /* I - Data source */
            ipp->state = IPP_STATE_DATA;
            break;
          }
+         else if (tag == IPP_TAG_ZERO || (tag == IPP_TAG_OPERATION && ipp->curtag != IPP_TAG_ZERO))
+         {
+           _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid group tag."), 1);
+           DEBUG_printf(("1ippReadIO: bad tag 0x%02x.", tag));
+           _cupsBufferRelease((char *)buffer);
+           return (IPP_STATE_ERROR);
+         }
           else if (tag < IPP_TAG_UNSUPPORTED_VALUE)
          {
           /*

diff --git a/cups/testipp.c b/cups/testipp.c
index 0a9024f1f82bfadd9a179cfb77d66df95028a7b9..6dd192da939229277f690773b5051b3a902c8fa8 100644 (file)
--- a/cups/testipp.c
+++ b/cups/testipp.c
@@ -738,7 +738,7 @@ main(int  argc,                     /* I - Number of command-line arguments */
 
        if (state != IPP_STATE_DATA)
        {
-         printf("Error reading IPP message from \"%s\".\n", argv[i]);
+         printf("Error reading IPP message from \"%s\": %s\n", argv[i], cupsLastErrorString());
          status = 1;
 
          ippDelete(request);