From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Date: Fri, 23 Oct 2015 20:08:36 +0000 (+0000)
Subject: Add missing length check (<rdar://problem/23133230>)
X-Git-Tag: v2.2b1~172
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd5ce3a47b8ffb290d59e6727ecfa445455535d1;p=thirdparty%2Fcups.git

Add missing length check (<rdar://problem/23133230>)


git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12921 a1ca3aef-8c08-0410-bb20-df032aa958be
---

diff --git a/CHANGES-2.1.txt b/CHANGES-2.1.txt
index c8525b2e53..dd85cf55bd 100644
--- a/CHANGES-2.1.txt
+++ b/CHANGES-2.1.txt
@@ -5,7 +5,7 @@ CHANGES IN CUPS V2.1.1
 
 	- Security hardening fixes (<rdar://problem/23131948>,
 	  <rdar://problem/23132108>, <rdar://problem/23132353>,
-	  <rdar://problem/23132803>)
+	  <rdar://problem/23132803>, <rdar://problem/23133230>)
 	- The cupsGetPPD* functions did not work with IPP printers (STR #4725)
 	- Some older HP LaserJet printers need a delayed close when printing
 	  using the libusb-based USB backend (STR #4549)
diff --git a/backend/usb-darwin.c b/backend/usb-darwin.c
index 2bf9615c8d..2df79f4fed 100644
--- a/backend/usb-darwin.c
+++ b/backend/usb-darwin.c
@@ -1654,7 +1654,7 @@ static CFStringRef copy_printer_interface_deviceid(printer_interface_t printer,
 			{
 				ret = CFStringCreateWithBytes(NULL, (const UInt8 *) &request.pData[2], actualLength - 2, kCFStringEncodingUTF8, false);
 			}
-			else {
+			else if (actualLength > 2) {
 				err = sendRequest(actualLength);
 				if (err == kIOReturnSuccess && request.wLenDone > 0)
 				{