Block invalid group tags when parsing IPP messages.

[thirdparty/cups.git] / cups / ipp.c

diff --git a/cups/ipp.c b/cups/ipp.c
index 7e3b06dd49f38162f3e33461a363e481fc4a0d55..714c2e522fed2720c0573b3a3f552c969670ac9e 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -3084,6 +3084,13 @@ ippReadIO(void       *src,               /* I - Data source */
            ipp->state = IPP_STATE_DATA;
            break;
          }
+         else if (tag == IPP_TAG_ZERO || (tag == IPP_TAG_OPERATION && ipp->curtag != IPP_TAG_ZERO))
+         {
+           _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid group tag."), 1);
+           DEBUG_printf(("1ippReadIO: bad tag 0x%02x.", tag));
+           _cupsBufferRelease((char *)buffer);
+           return (IPP_STATE_ERROR);
+         }
           else if (tag < IPP_TAG_UNSUPPORTED_VALUE)
          {
           /*