X-Git-Url: http://git.ipfire.org/?p=thirdparty%2Fcups.git;a=blobdiff_plain;f=cups%2Fipp.c;h=f212fd1179eaed642f7561c7d37d9913e663468f;hp=c068d84ce81de6b8e8faa36630e413b5f00c9b81;hb=91c84a3551145559de2956179661e111e373db95;hpb=080811b190031b9182e96dc76fc610fadfeaec21

diff --git a/cups/ipp.c b/cups/ipp.c
index c068d84ce..f212fd117 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -4,7 +4,7 @@
  *   Internet Printing Protocol support functions for the Common UNIX
  *   Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -361,7 +361,12 @@ ippAddOctetString(ipp_t      *ipp,	/* I - IPP message */
 
   if (data)
   {
-    attr->values[0].unknown.data = malloc(datalen);
+    if ((attr->values[0].unknown.data = malloc(datalen)) == NULL)
+    {
+      ippDeleteAttribute(ipp, attr);
+      return (NULL);
+    }
+
     memcpy(attr->values[0].unknown.data, data, datalen);
   }
 
@@ -1277,7 +1282,11 @@ ippReadIO(void       *src,		/* I - Data source */
             if (ipp->current)
 	      ipp->prev = ipp->current;
 
-	    attr = ipp->current = _ippAddAttr(ipp, 1);
+	    if ((attr = ipp->current = _ippAddAttr(ipp, 1)) == NULL)
+	    {
+	      DEBUG_puts("ippReadIO: unable to allocate attribute!");
+	      return (IPP_ERROR);
+	    }
 
 	    DEBUG_printf(("ippReadIO: name=\'%s\', ipp->current=%p, ipp->prev=%p\n",
 	                  buffer, ipp->current, ipp->prev));
@@ -1538,7 +1547,7 @@ ippReadIO(void       *src,		/* I - Data source */
 		break;
 
             default : /* Other unsupported values */
-		if (n > sizeof(buffer))
+		if (n > IPP_MAX_LENGTH)
 		{
 		  DEBUG_printf(("ippReadIO: bad value length %d!\n", n));
 		  return (IPP_ERROR);
@@ -1547,7 +1556,12 @@ ippReadIO(void       *src,		/* I - Data source */
                 value->unknown.length = n;
 	        if (n > 0)
 		{
-		  value->unknown.data = malloc(n);
+		  if ((value->unknown.data = malloc(n)) == NULL)
+		  {
+		    DEBUG_puts("ippReadIO: Unable to allocate value");
+		    return (IPP_ERROR);
+		  }
+
 	          if ((*cb)(src, value->unknown.data, n) < n)
 		  {
 	            DEBUG_puts("ippReadIO: Unable to read unsupported value!");