Fix UTF-8 validation (Issue #5509)

diff --git a/CHANGES.md b/CHANGES.md
index 65915d44cd0673ec08a8597ae5e31f3854ffb139..5f72f68eac8f3b1d9134a79e9b509acea1471c69 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,4 +1,4 @@
-CHANGES - 2.3b8 - 2019-01-24
+CHANGES - 2.3b8 - 2019-02-05
 ============================
 
 
@@ -7,6 +7,8 @@ Changes in CUPS v2.3b8
 
 - Fixed a potential crash bug in cups-driverd (rdar://46625579)
 - Fixed a performance regression with large PPDs (rdar://47040759)
+- The `ippValidateAttribute` function did not catch all instances of invalid
+  UTF-8 strings (Issue #5509)
 - Fixed a potential memory leak when reading at the end of a file (Issue #5473)
 - Fixed potential unaligned accesses in the string pool (Issue #5474)
 - Fixed a potential memory leak when loading a PPD file (Issue #5475)

diff --git a/cups/ipp.c b/cups/ipp.c
index cc720d2220cc6cd8b048d618606b4e8a50ccef78..0248cb9d295a01d365e5c49eec29b31b19bd4200 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -4909,30 +4909,24 @@ ippValidateAttribute(
          {
            if ((*ptr & 0xe0) == 0xc0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80)
                break;
+
+             ptr ++;
            }
            else if ((*ptr & 0xf0) == 0xe0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80)
                break;
+
+             ptr += 2;
            }
            else if ((*ptr & 0xf8) == 0xf0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80)
                break;
+
+             ptr += 3;
            }
            else if (*ptr & 0x80)
              break;
@@ -4970,30 +4964,24 @@ ippValidateAttribute(
          {
            if ((*ptr & 0xe0) == 0xc0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80)
                break;
+
+             ptr ++;
            }
            else if ((*ptr & 0xf0) == 0xe0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80)
                break;
+
+             ptr += 2;
            }
            else if ((*ptr & 0xf8) == 0xf0)
            {
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
-               break;
-             ptr ++;
-             if ((*ptr & 0xc0) != 0x80)
+             if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80)
                break;
+
+             ptr += 3;
            }
            else if (*ptr & 0x80)
              break;