Add missing length check (<rdar://problem/23133230>)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12921 a1ca3aef-8c08-0410-bb20-df032aa958be

diff --git a/CHANGES-2.1.txt b/CHANGES-2.1.txt
index c8525b2e533cc028a9c521424e0cc518ad534359..dd85cf55bdc85af34ebb57386aad50da1095cf35 100644 (file)
--- a/CHANGES-2.1.txt
+++ b/CHANGES-2.1.txt
@@ -5,7 +5,7 @@ CHANGES IN CUPS V2.1.1
 
        - Security hardening fixes (<rdar://problem/23131948>,
          <rdar://problem/23132108>, <rdar://problem/23132353>,
-         <rdar://problem/23132803>)
+         <rdar://problem/23132803>, <rdar://problem/23133230>)
        - The cupsGetPPD* functions did not work with IPP printers (STR #4725)
        - Some older HP LaserJet printers need a delayed close when printing
          using the libusb-based USB backend (STR #4549)

diff --git a/backend/usb-darwin.c b/backend/usb-darwin.c
index 2bf9615c8df229af3f1acc2858d8930ce9506918..2df79f4fed3ee00c2ec80687f5d0ae911492075a 100644 (file)
--- a/backend/usb-darwin.c
+++ b/backend/usb-darwin.c
@@ -1654,7 +1654,7 @@ static CFStringRef copy_printer_interface_deviceid(printer_interface_t printer,
                        {
                                ret = CFStringCreateWithBytes(NULL, (const UInt8 *) &request.pData[2], actualLength - 2, kCFStringEncodingUTF8, false);
                        }
-                       else {
+                       else if (actualLength > 2) {
                                err = sendRequest(actualLength);
                                if (err == kIOReturnSuccess && request.wLenDone > 0)
                                {