From b018978c278d42c7abf78941251b887c95dfdb07 Mon Sep 17 00:00:00 2001 From: Michael R Sweet Date: Fri, 13 Dec 2019 09:27:14 -0500 Subject: [PATCH] CVE-2019-2228: Fix ippSetValueTag validation of default language. --- CHANGES.md | 4 +++- cups/ipp.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 2afa7686a..78ca1f98a 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,4 +1,4 @@ -CHANGES - 2.3.1 - 2019-12-04 +CHANGES - 2.3.1 - 2019-12-13 ============================ @@ -6,6 +6,8 @@ Changes in CUPS v2.3.1 ---------------------- - Documentation updates (Issue #5661, #5674, #5682) +- CVE-2019-2228: The `ippSetValuetag` function did not validate the default + language value. - Fixed a crash bug in the web interface (Issue #5621) - The PPD cache code now looks up page sizes using their dimensions (Issue #5633) diff --git a/cups/ipp.c b/cups/ipp.c index d0cac8cfe..1595b8b61 100644 --- a/cups/ipp.c +++ b/cups/ipp.c @@ -4565,7 +4565,7 @@ ippSetValueTag( return (0); if (ipp->attrs && ipp->attrs->next && ipp->attrs->next->name && - !strcmp(ipp->attrs->next->name, "attributes-natural-language")) + !strcmp(ipp->attrs->next->name, "attributes-natural-language") && (ipp->attrs->next->value_tag & IPP_TAG_CUPS_MASK) == IPP_TAG_LANGUAGE) { /* * Use the language code from the IPP message... -- 2.39.2