backend,scheduler/ipp.c: Fix 'printer-alert' invalid free

The fix is created by Bernhard Übelacker from apple/cups #5826.

diff --git a/backend/ipp.c b/backend/ipp.c
index 35c0711c06c42207721d8ab8fcd9f96c972033da..3e601b2adeebdc2227da54b3a5456174a0a46be6 100644 (file)
--- a/backend/ipp.c
+++ b/backend/ipp.c
@@ -3075,7 +3075,7 @@ report_printer_state(ipp_t *ipp)  /* I - IPP response */
   * Report alerts and messages...
   */
 
-  if ((pa = ippFindAttribute(ipp, "printer-alert", IPP_TAG_TEXT)) != NULL)
+  if ((pa = ippFindAttribute(ipp, "printer-alert", IPP_TAG_STRING)) != NULL)
     report_attr(pa);
 
   if ((pam = ippFindAttribute(ipp, "printer-alert-message",

diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index 0c44d7d4ad8bc6e5bd7c6cf3188c2afb1aa10c79..68763a0f123abab7dae5220ad76263b5a1082a65 100644 (file)
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -4891,7 +4891,7 @@ copy_printer_attrs(
   }
 
   if (printer->alert && (!ra || cupsArrayFind(ra, "printer-alert")))
-    ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_STRING, "printer-alert", NULL, printer->alert);
+    ippAddOctetString(con->response, IPP_TAG_PRINTER, "printer-alert", printer->alert, (int)strlen(printer->alert));
 
   if (printer->alert_description && (!ra || cupsArrayFind(ra, "printer-alert-description")))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_TEXT, "printer-alert-description", NULL, printer->alert_description);