Fix encoding of extension values (Issue #913)

diff --git a/CHANGES.md b/CHANGES.md
index 1ae376fd494947ec99f24ca07c5229282e7c1389..bb99b129bd10f7f659cfe5fbe933b1165f86875c 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -59,6 +59,7 @@ Changes in CUPS v2.5b1 (TBA)
 - Fixed Oki 407 freeze when printing larger jobs (Issue #877)
 - Fixed checking for required attributes during PPD generation (Issue #890)
 - Fixed encoding of IPv6 addresses in HTTP requests (Issue #903)
+- Fixed encoding of `IPP_TAG_EXTENSION` values in IPP messages (Issue #913)
 - Removed hash support for SHA2-512-224 and SHA2-512-256.
 - Removed `mantohtml` script for generating html pages (use
   `https://www.msweet.org/mantohtml/`)

diff --git a/cups/ipp.c b/cups/ipp.c
index 09e4d35d2b4f60a58d871fb962110cdb12490d74..6e1d9cf1c845fb0a59b98a2f20a8b9e3aff90d23 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -2139,7 +2139,7 @@ ippGetOctetString(
     int             *datalen)          // O - Length of octetString data
 {
   // Range check input...
-  if (!attr || attr->value_tag != IPP_TAG_STRING || element < 0 || element >= attr->num_values)
+  if (!attr || (attr->value_tag != IPP_TAG_STRING && attr->value_tag != IPP_TAG_EXTENSION) || element < 0 || element >= attr->num_values)
   {
     if (datalen)
       *datalen = 0;
@@ -2669,25 +2669,6 @@ ippReadIO(void        *src,              // I - Data source
 
          // Read this attribute...
           tag = (ipp_tag_t)buffer[0];
-          if (tag == IPP_TAG_EXTENSION)
-          {
-            // Read 32-bit "extension" tag...
-           if ((*cb)(src, buffer, 4) < 4)
-           {
-             DEBUG_puts("1ippReadIO: Callback returned EOF/error");
-             goto rollback;
-           }
-
-           tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
-
-            if (tag & IPP_TAG_CUPS_CONST)
-            {
-              // Fail if the high bit is set in the tag...
-             _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
-             DEBUG_printf("1ippReadIO: bad tag 0x%x.", tag);
-             goto rollback;
-            }
-          }
 
          if (tag == IPP_TAG_END)
          {
@@ -3507,7 +3488,7 @@ ippSetOctetString(
 
 
   // Range check input...
-  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_STRING && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || datalen < 0 || datalen > IPP_MAX_LENGTH)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_STRING && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN && (*attr)->value_tag != IPP_TAG_EXTENSION) || element < 0 || element > (*attr)->num_values || datalen < 0 || datalen > IPP_MAX_LENGTH)
     return (0);
 
   // Set the value and return...
@@ -4090,6 +4071,16 @@ ippSetValueTag(
         if (temp_tag == IPP_TAG_NAME || temp_tag == IPP_TAG_NAMELANG)
           break;                       // Silently "allow" name -> keyword
 
+        return (0);
+
+    case IPP_TAG_EXTENSION :
+        if (temp_tag == IPP_TAG_STRING && value_tag == IPP_TAG_EXTENSION)
+        {
+          // Allow octetString -> extension
+          (*attr)->value_tag = value_tag;
+          break;
+        }
+
     default :
         return (0);
   }
@@ -4866,22 +4857,10 @@ ippWriteIO(void        *dst,            // I - Destination
            }
 
             // Write the value tag, name length, and name string...
-            DEBUG_printf("2ippWriteIO: writing value tag=%x(%s)", attr->value_tag, ippTagString(attr->value_tag));
-            DEBUG_printf("2ippWriteIO: writing name=%d,\"%s\"", n, attr->name);
-
-            if (attr->value_tag > 0xff)
-            {
-              *bufptr++ = IPP_TAG_EXTENSION;
-             *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 24);
-             *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 16);
-             *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 8);
-             *bufptr++ = (ipp_uchar_t)attr->value_tag;
-            }
-            else
-            {
-             *bufptr++ = (ipp_uchar_t)attr->value_tag;
-           }
+           DEBUG_printf("2ippWriteIO: writing value tag=%x(%s)", attr->value_tag, ippTagString(attr->value_tag));
+           DEBUG_printf("2ippWriteIO: writing name=%d,\"%s\"", n, attr->name);
 
+           *bufptr++ = (ipp_uchar_t)attr->value_tag;
            *bufptr++ = (ipp_uchar_t)(n >> 8);
            *bufptr++ = (ipp_uchar_t)n;
            memcpy(bufptr, attr->name, (size_t)n);

diff --git a/cups/ipp.h b/cups/ipp.h
index b4bc1da9406ca2f7e56c8fbbb5eae34a097502d7..891b1a4ca098474db41633775f219e4ae7710bae 100644 (file)
--- a/cups/ipp.h
+++ b/cups/ipp.h
@@ -493,7 +493,7 @@ typedef enum ipp_tag_e                      // Value and group tag values for attributes
   IPP_TAG_LANGUAGE,                    // Language value
   IPP_TAG_MIMETYPE,                    // MIME media type value
   IPP_TAG_MEMBERNAME,                  // Collection member name value @exclude all@
-  IPP_TAG_EXTENSION = 0x7f,            // Extension point for 32-bit tags @exclude all@
+  IPP_TAG_EXTENSION = 0x7f,            // Extension point for 32-bit tags (part of value)
   IPP_TAG_CUPS_MASK = 0x7fffffff,      // Mask for copied attribute values @private@
   // The following expression is used to avoid compiler warnings with +/-0x80000000
   IPP_TAG_CUPS_CONST = -0x7fffffff-1   // Bitflag for copied/const attribute values @private@