Throw an error if a member attribute occurs outside a collection.

diff --git a/CHANGES.md b/CHANGES.md
index aaa9a848f515a98b9f17748329bbae8a2f1b276a..0081a727ccc040236a6f8daeb36b0921b67927c9 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,6 +24,8 @@ CUPS v2.4rc1 (Pending)
 - The scheduler now includes the `[Job N]` prefix for job log messages, even
   when using syslog logging (Issue #154)
 - Added support for locales using the GB18030 character set (Issue #159)
+- The IPP parser now errors out when reading a member attribute outside a
+  collection.
 - Documentation fixes (Issue #92)
 - Localization updates (Issue #123, Issue #129, Issue #134, Issue #146)
 - USB quirk updates (Apple #5766, Apple #5838, Apple #5843, Apple #5867)

diff --git a/cups/ipp.c b/cups/ipp.c
index adbb26fba13e5c0a3c561db01b6c32fcb0ba470c..5f5b7922c337b135fceb9e7fc8e1432365690367 100644 (file)
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -1,7 +1,7 @@
 /*
  * Internet Printing Protocol functions for CUPS.
  *
- * Copyright © 2007-2019 by Apple Inc.
+ * Copyright © 2007-2021 by Apple Inc.
  * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -3174,6 +3174,13 @@ ippReadIO(void       *src,               /* I - Data source */
              _cupsBufferRelease((char *)buffer);
              return (IPP_STATE_ERROR);
            }
+           else if (!parent)
+           {
+             _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP member attribute outside of collection."), 1);
+             DEBUG_puts("1ippReadIO: member attribute outside of collection.");
+             _cupsBufferRelease((char *)buffer);
+             return (IPP_STATE_ERROR);
+           }
 
             if (ipp->current)
              ipp->prev = ipp->current;