From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Mon, 29 Mar 2021 00:57:55 +0000 (-0400)
Subject: Protect against group tags inside collections.
X-Git-Tag: v2.4b1~163^2~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3f93a0cbee06c3f18361ad74e0183efe39a60281;p=thirdparty%2Fcups.git

Protect against group tags inside collections.
---

diff --git a/cups/ipp.c b/cups/ipp.c
index 5f5b7922c3..3a341f2175 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -3004,7 +3004,14 @@ ippReadIO(void       *src,		/* I - Data source */
 	    * Group tag...  Set the current group and continue...
 	    */
 
-            if (ipp->curtag == tag)
+            if (parent)
+            {
+	      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid group tag."), 1);
+	      DEBUG_printf(("1ippReadIO: bad tag 0x%02x.", tag));
+	      _cupsBufferRelease((char *)buffer);
+	      return (IPP_STATE_ERROR);
+            }
+            else if (ipp->curtag == tag)
 	      ipp->prev = ippAddSeparator(ipp);
             else if (ipp->current)
 	      ipp->prev = ipp->current;