From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Mon, 7 Jun 2021 13:16:39 +0000 (-0400)
Subject: Delete an empty attribute if we aren't able to get the value length, otherwise
X-Git-Tag: v2.4b1~110
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=655ed29289ba92ea680b9c805e9d0bc76b615996;p=thirdparty%2Fcups.git

Delete an empty attribute if we aren't able to get the value length, otherwise
the IPP message will contain a truncated attribute that cannot be written
(Issue #195)
---

diff --git a/CHANGES.md b/CHANGES.md
index 3b22c19910..36faf2aa39 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -46,6 +46,8 @@ CUPS v2.4rc1 (Pending)
   socket or the loopback interface (Issue #185)
 - Fixed a job history update issue in the scheduler (Issue #187)
 - Fixed `job-pages-per-set` value for duplex print jobs.
+- Fixed an edge case in `ippReadIO` to make sure that only complete attributes
+  and values are retained on an error (Issue #195)
 - Documentation fixes (Issue #92, Issue #163, Issue #177, Issue #184)
 - Localization updates (Issue #123, Issue #129, Issue #134, Issue #146,
   Issue #164)
diff --git a/cups/ipp.c b/cups/ipp.c
index 3a341f2175..5a45445451 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -3246,6 +3246,8 @@ ippReadIO(void       *src,		/* I - Data source */
 	  {
 	    DEBUG_puts("1ippReadIO: unable to read value length.");
 	    _cupsBufferRelease((char *)buffer);
+	    if (attr)
+	      ippDeleteAttribute(ipp, attr);
 	    return (IPP_STATE_ERROR);
 	  }