From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 19 Jan 2026 16:38:24 +0000 (-0500)
Subject: Fix possible corruption of previous pointer in ipp_t linked list (Issue #138)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6c7d9bbab51a359bfa99a916019ee4b6c8a2c10c;p=thirdparty%2Fcups.git

Fix possible corruption of previous pointer in ipp_t linked list (Issue #138)
---

diff --git a/cups/ipp.c b/cups/ipp.c
index 622e0c981e..d2b8d6eaed 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -1,7 +1,7 @@
 //
 // Internet Printing Protocol functions for CUPS.
 //
-// Copyright © 2022-2025 by OpenPrinting.
+// Copyright © 2022-2026 by OpenPrinting.
 // Copyright © 2007-2021 by Apple Inc.
 // Copyright © 1997-2007 by Easy Software Products, all rights reserved.
 //
@@ -6080,7 +6080,7 @@ ipp_set_value(ipp_t           *ipp,	// IO - IPP message
 #endif // !__clang_analyzer__
     DEBUG_printf("4debug_alloc: %p %s %s%s (%d)", (void *)temp, temp->name, temp->num_values > 1 ? "1setOf " : "", ippTagString(temp->value_tag), temp->num_values);
 
-    if (ipp->current == *attr && ipp->prev)
+    if (ipp->current == *attr && ipp->prev && ipp->prev->next == *attr)
     {
       // Use current "previous" pointer...
       prev = ipp->prev;