From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 13 Dec 2019 14:27:14 +0000 (-0500)
Subject: CVE-2019-2228: Fix ippSetValueTag validation of default language.
X-Git-Tag: v2.3.1~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b018978c278d42c7abf78941251b887c95dfdb07;p=thirdparty%2Fcups.git

CVE-2019-2228: Fix ippSetValueTag validation of default language.
---

diff --git a/CHANGES.md b/CHANGES.md
index 2afa7686a8..78ca1f98a8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,4 +1,4 @@
-CHANGES - 2.3.1 - 2019-12-04
+CHANGES - 2.3.1 - 2019-12-13
 ============================
 
 
@@ -6,6 +6,8 @@ Changes in CUPS v2.3.1
 ----------------------
 
 - Documentation updates (Issue #5661, #5674, #5682)
+- CVE-2019-2228: The `ippSetValuetag` function did not validate the default
+  language value.
 - Fixed a crash bug in the web interface (Issue #5621)
 - The PPD cache code now looks up page sizes using their dimensions
   (Issue #5633)
diff --git a/cups/ipp.c b/cups/ipp.c
index d0cac8cfe1..1595b8b610 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -4565,7 +4565,7 @@ ippSetValueTag(
           return (0);
 
         if (ipp->attrs && ipp->attrs->next && ipp->attrs->next->name &&
-            !strcmp(ipp->attrs->next->name, "attributes-natural-language"))
+            !strcmp(ipp->attrs->next->name, "attributes-natural-language") && (ipp->attrs->next->value_tag & IPP_TAG_CUPS_MASK) == IPP_TAG_LANGUAGE)
         {
          /*
           * Use the language code from the IPP message...